[tor-relays] Intrusion Prevention System Software - Snort or Suricata

[krishna e bera]

On 04/10/16 08:48 AM, pa011 wrote:
> One of my main ISP is going mad with the number of abuses he gets from my Exits (currently most on port 80). 
> He asks me to install "Intrusion Prevention System Software" or shutting down the servers.

You can first ask him for a copy of the complaints in order to
understand what sort of alleged abuses are taking place.  Are the
complaints about spam or scraping or web server exploits or something else?

You can change your exit policy to reduce likelihood of complaints:
https://blog.torproject.org/blog/tips-running-exit-node

> As far as I understand implementing such a software is not going together with Tor - am I right?

If your exit nodes tamper with traffic in any way they will be labelled
as Bad Exit. (Tor tries to be net neutral.)
https://trac.torproject.org/projects/tor/wiki/doc/badRelays