piotr_n



Offline



Activity: 2040

Merit: 1062





aka tonikt







LegendaryActivity: 2040Merit: 1062aka tonikt Re: the bs "Satoshi:0.8.99" October 27, 2013, 02:58:56 PM

Last edit: October 27, 2013, 03:48:46 PM by piotr_n #2 Yeah, I've seen them as well.

They do nothing except listening for invs and they never give up - when you disconnect them, they immediately try to reconnect,



The only explanation I have is that they seek to find IP addresses from which new transactions originate. Check out gocoin - my original project of full bitcoin node & cold wallet written in Go.

PGP fingerprint: AB9E A551 E262 A87A 13BB 9059 1BE7 B545 CDF3 FD0E PGP fingerprint: AB9E A551 E262 A87A 13BB 9059 1BE7 B545 CDF3 FD0E

Mike Hearn





Offline



Activity: 1526

Merit: 1008







LegendaryActivity: 1526Merit: 1008 Re: the bs "Satoshi:0.8.99" October 27, 2013, 03:46:13 PM #3 Looks like they're mostly hosted at your-server.de



Whoever is doing this, please set your subVer field appropriately. Otherwise it just makes you look like a DoS attacker ....

piotr_n



Offline



Activity: 2040

Merit: 1062





aka tonikt







LegendaryActivity: 2040Merit: 1062aka tonikt Re: the bs "Satoshi:0.8.99" October 27, 2013, 03:51:22 PM #4



How exactly is the guy setting his "subVer field appropriately" going to help anyone with anything here?



And what kid of DoS attacker connects to a node, just to do nothing, except listening for invs?

The node staying idle looks more like it's trying to not DoS attack itself, after being connected to so many peers Sorry, mr polite and competent, but I did not catch that point...How exactly is the guy setting his "subVer field appropriately" going to help anyone with anything here?And what kid of DoS attacker connects to a node, just to do nothing, except listening for invs?The node staying idle looks more like it's trying to not DoS attack itself, after being connected to so many peers Check out gocoin - my original project of full bitcoin node & cold wallet written in Go.

PGP fingerprint: AB9E A551 E262 A87A 13BB 9059 1BE7 B545 CDF3 FD0E PGP fingerprint: AB9E A551 E262 A87A 13BB 9059 1BE7 B545 CDF3 FD0E

Mike Hearn





Offline



Activity: 1526

Merit: 1008







LegendaryActivity: 1526Merit: 1008 Re: the bs "Satoshi:0.8.99" October 27, 2013, 05:44:06 PM #5 I mean if it's legitimate, setting the subVer to reflect the fact that it's not really a Satoshi 0.8.99 node would be useful for helping people figure out what's connecting to them.



Bitcoin is very easy to DoS today. Each node only accepts (I think?) 120 connections, because each open connection uses some RAM even if it's not doing anything. Thus you can use up all available connection slots by connecting to all the nodes lots of times and it costs you hardly any bandwidth.

piotr_n



Offline



Activity: 2040

Merit: 1062





aka tonikt







LegendaryActivity: 2040Merit: 1062aka tonikt Re: the bs "Satoshi:0.8.99" October 27, 2013, 05:48:15 PM

Last edit: October 27, 2013, 06:38:20 PM by piotr_n #6



And BTW these spying nodes have been there for at least a month and I even have this issue addressed And I mean that these nodes seem to be there to not do any DoS attacks, but rather to collect information, so changing the subVer won't change a bit in the matter.And BTW these spying nodes have been there for at least a month and I even have this issue addressed deep on my todo list Check out gocoin - my original project of full bitcoin node & cold wallet written in Go.

PGP fingerprint: AB9E A551 E262 A87A 13BB 9059 1BE7 B545 CDF3 FD0E PGP fingerprint: AB9E A551 E262 A87A 13BB 9059 1BE7 B545 CDF3 FD0E

gmaxwell

Legendary





Offline



Activity: 3178

Merit: 4298









ModeratorLegendaryActivity: 3178Merit: 4298 Re: the bs "Satoshi:0.8.99" October 28, 2013, 02:39:00 AM #9 Quote from: btceic on October 28, 2013, 02:21:22 AM Whats a spying node?

Are you suggesting that bitcoin nodes exist solely to watch the blockchain? To watch transactions as they occur?

They may, BC.i runs nodes that do this. I've seen other aggressive connectors in the past, and surveillance is one of the possible explanations for them but for most of them it's impossible to know for sure.



There are more benign explanations though. For example, some people erroneously believe that connecting to large numbers of nodes is in their interest e.g. they're miners and they think it will improve their block propagation, in fact because the relaying is sequential it generally tends to hurt your block propagation to do this... and they go around addnode=ing hundreds of nodes.



I've spent a fair amount of time trying to figure out how the network can discourage this kind of behavior and don't have any great general solutions. So far the best I can do is They may, BC.i runs nodes that do this. I've seen other aggressive connectors in the past, and surveillance is one of the possible explanations for them but for most of them it's impossible to know for sure.There are more benign explanations though. For example, some people erroneously believe that connecting to large numbers of nodes is in their interest e.g. they're miners and they think it will improve their block propagation, in fact because the relaying is sequential it generally tends to hurt your block propagation to do this... and they go around addnode=ing hundreds of nodes.I've spent a fair amount of time trying to figure out how the network can discourage this kind of behavior and don't have any great general solutions. So far the best I can do is prevent mass-connectors from DOSing the whole network . For anti-spying the best I can suggest right now is moving your nodes behind tor.

piotr_n



Offline



Activity: 2040

Merit: 1062





aka tonikt







LegendaryActivity: 2040Merit: 1062aka tonikt Re: the bs "Satoshi:0.8.99" October 28, 2013, 09:27:39 AM #10 Quote from: btceic on October 28, 2013, 02:21:22 AM Whats a spying node?



Are you suggesting that bitcoin nodes exist solely to watch the blockchain? To watch transactions as they occur?

Yes.



What can be an other reason for a node that keeps connecting to you and after connected is only listening for invs, though never asking for any data?

The only reason that comes to my mind is that it tries to collect IP addresses where new invs originate from. Might also be for new blocks - not necessarily only for transactions.



And that I call a spying node, though you can call it whatever you like. A curious node, for instance Yes.What can be an other reason for a node that keeps connecting to you and after connected is only listening for invs, though never asking for any data?The only reason that comes to my mind is that it tries to collect IP addresses where new invs originate from. Might also be for new blocks - not necessarily only for transactions.And that I call a spying node, though you can call it whatever you like. A curious node, for instance Check out gocoin - my original project of full bitcoin node & cold wallet written in Go.

PGP fingerprint: AB9E A551 E262 A87A 13BB 9059 1BE7 B545 CDF3 FD0E PGP fingerprint: AB9E A551 E262 A87A 13BB 9059 1BE7 B545 CDF3 FD0E

disclosure



Offline



Activity: 38

Merit: 0







NewbieActivity: 38Merit: 0 Re: the bs "Satoshi:0.8.99" October 28, 2013, 09:37:46 AM #11 It looks like an attempt to connect to all nodes in the network at once. Perhaps for realtime stats of the network?

Mike Hearn





Offline



Activity: 1526

Merit: 1008







LegendaryActivity: 1526Merit: 1008 Re: the bs "Satoshi:0.8.99" October 28, 2013, 10:28:45 AM #13 The other thing we could do is start to politely disconnect nodes that appear to be forging their subVer field. Unfortunately the lack of any kind of error message in the protocol means there's no way to send a message to the node before it's disconnected ....

Mike Hearn





Offline



Activity: 1526

Merit: 1008







LegendaryActivity: 1526Merit: 1008 Re: the bs "Satoshi:0.8.99" October 28, 2013, 04:54:44 PM #17 If they're determined to forge a fake subVer then it won't help much. If they're doing that because they're lazy or because they just modified a regular Satoshi codebase and forgot, then it might give them the incentive they need to announce themselves in a useful manner.