Why Tor Only Anonymizes TCP Traffic by Default

The Tor network is fundamentally designed to route and anonymize only Transmission Control Protocol (TCP) traffic, leaving User Datagram Protocol (UDP) and raw ICMP packets unrouted by default. This limitation is not an oversight, but a deliberate architectural decision rooted in how Tor establishes multi-layered encryption circuits, manages network congestion, and interfaces with applications via SOCKS proxies.

Circuit-Based Onion Routing Requires Reliable Delivery

Tor functions by wrapping data in multiple layers of encryption and sending it through a three-node circuit: the guard node, the middle node, and the exit node. For this layered decryption to succeed, data cells must arrive in the exact sequence they were transmitted and without data loss.

• Sequential Integrity: TCP guarantees in-order packet delivery, error-checking, and automatic retransmission of lost packets.
• Encryption Dependency: If a packet drops or arrives out of order—a common occurrence with UDP—the onion-routing decryption process fails, breaking the cryptographic state between the client and the relay nodes.

The Design of SOCKS Proxies

Tor provides a local SOCKS5 proxy interface (typically on port 9050 or 9150) that applications use to direct their traffic into the network.

The SOCKS protocol was originally created as a stream-based proxy standard primarily built for TCP connections. While SOCKS5 includes theoretical specifications for UDP association, Tor’s internal protocol—specifically its RELAY_DATA cell format—is strictly optimized for multiplexing byte streams rather than isolated datagrams. Implementing UDP would require Tor to either emulate a full network stack or establish separate connection states for every stateless UDP exchange.

Congestion Control and Network Overhead

Tor already introduces significant latency due to routing traffic across multiple geographic nodes. Managing network traffic inside the Tor network requires complex congestion control mechanisms:

1. Multiplexing: Tor bundles multiple user streams into single TLS connections between relays to prevent observers from correlating individual packets.
2. Backpressure and Flow Control: TCP provides built-in flow control (windowing) that allows relays to signal when they are overwhelmed. UDP lacks these congestion signals, meaning unthrottled UDP traffic could easily saturate relay nodes and degrade performance across the entire network.

Handling DNS and non-TCP Protocols

Because standard DNS queries rely on UDP over port 53, standard lookups can bypass Tor and cause identity-exposing “DNS leaks.” To mitigate this, Tor translates DNS requests into custom, stream-based TCP commands within the Tor protocol, resolving domain names directly at the exit node.

Applications that rely strictly on UDP (such as WebRTC, VoIP services, and most online games) cannot route their traffic through Tor by default. Users requiring UDP anonymization must encapsulate their datagrams inside TCP tunnels using third-party tools, VPN-over-Tor configurations, or specialized software like OnionCat.