Okay, but my question was, how traffic could be correlated if the atttacker has traffic-logs from all servers a possible user could use (e.g. all server operated by one provider/in one country) - but he does not know the user himself.
So, he could follow the tcp-stream,i think: At first, he examines the log of the exit-node, an he detects, that there is some specific traffic ingoing and ountgoing at the same time. And then, he follows this stream through the other relays... _______________________________________________ tor-talk mailing list [email protected] https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
