96 lines
5.6 KiB
Text
96 lines
5.6 KiB
Text
Recorded private-network output, 7 October 2026
|
|
Tor version 0.4.9.13.
|
|
|
|
This is lab traffic only. IDs and paths can differ on another run.
|
|
Captures ran simultaneously for ten seconds. Headers below are excerpts.
|
|
Counts were computed from the complete saved capture text before excerpting.
|
|
Binary payload is omitted. These counts are observations, not proof of encryption.
|
|
|
|
Requests:
|
|
<p>Hello from the web server inside the private Tor network.</p>
|
|
Marker: audit-marker-01
|
|
Stream 28 used circuit 2: da -> relay2 -> exit1
|
|
Positions: guard -> middle -> exit
|
|
|
|
<p>Hello from the web server inside the private Tor network.</p>
|
|
Marker: audit-marker-02
|
|
Stream 31 used circuit 7: da -> relay1 -> exit1
|
|
Positions: guard -> middle -> exit
|
|
|
|
<p>Hello from the web server inside the private Tor network.</p>
|
|
Marker: audit-marker-03
|
|
Stream 34 used circuit 8: da -> relay1 -> exit1
|
|
Positions: guard -> middle -> exit
|
|
|
|
Web log:
|
|
web-1 | Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
|
|
web-1 | 10.77.0.13 - - [07/Oct/2026 15:07:47] "GET /?audit-marker-01 HTTP/1.1" 200 -
|
|
web-1 | 10.77.0.100 - - [07/Oct/2026 15:07:56] "GET /?audit-direct HTTP/1.1" 200 -
|
|
web-1 | 10.77.0.13 - - [07/Oct/2026 15:08:07] "GET /?audit-marker-02 HTTP/1.1" 200 -
|
|
web-1 | 10.77.0.13 - - [07/Oct/2026 15:08:18] "GET /?audit-marker-03 HTTP/1.1" 200 -
|
|
|
|
Guard capture (da):
|
|
Packet headers: 324
|
|
Headers mentioning 10.77.0.100: 88
|
|
Headers mentioning 10.77.0.80: 0
|
|
Occurrences of audit-marker-01 in complete capture text: 0
|
|
Observed IP pairs:
|
|
10.77.0.10 -> 10.77.0.100
|
|
10.77.0.10 -> 10.77.0.11
|
|
10.77.0.10 -> 10.77.0.12
|
|
10.77.0.10 -> 10.77.0.13
|
|
10.77.0.10 -> 10.77.0.14
|
|
10.77.0.100 -> 10.77.0.10
|
|
10.77.0.11 -> 10.77.0.10
|
|
10.77.0.12 -> 10.77.0.10
|
|
10.77.0.13 -> 10.77.0.10
|
|
10.77.0.14 -> 10.77.0.10
|
|
Header excerpts:
|
|
2026-10-07 15:07:46.905646 IP 10.77.0.100.57582 > 10.77.0.10.5000: Flags [P.], seq 3673650497:3673651033, ack 3151577181, win 83, options [nop,nop,TS val 701088483 ecr 2695797422], length 536
|
|
2026-10-07 15:07:46.906631 IP 10.77.0.10.5000 > 10.77.0.100.57582: Flags [P.], seq 1:537, ack 536, win 76, options [nop,nop,TS val 2695798418 ecr 701088483], length 536
|
|
2026-10-07 15:07:46.906666 IP 10.77.0.100.57582 > 10.77.0.10.5000: Flags [.], ack 537, win 83, options [nop,nop,TS val 701088484 ecr 2695798418], length 0
|
|
2026-10-07 15:07:46.907220 IP 10.77.0.100.57582 > 10.77.0.10.5000: Flags [P.], seq 536:1072, ack 537, win 83, options [nop,nop,TS val 701088484 ecr 2695798418], length 536
|
|
2026-10-07 15:07:46.909890 IP 10.77.0.10.5000 > 10.77.0.100.57582: Flags [P.], seq 537:1073, ack 1072, win 76, options [nop,nop,TS val 2695798421 ecr 701088484], length 536
|
|
2026-10-07 15:07:46.910523 IP 10.77.0.100.57582 > 10.77.0.10.5000: Flags [P.], seq 1072:1608, ack 1073, win 83, options [nop,nop,TS val 701088487 ecr 2695798421], length 536
|
|
|
|
Middle capture (relay2):
|
|
Packet headers: 95
|
|
Headers mentioning 10.77.0.100: 0
|
|
Headers mentioning 10.77.0.80: 0
|
|
Occurrences of audit-marker-01 in complete capture text: 0
|
|
Observed IP pairs:
|
|
10.77.0.10 -> 10.77.0.12
|
|
10.77.0.12 -> 10.77.0.10
|
|
10.77.0.12 -> 10.77.0.13
|
|
10.77.0.13 -> 10.77.0.12
|
|
Header excerpts:
|
|
2026-10-07 15:07:47.019887 IP 10.77.0.12.5000 > 10.77.0.10.39792: Flags [P.], seq 369482164:369482700, ack 3249314216, win 77, options [nop,nop,TS val 2653116424 ecr 2310787540], length 536
|
|
2026-10-07 15:07:47.020679 IP 10.77.0.10.39792 > 10.77.0.12.5000: Flags [P.], seq 1:537, ack 536, win 87, options [nop,nop,TS val 2310788537 ecr 2653116424], length 536
|
|
2026-10-07 15:07:47.020688 IP 10.77.0.12.5000 > 10.77.0.10.39792: Flags [.], ack 537, win 77, options [nop,nop,TS val 2653116425 ecr 2310788537], length 0
|
|
2026-10-07 15:07:47.021191 IP 10.77.0.12.5000 > 10.77.0.10.39792: Flags [P.], seq 536:1072, ack 537, win 77, options [nop,nop,TS val 2653116425 ecr 2310788537], length 536
|
|
2026-10-07 15:07:47.024556 IP 10.77.0.10.39792 > 10.77.0.12.5000: Flags [P.], seq 537:1073, ack 1072, win 87, options [nop,nop,TS val 2310788540 ecr 2653116425], length 536
|
|
2026-10-07 15:07:47.025172 IP 10.77.0.12.5000 > 10.77.0.10.39792: Flags [P.], seq 1072:1608, ack 1073, win 77, options [nop,nop,TS val 2653116429 ecr 2310788540], length 536
|
|
|
|
Exit capture (exit):
|
|
Packet headers: 78
|
|
Headers mentioning 10.77.0.100: 0
|
|
Headers mentioning 10.77.0.80: 12
|
|
Occurrences of audit-marker-01 in complete capture text: 2
|
|
Observed IP pairs:
|
|
10.77.0.10 -> 10.77.0.13
|
|
10.77.0.11 -> 10.77.0.13
|
|
10.77.0.12 -> 10.77.0.13
|
|
10.77.0.13 -> 10.77.0.10
|
|
10.77.0.13 -> 10.77.0.11
|
|
10.77.0.13 -> 10.77.0.12
|
|
10.77.0.13 -> 10.77.0.80
|
|
10.77.0.80 -> 10.77.0.13
|
|
Header excerpts:
|
|
2026-10-07 15:07:47.167900 IP 10.77.0.13.40396 > 10.77.0.80.80: Flags [S], seq 3555911058, win 64240, options [mss 1460,sackOK,TS val 1871435982 ecr 0,nop,wscale 10], length 0
|
|
2026-10-07 15:07:47.167914 IP 10.77.0.80.80 > 10.77.0.13.40396: Flags [S.], seq 1210009252, ack 3555911059, win 65160, options [mss 1460,sackOK,TS val 3568326866 ecr 1871435982,nop,wscale 10], length 0
|
|
2026-10-07 15:07:47.167922 IP 10.77.0.13.40396 > 10.77.0.80.80: Flags [.], ack 1, win 63, options [nop,nop,TS val 1871435982 ecr 3568326866], length 0
|
|
2026-10-07 15:07:47.171270 IP 10.77.0.13.40396 > 10.77.0.80.80: Flags [P.], seq 1:91, ack 1, win 63, options [nop,nop,TS val 1871435985 ecr 3568326866], length 90: HTTP: GET /?audit-marker-01 HTTP/1.1
|
|
2026-10-07 15:07:47.171285 IP 10.77.0.80.80 > 10.77.0.13.40396: Flags [.], ack 91, win 64, options [nop,nop,TS val 3568326869 ecr 1871435985], length 0
|
|
2026-10-07 15:07:47.172243 IP 10.77.0.80.80 > 10.77.0.13.40396: Flags [P.], seq 1:187, ack 91, win 64, options [nop,nop,TS val 3568326870 ecr 1871435985], length 186: HTTP: HTTP/1.0 200 OK
|
|
ASCII request line; leading binary header omitted:
|
|
GET /?audit-marker-01 HTTP/1.1
|