On Fri, Aug 01, 2014 at 10:08:41PM -0400, krishna e bera wrote:
According to
https://blog.torproject.org/blog/tor-security-advisory-relay-early-traffic-c...
the RELAY_EARLY cell has common legitimate uses. How can we distinguish an attack from those?
Correctly-behaving Tor relays never send RELAY_CELL cells backwards (towards the client) on the circuit.
So if you see one, it's somebody not following the protocol.
--Roger