I found it interesting that Cisco added this their most recent IDS signatures: [snip] PLATFORM SIGID SIGNAME ENGINE SEVERITY ENABLED 5.x 5816.0 TOR Client Activity SERVICE-HTTP Low True [snip] Go figure. - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/