[tor-talk] tor-exit running ntop

John Case case at SDF.ORG
Mon Dec 19 18:15:18 UTC 2011

On Mon, 19 Dec 2011, grarpamp wrote:

>> Maybe they are running sniffers or just traffic statistics?
> Cute. However, it is certainly safe to assume that many nodes,
> many ISP's and many 'other' are running such things transparently
> for equally known and unknown reasons. So this is of no particular
> cause for alarm or action.

First of all, your test is for servers that are answering on TCP 3000, 
which could very well be anything.  Perhaps ntop, perhaps nethack.  Who 

Second, ntop provides a subset of the information that anyone can 
trivially collect with tcpdump.

Any Tor user should assume that a baseline of traffic analysis and logging 
is being done on all relays - exit or not - and adjust your behavior 

More information about the tor-talk mailing list