[tor-relays] Network Scan through Tor Exit Node (Port 80)

[Robert Ransom]

On Wed, 2 Mar 2011 10:39:44 -0800
Chris Palmer <chris at eff.org> wrote:

> On Mar 2, 2011, at 5:04 AM, Mitar wrote:
> 
> > And what is even more interesting is that our ISP was much more eager
> > for us to reply to those complaints than to complaints for us running
> > a Tor exit node some time ago. At that time they didn't even require
> > from us to respond. They just forwarded us e-mails in a FYI manner.
> > Maybe they changed some policies in meantime.
> 
> Beats me. I hypothesize that some people think scanning is the same as fuzzing or DoSing or sending actual attack packets or something, because they don't know the difference.

That's probably because 'intrusion detection' tools report network
scans as attacks.  Unfortunately, an IDS's author has an incentive to
continue misrepresenting scans as attacks because if he/she/it does not,
his/her/its competitors will advertize the fact that their software
detects more types of 'attacks'.


Robert Ransom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 490 bytes
Desc: not available
URL: <http://lists.torproject.org/pipermail/tor-relays/attachments/20110302/e8b04df2/attachment.pgp>