From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from sog-mx-3.v43.ch3.sourceforge.com ([172.29.43.193]
	helo=mx.sourceforge.net)
	by sfs-ml-1.v29.ch3.sourceforge.com with esmtp (Exim 4.76)
	(envelope-from <gmaxwell@gmail.com>) id 1XBbIA-0003hh-8e
	for bitcoin-development@lists.sourceforge.net;
	Mon, 28 Jul 2014 03:08:02 +0000
Received-SPF: pass (sog-mx-3.v43.ch3.sourceforge.com: domain of gmail.com
	designates 209.85.223.177 as permitted sender)
	client-ip=209.85.223.177; envelope-from=gmaxwell@gmail.com;
	helo=mail-ie0-f177.google.com; 
Received: from mail-ie0-f177.google.com ([209.85.223.177])
	by sog-mx-3.v43.ch3.sourceforge.com with esmtps (TLSv1:RC4-SHA:128)
	(Exim 4.76) id 1XBbI9-0007TV-HU
	for bitcoin-development@lists.sourceforge.net;
	Mon, 28 Jul 2014 03:08:02 +0000
Received: by mail-ie0-f177.google.com with SMTP id at20so5829139iec.8
	for <bitcoin-development@lists.sourceforge.net>;
	Sun, 27 Jul 2014 20:07:56 -0700 (PDT)
MIME-Version: 1.0
X-Received: by 10.42.240.71 with SMTP id kz7mr2773581icb.14.1406516876193;
	Sun, 27 Jul 2014 20:07:56 -0700 (PDT)
Received: by 10.107.14.67 with HTTP; Sun, 27 Jul 2014 20:07:56 -0700 (PDT)
In-Reply-To: <CAAS2fgR+r6VoUse_ropq=p3WTy_qWq68fpCQim1FhcbkCXYtsQ@mail.gmail.com>
References: <CAD5xwhhKKooGBfSY3nZzMmS=3WD=EdX9FQ7mZtQL3fkikuwyLg@mail.gmail.com>
	<20140728024030.GA17724@savin>
	<CAAS2fgR+r6VoUse_ropq=p3WTy_qWq68fpCQim1FhcbkCXYtsQ@mail.gmail.com>
Date: Sun, 27 Jul 2014 20:07:56 -0700
Message-ID: <CAAS2fgTOR=Aytak3jdfDMv_mYoBdXNRevCmZyo-iSAQE2_ys=A@mail.gmail.com>
From: Gregory Maxwell <gmaxwell@gmail.com>
To: Peter Todd <pete@petertodd.org>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Spam-Score: -1.6 (-)
X-Spam-Report: Spam Filtering performed by mx.sourceforge.net.
	See http://spamassassin.org/tag/ for more details.
	-1.5 SPF_CHECK_PASS SPF reports sender host as permitted sender for
	sender-domain
	0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
	(gmaxwell[at]gmail.com)
	-0.0 SPF_PASS               SPF: sender matches SPF record
	-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
	author's domain
	0.1 DKIM_SIGNED            Message has a DKIM or DK signature,
	not necessarily valid
	-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
X-Headers-End: 1XBbI9-0007TV-HU
Cc: Bitcoin Dev <bitcoin-development@lists.sourceforge.net>, alex@stamos.org
Subject: Re: [Bitcoin-development] Abnormally Large Tor node accepting only
 Bitcoin traffic
X-BeenThere: bitcoin-development@lists.sourceforge.net
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: <bitcoin-development.lists.sourceforge.net>
List-Unsubscribe: <https://lists.sourceforge.net/lists/listinfo/bitcoin-development>,
	<mailto:bitcoin-development-request@lists.sourceforge.net?subject=unsubscribe>
List-Archive: <http://sourceforge.net/mailarchive/forum.php?forum_name=bitcoin-development>
List-Post: <mailto:bitcoin-development@lists.sourceforge.net>
List-Help: <mailto:bitcoin-development-request@lists.sourceforge.net?subject=help>
List-Subscribe: <https://lists.sourceforge.net/lists/listinfo/bitcoin-development>,
	<mailto:bitcoin-development-request@lists.sourceforge.net?subject=subscribe>
X-List-Received-Date: Mon, 28 Jul 2014 03:08:02 -0000

On Sun, Jul 27, 2014 at 7:45 PM, Gregory Maxwell <gmaxwell@gmail.com> wrote=
:
> Or its a complete snipe hunt, I'm unable to find any nodes with it
> connected to them. Does anyone here have any?
[unimportant update] Turns out that my IPv4 nodes already have
iptables blocking of that subnet, presumably due to other misconduct
there, which might be why I'm not seeing it.

Several other people appear to be observing it, and all it seems to be
doing is listening without sending transactions=E2=80=94 e.g. surveillance
node... not the first time thats happened, but the weird tor
non-exit-flagged-exit adds a fun level of intrigue to it.