I've set up a Tor exit relay (0.2.4.17-rc, debian testing) in my VPS, and it's running well (about 20Gbs/day).
But a lot of traffic (about 50%) is using port 9050 for incoming connections. It's something more than random scans.
Because I am worried, I've run tcpdump and the packets length is about 50-60 bytes long. It seems like DOS or flood traffic: external IP tries to connect and my server refuses (RST, ACK), each time.
My Tor relay (OR) port is 9001, and, of course,
SocksPort 0 in my torrc.
Do you think something is wrong with my relay? Why that traffic if my only Tor port is 9001? Should I block that traffic using iptables?