Re: [tor-relays] 'relay early' attack detection at the infrastructure level

On 8/2/14, Roger Dingledine arma@mit.edu wrote:

On Fri, Aug 01, 2014 at 10:08:41PM -0400, krishna e bera wrote:

...

According to

https://blog.torproject.org/blog/tor-security-advisory-relay-early-traffic-c...

the RELAY_EARLY cell has common legitimate uses. How can we distinguish an attack from those?

Correctly-behaving Tor relays never send RELAY_CELL cells backwards (towards the client) on the circuit.

So if you see one, it's somebody not following the protocol.

Might be a stupid question sorry, but why not just block such relay-early packets coming in the wrong direction?