I found it interesting that Cisco added this their most recent IDS
signatures:

[snip]

PLATFORM SIGID   SIGNAME             ENGINE       SEVERITY ENABLED

5.x      5816.0  TOR Client Activity SERVICE-HTTP Low      True

[snip]

Go figure.

- ferg


--
"Fergie", a.k.a. Paul Ferguson
 Engineering Architecture for the Internet
 fergdawg(at)netzero.net
 ferg's tech blog: http://fergdawg.blogspot.com/