>Oxy operates as a hidden service, and connection initiation occurs over two phases: a UDP "knock", followed by a TCP connection that will contain all subsequen

>Oxy operates as a hidden service, and connection initiation occurs over two phases: a UDP "knock", followed by a TCP connection that will contain all subsequent connection data. The TCP connection defaults to port 2600; however, the UDP "knock" uses a port number between 1025 and 65535, derived from the server's "identity" value. By not using a standardized port, detection of oxy services (and thereby deployment of exploits targeting the oxy service) is made more difficult. By not using a standardized port, I can't firewall off UDP on non-essential ports... I hope there's a way to disable this.