1# Tor - The Onion Router - used for anonymization - http://tor.eff.org 2# Pattern attributes: good notsofast notsofast 3# Protocol groups: networking 4# Wiki: http://protocolinfo.org/wiki/Tor 5# 6# This pattern has been tested and is believed to work well. 7# 8# It matches on the second packet. I have no idea how the protocol 9# works, but this matches every stream I have made using Tor 0.1.0.16 as 10# a client on Linux. 11# 12# It does NOT attempt to match the HTTP request that fetches the list of 13# Tor servers. 14 15tor 16TOR1.*<identity> 17