What Information Can a Tor Middle Relay ISP See?

Operating a Tor middle relay provides strong cryptographic isolation, meaning an Internet Service Provider (ISP) hosting the relay has strictly limited visibility into the network traffic. Because a middle relay only forwards encrypted data between an entry guard and an exit node, the ISP cannot see the original user or the final destination. This article explains precisely what data is visible to a middle relay’s ISP and what remains entirely hidden.

Visible Information

An ISP monitoring a Tor middle relay can observe standard network-level metadata and transport characteristics:

• Upstream and Downstream IP Addresses: The ISP can see the IP addresses and ports of the Tor nodes directly communicating with the relay. This includes incoming connections from the Entry/Guard nodes and outgoing connections to the Exit nodes (or other relays).
• Data Volume and Bandwidth: The ISP can measure the total amount of data entering and leaving the server, bandwidth utilization rates, and overall traffic throughput.
• Connection Timestamps and Duration: The ISP logs when connections are established, how long they remain open, and the precise timing of packet transmissions.
• Encrypted Tor Protocol Traffic: The ISP can identify that the server is using TLS-encrypted Tor protocol traffic based on packet structure, port usage, and cryptographic handshakes.
• Public Relay Status: Because middle relays are published in the public Tor consensus directory, the ISP can easily correlate the server’s IP address with the official list of active Tor relays.

Information That Remains Hidden

Due to Tor’s layered onion routing design, critical user and destination data is cryptographically obscured from the middle relay and its ISP:

• The Original Client’s IP Address: The identity and location of the originating user are known only to the Guard node. The middle relay’s ISP sees incoming packets coming exclusively from the Guard node.
• The Final Destination: The website, server, or service the user is accessing is known only to the Exit node. The middle relay’s ISP sees outgoing packets destined only for an Exit relay.
• The Data Payload: All payload data passing through a middle relay is protected by multiple layers of encryption. Neither the relay operator nor the ISP can decrypt, read, or alter the contents of the transmitted data.
• DNS Requests and Visited URLs: Domain lookups and specific URL paths are resolved at the exit stage of the circuit and are completely inaccessible to the middle relay’s network provider.