Logging isn't enough. You would need to be able to prove that the encrypted blob originated from the potentially infringing IP address and wasn't just merely passing through it. Because if it was the potentially infringing node couldn't have had any clue about what the packet contained.
If all you can see is routing you can't know where packets originate or are destined to. You receive a packet, open your layer of encryption, see where the packet should be going next, log it, and send it forward. You can't possibly know whether the sender created the packet or forwarded it, and you can't possibly know whether the recipient consumed the packet or forwarded it.
You would need to monitor physical network links to determine patterns how the onion style packets travel around.
But with one-hop communications (as suggested by the post I was replying to) then the routing nodes (that could be made to log everything) know both the source and destination addresses as it is the only other hop in a one-hop path.
If all you can see is routing you can't know where packets originate or are destined to. You receive a packet, open your layer of encryption, see where the packet should be going next, log it, and send it forward. You can't possibly know whether the sender created the packet or forwarded it, and you can't possibly know whether the recipient consumed the packet or forwarded it.
You would need to monitor physical network links to determine patterns how the onion style packets travel around.