App for Stream: How can streamfwd detect TOR?

[kwchang_splunk]

Hello stream experts,

Detecting TOR packets is very simple with Splunk App for Stream. It's just searching "app=TOR".
How can streamfwd know whether the packets are TOR or not?
Also I'd like to know whether false-positive detections can happen.

Thank you in advance.

[vshcherbakov_sp · Accepted solution]

hello kwchang,

TOR is detected by analyzing SSL certificate and other SSL handshake data. We have no reported incidents of false positive or false negative TOR classification, but I suppose it's not technically impossible. My guess would be that false negative is more likely than false positive, but again - I'm just speculating here.

HTH

[kwchang_splunk]

Thank you.