# Observations **URL:** https://bnoc.xyz/c/observations/6.md [Latest](https://bnoc.xyz/latest.md) · [Categories](https://bnoc.xyz/categories.md) · [Tags](https://bnoc.xyz/tags.md) --- ## [About the Observations category](https://bnoc.xyz/t/about-the-observations-category/11)
**Author:** [@admin](https://bnoc.xyz/u/admin)\ **Replies:** 0\ **Last updated:** [October 13, 2025, 3:37pm UTC](https://bnoc.xyz/t/about-the-observations-category/11 "2025-10-13T15:37:15Z")
A place for sharing raw and unfinished Bitcoin network observations with others. Feel free to post network observations here. Ideally, include time-of-observation, images, links, … Examples could be: A spike in new B… --- ## [Compact block reconstruction degradation between September - October 2026](https://bnoc.xyz/t/compact-block-reconstruction-degradation-between-september-october-2026/198)
**Author:** [@m4ycon](https://bnoc.xyz/u/m4ycon)\ **Replies:** 5\ **Last updated:** [October 27, 2026, 9:17pm UTC](https://bnoc.xyz/t/compact-block-reconstruction-degradation-between-september-october-2026/198 "2026-10-27T21:17:44Z")
On April, I was working on adding some stats based on logs about compact block reconstruction in peer-observer (see 420 and 465), since then, I’ve been looking to the added panels to validate them and I’ve seen some degr… --- ## [/Satoshi:31.0.0/ peers with no service flags and protocol 70015 pushed transactions, then stopped together on Oct 18](https://bnoc.xyz/t/satoshi-31-0-0-peers-with-no-service-flags-and-protocol-70015-pushed-transactions-then-stopped-together-on-oct-18/193)
**Author:** [@benunskilled](https://bnoc.xyz/u/benunskilled)\ **Replies:** 10\ **Last updated:** [October 22, 2026, 11:07pm UTC](https://bnoc.xyz/t/satoshi-31-0-0-peers-with-no-service-flags-and-protocol-70015-pushed-transactions-then-stopped-together-on-oct-18/193 "2026-10-22T23:07:43Z")
My listening node (Core 31.1) got inbound connections from a small fleet announcing /Satoshi:31.0.0/ that, as far as I can tell, isn’t Bitcoin Core. Who: 6,591 sessions from 22 IPv4 addresses (Oct 6–18), each in a diffe… --- ## [Large disruption in Tor exit node population: visible in your data?](https://bnoc.xyz/t/large-disruption-in-tor-exit-node-population-visible-in-your-data/197)
**Author:** [@jonhbit](https://bnoc.xyz/u/jonhbit)\ **Replies:** 1\ **Last updated:** [October 21, 2026, 11:05pm UTC](https://bnoc.xyz/t/large-disruption-in-tor-exit-node-population-visible-in-your-data/197 "2026-10-21T23:05:44Z")
Looks like there was an attack that hijacked 300+ Tor relay nodes, promoted them to exit nodes (to become 10+% of the count of exit nodes at the time), and was then discovered and stopped. Roughly, detected on October 2n… --- ## [Addrman health dashboard](https://bnoc.xyz/t/addrman-health-dashboard/185)
**Author:** [@naiyoma](https://bnoc.xyz/u/naiyoma)\ **Replies:** 3\ **Last updated:** [October 20, 2026, 5:37am UTC](https://bnoc.xyz/t/addrman-health-dashboard/185 "2026-10-20T05:37:46Z")
Sharing an addrman health dashboard ( Addrman health ) which @stratospher and I vibe-coded for fun last month. The dashboard lets you upload your addrman (peers.dat) and gives a quick overview of the state and compositi… --- ## [/Satoshi:25.0.0/ and /Satoshi:25.1.0/ clients disrespecting fRelay](https://bnoc.xyz/t/satoshi-25-0-0-and-satoshi-25-1-0-clients-disrespecting-frelay/17)
**Author:** [@b10c](https://bnoc.xyz/u/b10c)\ **Replies:** 5\ **Last updated:** [October 19, 2026, 10:14pm UTC](https://bnoc.xyz/t/satoshi-25-0-0-and-satoshi-25-1-0-clients-disrespecting-frelay/17 "2026-10-19T22:14:49Z")
These IP addresses of v25.0 / v25.1 clients disrespecting fRelay were shared with me. They belong to different cloud providers (seeing Hetzner, Google, AWS, …): # Google 104.199.210.140 /Satoshi:25.1.0/ 104.199.67.60 /S… --- ## [Effect of Linux Kernel CVE-2026-99999 (CVSS 9.3, PwnScape) on the Bitcoin network](https://bnoc.xyz/t/effect-of-linux-kernel-cve-2026-99999-cvss-9-3-pwnscape-on-the-bitcoin-network/189)
**Author:** [@b10c](https://bnoc.xyz/u/b10c)\ **Replies:** 3\ **Last updated:** [October 19, 2026, 8:30pm UTC](https://bnoc.xyz/t/effect-of-linux-kernel-cve-2026-99999-cvss-9-3-pwnscape-on-the-bitcoin-network/189 "2026-10-19T20:30:11Z")
VPS providers have been patching and restarting the hosts of their VPS / cloud servers following CVE-2026-99999 for the past days since the vulnerability was made public on the 15th. Some of these likely run Bitcoin node… --- ## [LinkingLion: An entity linking Bitcoin transactions to IPs?](https://bnoc.xyz/t/linkinglion-an-entity-linking-bitcoin-transactions-to-ips/12)
**Author:** [@b10c](https://bnoc.xyz/u/b10c)\ **Replies:** 17\ **Last updated:** [October 10, 2026, 6:14pm UTC](https://bnoc.xyz/t/linkinglion-an-entity-linking-bitcoin-transactions-to-ips/12 "2026-10-10T18:14:59Z")
In March 2023, I published LinkingLion: An entity linking Bitcoin transactions to IPs? about an entity which opens connections to many Bitcoin nodes using four IP address ranges and listens to transaction announcements. … --- ## [OS fingerprints of ~16.6k Bitcoin nodes](https://bnoc.xyz/t/os-fingerprints-of-16-6k-bitcoin-nodes/152)
**Author:** [@ViniciusCestarii](https://bnoc.xyz/u/ViniciusCestarii)\ **Replies:** 3\ **Last updated:** [October 9, 2026, 2:00pm UTC](https://bnoc.xyz/t/os-fingerprints-of-16-6k-bitcoin-nodes/152 "2026-10-09T14:00:36Z")
I scanned publicly reachable Bitcoin nodes with nmap -O and aggregated the detected operating system as Linux, Windows, BSD, macOS, Other/Device, or Unknown. Latest scan (2026-07-07): 16,662 IPv4/IPv6 targets Reachabl… --- ## [Increase in the number of reachable IPv4 nodes (bitprojects.io)](https://bnoc.xyz/t/increase-in-the-number-of-reachable-ipv4-nodes-bitprojects-io/45)
**Author:** [@matthias](https://bnoc.xyz/u/matthias)\ **Replies:** 11\ **Last updated:** [October 2, 2026, 4:33pm UTC](https://bnoc.xyz/t/increase-in-the-number-of-reachable-ipv4-nodes-bitprojects-io/45 "2026-10-02T16:33:48Z")
A few days ago, a sudden increase in the number of reachable IPv4 nodes from about 8,500 to 10,500 was observed by our monitoring nodes at KIT: This increase seems to come mostly from 2040 new reachable addresses in … --- ## [Outbound connection success rates of a Bitcoin node](https://bnoc.xyz/t/outbound-connection-success-rates-of-a-bitcoin-node/142)
**Author:** [@b10c](https://bnoc.xyz/u/b10c)\ **Replies:** 14\ **Last updated:** [September 30, 2026, 10:21pm UTC](https://bnoc.xyz/t/outbound-connection-success-rates-of-a-bitcoin-node/142 "2026-09-30T22:21:27Z")
To have data for a simulation, I’ve been looking at the rate of successful outbound connections my nodes are making. I’m parsing and using the following log messages for this: trying TRANSPORT connection (CONN\_TYPE) to… --- ## [ViaBTC bitpeers sending the same \`block\` message multiple times during forks](https://bnoc.xyz/t/viabtc-bitpeers-sending-the-same-block-message-multiple-times-during-forks/178)
**Author:** [@b10c](https://bnoc.xyz/u/b10c)\ **Replies:** 2\ **Last updated:** [September 27, 2026, 12:49am UTC](https://bnoc.xyz/t/viabtc-bitpeers-sending-the-same-block-message-multiple-times-during-forks/178 "2026-09-27T00:49:36Z")
Just a network observations I wanted to write down. Nothing problematic. While looking into peers sending us the same block multiple times in a short time-frame, I came across this interaction with a peer: 2026-04-20T… --- ## [/btcwire:0.5.0/hemi-soak:1.0/ annoucing its address on many ports (82.221.101.217)](https://bnoc.xyz/t/btcwire-0-5-0-hemi-soak-1-0-annoucing-its-address-on-many-ports-82-221-101-217/170)
**Author:** [@stratospher](https://bnoc.xyz/u/stratospher)\ **Replies:** 4\ **Last updated:** [September 21, 2026, 11:09pm UTC](https://bnoc.xyz/t/btcwire-0-5-0-hemi-soak-1-0-annoucing-its-address-on-many-ports-82-221-101-217/170 "2026-09-21T23:09:21Z")
I found it hard to believe the number of IP addresses received including duplicates rose to 460,241 addresses on 31 august in a node I was looking at. Apparently 99.2% of all the addresses which got rate limited in net\_… --- ## [Blocks at the same height by the same pool](https://bnoc.xyz/t/blocks-at-the-same-height-by-the-same-pool/171)
**Author:** [@CedArctic](https://bnoc.xyz/u/CedArctic)\ **Replies:** 0\ **Last updated:** [September 5, 2026, 8:20pm UTC](https://bnoc.xyz/t/blocks-at-the-same-height-by-the-same-pool/171 "2026-09-05T20:20:49Z")
Following up on the discussion from recent similar observations (see 1, 2, 3, 4), I wanted to see how frequently any given pool mines two blocks at the same height. I attach a small dataset below. :goose: Methodology: I… --- ## [Bitcoin Core versions run by mining pools](https://bnoc.xyz/t/bitcoin-core-versions-run-by-mining-pools/57)
**Author:** [@b10c](https://bnoc.xyz/u/b10c)\ **Replies:** 4\ **Last updated:** [September 3, 2026, 1:10pm UTC](https://bnoc.xyz/t/bitcoin-core-versions-run-by-mining-pools/57 "2026-09-03T13:10:53Z")
By looking at which pools mine P2A spends, we can guess when a pool roughly upgraded their getblocktemplate node to Bitcoin Core version v28. pool first spend first creation total inputs total outputs MARA Pool 8… --- ## [/python-bitcoinlib:0.12.2/ client getting addr-ratelimited (since 2026-04-10)](https://bnoc.xyz/t/python-bitcoinlib-0-12-2-client-getting-addr-ratelimited-since-2026-04-10/116)
**Author:** [@b10c](https://bnoc.xyz/u/b10c)\ **Replies:** 8\ **Last updated:** [September 2, 2026, 3:12pm UTC](https://bnoc.xyz/t/python-bitcoinlib-0-12-2-client-getting-addr-ratelimited-since-2026-04-10/116 "2026-09-02T15:12:59Z")
Since 2026-04-10 at about 16:30 UTC I’ve seen multiple IPv4 addresses connect to my monitoring nodes gossiping addresses via addr (and not addrv2) at a higher rate. These addresses are frequently rate-limited. IPs are: … --- ## [SpiderPool mines two blocks at same height 963853](https://bnoc.xyz/t/spiderpool-mines-two-blocks-at-same-height-963853/166)
**Author:** [@b10c](https://bnoc.xyz/u/b10c)\ **Replies:** 5\ **Last updated:** [September 2, 2026, 2:36pm UTC](https://bnoc.xyz/t/spiderpool-mines-two-blocks-at-same-height-963853/166 "2026-09-02T14:36:59Z")
I happened to catch it while the split was on-going which allowed to check which of the SpiderPool blocks the pools were mining on-top of. Note that AntPool & Friends don’t all mine on the same block here. I suspect tha… --- ## [Electrum Server Monitoring: Header Propagation and Shared Infrastructure](https://bnoc.xyz/t/electrum-server-monitoring-header-propagation-and-shared-infrastructure/167)
**Author:** [@dutenrapha](https://bnoc.xyz/u/dutenrapha)\ **Replies:** 4\ **Last updated:** [August 27, 2026, 5:25pm UTC](https://bnoc.xyz/t/electrum-server-monitoring-header-propagation-and-shared-infrastructure/167 "2026-08-27T17:25:22Z")
In my previous post (Electrum Server Monitoring), I explored whether public Electrum servers could be grouped by comparing their mempool.get\_fee\_histogram responses. The initial hypothesis was simple: if multiple Electr… --- ## [Electrum Server Monitoring](https://bnoc.xyz/t/electrum-server-monitoring/135)
**Author:** [@dutenrapha](https://bnoc.xyz/u/dutenrapha)\ **Replies:** 4\ **Last updated:** [August 25, 2026, 9:44pm UTC](https://bnoc.xyz/t/electrum-server-monitoring/135 "2026-08-25T21:44:42Z")
Recently, I started working on the following research idea proposed by b10c: Research and exploration: Can we spot public spy-Electrum servers run by Chainalysis? Based on the ideas from b10c, I started collecting data … --- ## [Unreachable addresses in Bitcoin GETADDR responses](https://bnoc.xyz/t/unreachable-addresses-in-bitcoin-getaddr-responses/155)
**Author:** [@danielabrozzoni](https://bnoc.xyz/u/danielabrozzoni)\ **Replies:** 3\ **Last updated:** [August 15, 2026, 12:21pm UTC](https://bnoc.xyz/t/unreachable-addresses-in-bitcoin-getaddr-responses/155 "2026-08-15T12:21:57Z")
In the past few months we saw many unreachable addresses being gossipped on the p2p network (see this thread or this one). This refers to unsolicited ADDR messages, but I wondered if we could find some more information o… --- ## [Logs of "Mempool in non-optimal ordering after block/additions(s)"](https://bnoc.xyz/t/logs-of-mempool-in-non-optimal-ordering-after-block-additions-s/125)
**Author:** [@b10c](https://bnoc.xyz/u/b10c)\ **Replies:** 4\ **Last updated:** [August 5, 2026, 8:21am UTC](https://bnoc.xyz/t/logs-of-mempool-in-non-optimal-ordering-after-block-additions-s/125 "2026-08-05T08:21:22Z")
While chatting with @instagibbs, he mentioned we should not be seeing any Mempool in non-optimal ordering after X logs on a node with mempool logging turned on. Turns out, while grepping for it, there appear to be a… --- ## [MARAPool mines two blocks at height 960761](https://bnoc.xyz/t/marapool-mines-two-blocks-at-height-960761/157)
**Author:** [@b10c](https://bnoc.xyz/u/b10c)\ **Replies:** 3\ **Last updated:** [August 3, 2026, 9:29am UTC](https://bnoc.xyz/t/marapool-mines-two-blocks-at-height-960761/157 "2026-08-03T09:29:38Z")
Added to the stale-block dataset in automated: add recent stale block(s) 2026-08-03 · bitcoin-data/stale-blocks@0a4e139 · GitHub This is similar to: AntPool mines two blocks at height 925051 F2Pool mines two blocks… --- ## [Small getaddr responses from 897 nodes (/Satoshi:27.0.0/ on AS63949)](https://bnoc.xyz/t/small-getaddr-responses-from-897-nodes-satoshi-27-0-0-on-as63949/121)
**Author:** [@naiyoma](https://bnoc.xyz/u/naiyoma)\ **Replies:** 13\ **Last updated:** [July 31, 2026, 7:25am UTC](https://bnoc.xyz/t/small-getaddr-responses-from-897-nodes-satoshi-27-0-0-on-as63949/121 "2026-07-31T07:25:32Z")
I ran this crawler(https://github.com/virtu/p2p-crawler.git) over the weekend and observed a cluster of 897 nodes that returned a getaddr response of 256 peers. This is way below the usual \< 990. All the nodes have… --- ## [F2Pool mines two blocks at height 956337](https://bnoc.xyz/t/f2pool-mines-two-blocks-at-height-956337/147)
**Author:** [@b10c](https://bnoc.xyz/u/b10c)\ **Replies:** 7\ **Last updated:** [July 7, 2026, 11:07am UTC](https://bnoc.xyz/t/f2pool-mines-two-blocks-at-height-956337/147 "2026-07-07T11:07:22Z")
Similar to AntPool mines two blocks at height 925051 , F2Pool mined two forks at height 956337. This isn’t too special, as two ASICs or two nodes, or multiple Stratum servers aren’t unlikely. Still, it’s interesting to d… --- ## [AntPool mines two blocks at height 925051](https://bnoc.xyz/t/antpool-mines-two-blocks-at-height-925051/60)
**Author:** [@b10c](https://bnoc.xyz/u/b10c)\ **Replies:** 3\ **Last updated:** [July 2, 2026, 9:50am UTC](https://bnoc.xyz/t/antpool-mines-two-blocks-at-height-925051/60 "2026-07-02T09:50:55Z")
At height 925051, AntPool mined two blocks. The stale block and header for 0000000000000000000199dc74f0c7d25adc618618ee00db80884b347253c264 can be found here. The blocks are fairly similar in size and transaction cou… --- ## [ASmap dashboard: first version, looking for feedback](https://bnoc.xyz/t/asmap-dashboard-first-version-looking-for-feedback/140)
**Author:** [@jorisstrakeljahn](https://bnoc.xyz/u/jorisstrakeljahn)\ **Replies:** 4\ **Last updated:** [June 25, 2026, 2:24pm UTC](https://bnoc.xyz/t/asmap-dashboard-first-version-looking-for-feedback/140 "2026-06-25T14:24:30Z")
Hi, I’d like to share the first version of a dashboard I’ve been building as a Summer of Bitcoin project, mentored by fjahr and jurraca. A quick thank you to @b10c and @matthias / the KIT DSN group for providing the hi… --- ## [High CPU usage on Knots node causing connections to drop](https://bnoc.xyz/t/high-cpu-usage-on-knots-node-causing-connections-to-drop/137)
**Author:** [@b10c](https://bnoc.xyz/u/b10c)\ **Replies:** 6\ **Last updated:** [June 12, 2026, 7:52am UTC](https://bnoc.xyz/t/high-cpu-usage-on-knots-node-causing-connections-to-drop/137 "2026-06-12T07:52:54Z")
As part of my peer.observer Bitcoin node monitoring infrastructure I’m running a v29.3.knots20260508 Knots node with the name nico. I noticed that on 2026-05-28 at around 20:30 UTC the inbound connections this node had … --- ## [How similar are addrman of different nodes](https://bnoc.xyz/t/how-similar-are-addrman-of-different-nodes/128)
**Author:** [@stratospher](https://bnoc.xyz/u/stratospher)\ **Replies:** 6\ **Last updated:** [June 12, 2026, 7:18am UTC](https://bnoc.xyz/t/how-similar-are-addrman-of-different-nodes/128 "2026-06-12T07:18:57Z")
recently chatted with a few people about how similar the addrman of 2 nodes might be - that is how much of the ip addresses stored in the addrman of different nodes overlap and we decided to actually measure it. this pos… --- ## [Forward-compatible coinbase locktimes for BIP-54](https://bnoc.xyz/t/forward-compatible-coinbase-locktimes-for-bip-54/75)
**Author:** [@b10c](https://bnoc.xyz/u/b10c)\ **Replies:** 10\ **Last updated:** [June 10, 2026, 9:56am UTC](https://bnoc.xyz/t/forward-compatible-coinbase-locktimes-for-bip-54/75 "2026-06-10T09:56:36Z")
One of the four requirement of BIP-54 (Consensus Cleanup) is that: The coinbase transaction’s nLockTime field must be set to the height of the block minus 1 and its nSequence field must not be equal to 0xffffffff. Ad… --- ## [Addrman age distribution](https://bnoc.xyz/t/addrman-age-distribution/130)
**Author:** [@stratospher](https://bnoc.xyz/u/stratospher)\ **Replies:** 2\ **Last updated:** [May 21, 2026, 9:46am UTC](https://bnoc.xyz/t/addrman-age-distribution/130 "2026-05-21T09:46:40Z")
was curious about the age distribution of different addresses in the addrman new and tried tables of different peers in peer.observer \*image plotted by claude kane is the tor/i2p only node. kane’s plot is interestin… [Next page](https://bnoc.xyz/c/observations/6.md?page=1)