  For journalists reporting from a totalitarian regime, whistleblowers and
resistance fighters, the anonymous use of cloud services on the Internet can be
vital for survival. The Tor network provides a free and widely used
anonymization service for everyone. However, there are different approaches to
distinguishing Tor from non-Tor encrypted network traffic, most recently only
due to the (relative) frequencies of hex digits in a single encrypted payload
packet. While conventional data traffic is usually encrypted once, but at least
three times in the case of Tor due to the structure and principle of the Tor
network, we have examined to what extent the number of encryptions contributes
to being able to distinguish Tor from non-Tor encrypted data traffic.
