Re: SANS Paper: Detecting Tor

2008-11-09 Thread Roger Dingledine
On Sun, Nov 09, 2008 at 09:58:22PM -0500, Roc Admin wrote: I just read this article in the SANS reading room called Detecting and Preventing Anonymous Proxy Usage http://www.sans.org/reading_room/whitepapers/detection/32943.php From the article: Wireshark's ability to reconstitute a TCP

Re: SANS Paper: Detecting Tor

2008-11-09 Thread Nick Mathewson
On Sun, Nov 09, 2008 at 09:54:53PM -0500, Roc Admin wrote: I just read this article in the SANS reading room called Detecting and Preventing Anonymous Proxy Usage http://www.sans.org/reading_room/whitepapers/detection/32943.php Cosmetic issues: 1) It's Tor, not TOR. 2) The paper

Re: SANS Paper: Detecting Tor

2008-11-09 Thread Roc Admin
I just read this article in the SANS reading room called Detecting and Preventing Anonymous Proxy Usage http://www.sans.org/reading_room/whitepapers/detection/32943.php From the article: Wireshark's ability to reconstitute a TCP stream was used to observe the content being sent and received. I