exit counts by port number over 61 days

[F. Fox]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Scott Bennett wrote:
(snip)
>>> 	2) Why are there so many exits to the standard socks port?  It
>>> 	seems kind of strange to go all the way through the tor network
>>> 	fully encrypted, only to exit in the clear to a port somewhere
>>> 	else for re-encryption.  Similarly, what about pptp?
>> There are Trojans opening backdoors on that port.
>>
>> http://isc.sans.org/port.html?port=1080
> 
>      Hmm...very interesting.  Maybe I should close that one.
(snip)

Although it's a longshot, another possibility is that someone is
chaining one or more additional, non-Tor open proxies onto the end of
their proxy chain.

They may do this if they want to hide that their proxy is backed by the
Tor network from a destination admin, for example - or if Tor is
blocked, and they know of a one-hop proxy that isn't.

There are plenty of other ports to do this on, though - many of them far
more common than 1080 (and SOCKS) nowadays.

- --
F. Fox
Owner of Tor node "kitsune"
http://fenrisfox.livejournal.com
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iQIcBAEBCAAGBQJJ5lkWAAoJECxKjnsrYHNHW/cP/0inGiVG0yoALVoDm6lPEDTx
bFRsjcBgLwQHBqG9uKTAP4ACgg9UzceNdU0mSlto3dISMznMK1eLJU/QJVi9JlVc
38RrfilZPcdKks0QmA4DWsz3q8GBGEvrZhBn8tsSQIw/NmdoPAbHURJsVp7mFB8x
KJQ4CYD3t25FHptbWpnQTXbCr/SBV7C0s4xPFujEzn8UOtuR7ExIbWUb7C5Ye4pW
XwWgIeMZxRzChRXBOEitH0hZSabLhkMxfY81SF3c1slezwnCNv9tZCliDizFiLqQ
i4u0vrBWbAxVVXrFjKQ4YvaE3V4joZZMN0PzPkZqiMqj3h3ZDTEk2Ug+DdXtJ9/t
3gsyZ5OyMV3Vevwc+Trd1YgFEbIb8wnMFZeCbq1xSNXchTXKcbmgLU8pDQq1S9ha
oNXj5hu7GFm4tMrAokSb3BNiw/rEFtPf9BzdHFfO+L8ICzHVYIXdPjf/XBlA9wfK
BtjhrjA2x+ZVHtUo/EXu58YWoi94sUrciVA0YyXlJBBs/E4f0Nzms9tRisHG1cA9
Lhjhjad7Y9rmqbzD4aN+3A8sfl8RzOJxCEh/12Ua/FO/ihPGoXnlGFrNDzgVnz/f
WNU5mrFQbHlLJ52pd3izdQQL3mSuYLFTZ74Rk8JQde+jXY23V+Aw9q14xvuORIpQ
yifvm8NGR/36q9vBZljT
=IH40
-----END PGP SIGNATURE-----