Traditional attacks against anonymous routing systems aim to uncover the identities of those involved, however, a more likely goal of attackers is to block or degrade the network itself, discouraging participation and forcing vulnerable users to communicate using less secure means. Since these anonymous networks operate on known protocols and employ strong encryption it is difficult to distinguish them from regular traffic. This paper proposes a method for identifying traffic belonging to anonymous networks by examining their communication patterns. If successful the method would enable the identification of Tor usage and thus allow for more directed attacks and possible user identification.