How effective are these things on encrypted data? How effective are they against protocol and application-level attacks (like slow loris or opening up thousands of connections to the introduction points)? Because you can't do a traditional DDOS like syn floods against a hidden service. A Tor circuit only works if a proper TCP handshake is done. And these things look like they scan for traditional DDOS attacks.