Categorically Analyzing the Network Traffic in the Snowflake Bridge of Tor

Tor is an anonymity network that routes internet traffic through multiple relays to conceal users’ identities and locations. One of the critical components of Tor is the bridge. It is a relay that is not publicly listed but helps users bypass censorship by making it harder for authorities to block Tor connections. In this work, we conduct network traffic analysis using Wireshark to investigate how Tor Bridge Snowflake obfuscates traffic. Our primary objective is to differentiate the traffic patterns of Snowflake (which uses WebRTC for obfuscation) from normal web browsing and to highlight its similarities to typical WebRTC-based applications. To achieve this, we conduct case studies analyzing network traffic from Tor with Snowflake, Firefox web browsing, and Zoom web browser-based meetings, all of which utilize the WebRTC protocol. Our analysis focuses on the protocol sequences and traffic characteristics across these different scenarios. We show how Snowflake traffic exhibits patterns that are more similar to Zoom web browser-based meetings than to standard web browsing. Furthermore, we demonstrate the distinct features of Zoom native application-based video calls in comparison to both WebRTC-based communication and obfuscated traffic from Snowflake. The obtained results provide insights into Snowflake’s obfuscation techniques, revealing how it mimics WebRTC traffic to enhance anonymity while maintaining discernible differences from conventional web and video conferencing traffic.