What Your ISP Can See: Network Forensics and Tor

Your Internet Service Provider is in a privileged position — they see all your network traffic at the transport layer. Understanding exactly what they can and cannot see informs your threat model.

Direct Connection (No Tor/VPN)

ISP sees: every domain you visit (DNS queries), every IP you connect to, connection timing and duration, data volume, protocol type (HTTP, HTTPS, BitTorrent). With HTTPS, they see the domain (SNI) but not page content. With HTTP, they see everything including page content.

With Tor

ISP sees: that you're connecting to Tor (identifiable traffic pattern), the Tor entry guard's IP address, connection timing and volume, nothing about the destination or content. With bridges (obfs4/Snowflake), the ISP can't easily identify the traffic as Tor-related.

Data Retention

EU Data Retention Directive (struck down but national laws remain): 6-24 months. US: no federal requirement, but ISPs retain voluntarily (typically 12-36 months). UK: Investigatory Powers Act mandates 12 months. Australia: 2 years. This retained data can be requested by law enforcement with appropriate legal process.