I usually use Snort when I'm connecting over TOR. It's exposed as an Onion service too: http://agzj5a4be3kgp6yurijk4q7pm2yh4a5nphdg4zozk365yirf7ahuctyd.onion/