I am a user of Tox, my client is qTox (if that makes any difference), and I was just reading their FAQs section when I came across these sections:

How does Tox Protect My Privacy?

Tox protects your privacy by removing the need to rely on central authorities to provide messenger services, concealing your identity(In the form of meta-data, your IP address) from people who are not your authorized friends, enforcing Off-The-Record Messaging as the default and only mode of operation for all messages, and by making your identity impossible to forge without stealing your personal private key on your own computer.

Does Tox leak my IP address?

Tox makes no attempt to cloak your IP address when communicating with other users, as the whole point of peer-to-peer is to connect you directly to your friends. A workaround does exist in the form of tunneling your Tox connections through Tor. However, a user cannot uncover another user's IP address using only a Tox ID to find the user in the DHT, the IP address will only be discernible when the users become “friends.”

So I tried to see if I could find the IPs of some of my contacts (I ask for their prior permission), so I first figured out with netstat -tnap which port qTox was running on, the port was 33445. I then launched WireShark to try and see if I could capture some packets going to and from that port, however I could not find the IPs of any of my contacts (some had given me hints to parts of their IPs and I couldn't even find similar IPs). Though there was such a large amount of traffic (mostly UDP and TCP, but some ICMPs as well) that it was hard to really see anything.

So how exactly can you trace someone's IP through Tox and make sure that it is their IP without asking them for their IP or a hint to it (not because I want to trace the IPs of my contacts without asking them, but so that my method is more foolproof than just capturing packets and asking people which packet came or is going to them)? Or is this the wrong way of doing it?

I have also been reading this section which suggests that it can only be done when the friend request is initially sent? Is this the case?

I am running Ubuntu GNOME 15.10 with GNOME 3.18.

Information Update:

I ran a test, someone gave me their IP, I then captured the packets going to and from the port which qTox is on, I captured the packets which where sent when I sent them a contact request, when they accepted it, and when we talked, however when I filtered out all the packets that were not either to or from their IP, no packets were left.

So even though Tox is meant to use P2P, it doesn't seem to directly connect, so how does it connect and is there any way of my tracing a contact's IP through it?

  • it looks like there is a personal private key that verifies the identity for you and don't forget about security.stackexchange.com – mchid Nov 28 '15 at 21:19
  • 1
    But isn't it a P2P connection? And am I not at least able to tell the IP when I first send the contact request because it does suggest that? Also, I know about the Information Security SE site, however I want to know how to do this specifically using Ubuntu so I thought I would start off asking here. – user364819 Nov 28 '15 at 21:30
  • I don't know enough about Tox but P2P just means t connects to other peers in the network and not necessarily your friends directly. Tor and torrents run on a similar basis... – Thomas Ward Nov 29 '15 at 21:32

When you use software to capture packets on your internal network behind a NAT router, you'll be capturing local traffic.

In that case, you will need to:

  • turn on the router logging (preferably logged to your machine) and cross-reference whatever the router logged with whatever you captured on your machine.


  • disconnect the router and hook your machine directly to the Internet and capture Internet traffic directly.
  • 1
    Finally, invested time to answer o_O – Ravan Dec 3 '15 at 13:37

Tox added Onion routing, similar to Tor, in 2014:

Bob then creates an onion (the packet will go through A, B, C and will end up at D) 
announce request packet with his real public key, ping_id as zeros and
searching for his real public key.

Read more here: https://github.com/irungentoo/toxcore/blob/522f90fee138087db660dccc08413c53f388f604/docs/Prevent_Tracking.txt

  • I have my answer deleted. – A.B. Dec 3 '15 at 21:22

To extend davidbaumann's answer: the onion routing is only used for friend requests, not for established communication. Once a user has accepted a friend request, the communication between those two users is directly peer to peer, minimizing latency. This has the side effect of exposing their IPs to each other. More info here: https://toktok.ltd/spec.html#onion

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy