# Observations

**URL:** https://bnoc.xyz/c/observations/6.md?page=1

[Latest](https://bnoc.xyz/latest.md) · [Categories](https://bnoc.xyz/categories.md) · [Tags](https://bnoc.xyz/tags.md)

**Page:** 2

---

## [Temporary increase in number of Tor addresses](https://bnoc.xyz/t/temporary-increase-in-number-of-tor-addresses/131)

<div class="topic-metadata">

**Author:** [@matthias](https://bnoc.xyz/u/matthias)\
**Replies:** 1\
**Last updated:** [May 20, 2026, 7:21pm UTC](https://bnoc.xyz/t/temporary-increase-in-number-of-tor-addresses/131 "2026-05-20T19:21:54Z")

</div>

At the beginning of May 2026, the number of reachable Tor addresses increased sharply for a few days. The following plots show the number of outgoing Tor connections of a node that is configured analogously to the monito…

---

## [Addresses with multiple ports](https://bnoc.xyz/t/addresses-with-multiple-ports/129)

<div class="topic-metadata">

**Author:** [@stratospher](https://bnoc.xyz/u/stratospher)\
**Replies:** 2\
**Last updated:** [May 19, 2026, 8:43am UTC](https://bnoc.xyz/t/addresses-with-multiple-ports/129 "2026-05-19T08:43:18Z")

</div>

While comparing alice, bob, frank, mike, nico, dave, erin, kane and my addrman, it was interesting to see that while most IP addresses advertise 1 port - some IP addresses advertised multiple ports. ports addresses …

---

## [Back-to-back fork at height 949203 and 949204](https://bnoc.xyz/t/back-to-back-fork-at-height-949203-and-949204/127)

<div class="topic-metadata">

**Author:** [@b10c](https://bnoc.xyz/u/b10c)\
**Replies:** 0\
**Last updated:** [May 13, 2026, 12:58pm UTC](https://bnoc.xyz/t/back-to-back-fork-at-height-949203-and-949204/127 "2026-05-13T12:58:54Z")

</div>

There were two forks back-to-back, which I haven’t seen before. Other than that, I think this isn’t too special.

---

## [Did the number of reachable nodes in residential ISPs increase since Bitcoin Core v30.0?](https://bnoc.xyz/t/did-the-number-of-reachable-nodes-in-residential-isps-increase-since-bitcoin-core-v30-0/122)

<div class="topic-metadata">

**Author:** [@b10c](https://bnoc.xyz/u/b10c)\
**Replies:** 9\
**Last updated:** [May 12, 2026, 3:07pm UTC](https://bnoc.xyz/t/did-the-number-of-reachable-nodes-in-residential-isps-increase-since-bitcoin-core-v30-0/122 "2026-05-12T15:07:54Z")

</div>

With the release of Bitcoin Core v30.0 on 2025-10-10, the -natpmp has been enabled by default. The hope is that this will increase the number of reachable nodes in residential ISPs. The release notes mention: The -natp…

---

## [Block propagation and validation duration during slow-to-validate blocks on Signet](https://bnoc.xyz/t/block-propagation-and-validation-duration-during-slow-to-validate-blocks-on-signet/117)

<div class="topic-metadata">

**Author:** [@b10c](https://bnoc.xyz/u/b10c)\
**Replies:** 6\
**Last updated:** [May 7, 2026, 1:23pm UTC](https://bnoc.xyz/t/block-propagation-and-validation-duration-during-slow-to-validate-blocks-on-signet/117 "2026-05-07T13:23:01Z")

</div>

During last week’s demonstration of slow blocks on Signet, I ran a custom P2P client that connected to all ~190 listening Signet nodes on IPv4 and Tor. The goal was to measure block propagation speed through the network …

---

## [Two block reorg at height 941880](https://bnoc.xyz/t/two-block-reorg-at-height-941880/97)

<div class="topic-metadata">

**Author:** [@b10c](https://bnoc.xyz/u/b10c)\
**Replies:** 32\
**Last updated:** [April 15, 2026, 9:10pm UTC](https://bnoc.xyz/t/two-block-reorg-at-height-941880/97 "2026-04-15T21:10:48Z")

</div>

We just had a rare-ish two block reorg where Foundry mined a couple of blocks in a row winning a two block long race against AntPool and ViaBTC. Foundry ended up mining seven blocks in a row: The stale blocks are…

---

## [Consecutive Block Patterns Don't Match What Hashrate Predicts](https://bnoc.xyz/t/consecutive-block-patterns-dont-match-what-hashrate-predicts/105)

<div class="topic-metadata">

**Author:** [@sorukumar](https://bnoc.xyz/u/sorukumar)\
**Replies:** 2\
**Last updated:** [April 3, 2026, 2:39am UTC](https://bnoc.xyz/t/consecutive-block-patterns-dont-match-what-hashrate-predicts/105 "2026-04-03T02:39:58Z")

</div>

Been poking at consecutive block data since recent two block re-org. A few things don’t square with what independent competing Poisson processes would predict: 7+ block streaks are 3–7× more frequent than hashrate pr…

---

## [Steep increase in inbound connections on 2026-03-31 at 00:12 UTC](https://bnoc.xyz/t/steep-increase-in-inbound-connections-on-2026-03-31-at-00-12-utc/108)

<div class="topic-metadata">

**Author:** [@b10c](https://bnoc.xyz/u/b10c)\
**Replies:** 5\
**Last updated:** [April 2, 2026, 6:25pm UTC](https://bnoc.xyz/t/steep-increase-in-inbound-connections-on-2026-03-31-at-00-12-utc/108 "2026-04-02T18:25:12Z")

</div>

I noticed that on my monitoring nodes, nearly across the board (ignoring ones that already had full connection slots), the inbound connections steeply increased on 2026-03-31 at around 00:12 UTC (2026-03-31T00:12:00Z (UT…

---

## [Many connections to bitproject.io nodes?](https://bnoc.xyz/t/many-connections-to-bitproject-io-nodes/40)

<div class="topic-metadata">

**Author:** [@instagibbs](https://bnoc.xyz/u/instagibbs)\
**Replies:** 29\
**Last updated:** [April 2, 2026, 5:36pm UTC](https://bnoc.xyz/t/many-connections-to-bitproject-io-nodes/40 "2026-04-02T17:36:03Z")

</div>

edit (@b10c): the title was originally “/Satoshi:29.1.0(dont-spam-me-bro)/ nodes?”. Noticed these connections on both my outbound and inbound direction on various nodes: “/Satoshi:29.1.0(dont-spam-me-bro)/” They appear…

---

## [Increased b-msghand thread utilization due to runestone transactions on 2026-02-17](https://bnoc.xyz/t/increased-b-msghand-thread-utilization-due-to-runestone-transactions-on-2026-02-17/81)

<div class="topic-metadata">

**Author:** [@b10c](https://bnoc.xyz/u/b10c)\
**Replies:** 15\
**Last updated:** [March 23, 2026, 11:00am UTC](https://bnoc.xyz/t/increased-b-msghand-thread-utilization-due-to-runestone-transactions-on-2026-02-17/81 "2026-03-23T11:00:40Z")

</div>

I noticed my peer-observer nodes spending a lot of time in b-msghand thread today on 2026-02-17 starting around 1:30 am UTC. Note that the screenshots are UTC+1. (red means we spend 1000ms out of 1000ms (i.e. 100%) o…

---

## [Attack on I2P: Bitcoin nodes not reachable via I2P](https://bnoc.xyz/t/attack-on-i2p-bitcoin-nodes-not-reachable-via-i2p/79)

<div class="topic-metadata">

**Author:** [@b10c](https://bnoc.xyz/u/b10c)\
**Replies:** 5\
**Last updated:** [February 12, 2026, 8:57pm UTC](https://bnoc.xyz/t/attack-on-i2p-bitcoin-nodes-not-reachable-via-i2p/79 "2026-02-12T20:57:07Z")

</div>

There’s an Ongoing Attack on I2P Network Causing Degraded Performance that’s also affecting Bitcoin node connectivity via I2P. I run four Bitcoin nodes with I2P connectivity, and all seem to be affected. My monitoring i…

---

## [\>60% spy-peers connected to freshly setup node](https://bnoc.xyz/t/60-spy-peers-connected-to-freshly-setup-node/15)

<div class="topic-metadata">

**Author:** [@b10c](https://bnoc.xyz/u/b10c)\
**Replies:** 2\
**Last updated:** [December 9, 2025, 5:10pm UTC](https://bnoc.xyz/t/60-spy-peers-connected-to-freshly-setup-node/15 "2025-12-09T17:10:31Z")

</div>

I recently set up two new nodes and right after IBD, a bunch of spy nodes started connecting to them. At some point over \>60% of my peers were spies. I found it surprising how aggressive the spies are. Some of the peer…

---

## [Bitcoin Core addr gossip is rate-limited right after connection open](https://bnoc.xyz/t/bitcoin-core-addr-gossip-is-rate-limited-right-after-connection-open/47)

<div class="topic-metadata">

**Author:** [@b10c](https://bnoc.xyz/u/b10c)\
**Replies:** 7\
**Last updated:** [December 8, 2025, 5:26pm UTC](https://bnoc.xyz/t/bitcoin-core-addr-gossip-is-rate-limited-right-after-connection-open/47 "2025-12-08T17:26:13Z")

</div>

On my peer-observer monitoring, I have a dashboard with the number of connected peers that have at least one address rate-limited. For each node (ignoring hazel and mike with different configurations), it shows a few pee…

---

## [Waves of (bad) addresses being gossiped](https://bnoc.xyz/t/waves-of-bad-addresses-being-gossiped/61)

<div class="topic-metadata">

**Author:** [@b10c](https://bnoc.xyz/u/b10c)\
**Replies:** 1\
**Last updated:** [November 26, 2025, 5:06pm UTC](https://bnoc.xyz/t/waves-of-bad-addresses-being-gossiped/61 "2025-11-26T17:06:31Z")

</div>

I recently re-observed something I previously looked into in 2023. Every couple of hours, at seemingly random intervals and times, my peers (i.e. the whole network) starts sending a spike in addresses. When I looked into…

---

## [Increased b-msghand thread utilization due to many 352 byte runestone inscriptions on 2025-11-17](https://bnoc.xyz/t/increased-b-msghand-thread-utilization-due-to-many-352-byte-runestone-inscriptions-on-2025-11-17/58)

<div class="topic-metadata">

**Author:** [@b10c](https://bnoc.xyz/u/b10c)\
**Replies:** 5\
**Last updated:** [November 26, 2025, 4:15pm UTC](https://bnoc.xyz/t/increased-b-msghand-thread-utilization-due-to-many-352-byte-runestone-inscriptions-on-2025-11-17/58 "2025-11-26T16:15:40Z")

</div>

While looking at a peer-observer dashboard for time spent in the b-msghand (P2P message handling thread) of Bitcoin Core, I noticed that some of the nodes (especially dave with many connections) were active in that threa…

---

## [Gossip Observer: New project to monitor the Lightning P2P network](https://bnoc.xyz/t/gossip-observer-new-project-to-monitor-the-lightning-p2p-network/54)

<div class="topic-metadata">

**Author:** [@jonhbit](https://bnoc.xyz/u/jonhbit)\
**Replies:** 0\
**Last updated:** [November 14, 2025, 9:51pm UTC](https://bnoc.xyz/t/gossip-observer-new-project-to-monitor-the-lightning-p2p-network/54 "2025-11-14T21:51:28Z")

</div>

For the past few months (since plebfi miami), I’ve been working on a project to monitor the Lightning gossip network by collecting gossip messages from numerous nodes. The repo with the code used, the raw data collected …

---

## [ViaBTC mining pool mines multiple blocks at same height](https://bnoc.xyz/t/viabtc-mining-pool-mines-multiple-blocks-at-same-height/48)

<div class="topic-metadata">

**Author:** [@b10c](https://bnoc.xyz/u/b10c)\
**Replies:** 1\
**Last updated:** [November 1, 2025, 11:03am UTC](https://bnoc.xyz/t/viabtc-mining-pool-mines-multiple-blocks-at-same-height/48 "2025-11-01T11:03:50Z")

</div>

At height 877991, ViaBTC mined three blocks. I hadn’t seen this before. The two alternative headers can be found here: As of writing, we don’t have the full blocks in the stale-block dataset.

---

## [Spy node cluster making many connections](https://bnoc.xyz/t/spy-node-cluster-making-many-connections/32)

<div class="topic-metadata">

**Author:** [@mzumsande](https://bnoc.xyz/u/mzumsande)\
**Replies:** 2\
**Last updated:** [October 15, 2025, 4:39pm UTC](https://bnoc.xyz/t/spy-node-cluster-making-many-connections/32 "2025-10-15T16:39:22Z")

</div>

During a recent IBD in August, I noticed a sudden drop from ~120 to ~100 peers. This was due to these IPs: 142.93.63.225 172.233.57.109 198.244.232.117 78.47.52.58 I had 5 inbound connections from each of these addres…

---

## [82.66.103.79 (v28.99) repeatedly connecting and getting discouraged for invalid POW](https://bnoc.xyz/t/82-66-103-79-v28-99-repeatedly-connecting-and-getting-discouraged-for-invalid-pow/18)

<div class="topic-metadata">

**Author:** [@b10c](https://bnoc.xyz/u/b10c)\
**Replies:** 1\
**Last updated:** [October 14, 2025, 6:34am UTC](https://bnoc.xyz/t/82-66-103-79-v28-99-repeatedly-connecting-and-getting-discouraged-for-invalid-pow/18 "2025-10-14T06:34:08Z")

</div>

In August 2025, someone reached out with the following message: Have you noticed 82.66.103.79 which (claims to be) 0.28.99 repeatedly connecting and getting banned for invalid POW? I hadn’t, but dug into it: I firs…

---

## [DigitalOcean /Satoshi:24.0.1/ spy nodes connected during IBD](https://bnoc.xyz/t/digitalocean-satoshi-24-0-1-spy-nodes-connected-during-ibd/16)

<div class="topic-metadata">

**Author:** [@b10c](https://bnoc.xyz/u/b10c)\
**Replies:** 0\
**Last updated:** [October 13, 2025, 6:08pm UTC](https://bnoc.xyz/t/digitalocean-satoshi-24-0-1-spy-nodes-connected-during-ibd/16 "2025-10-13T18:08:15Z")

</div>

While setting up a nodes for https://demo.peer.observer, I noticed on the netinfo.html page that I immediately get inbound connections for spy nodes. These connect even while during IBD. on hal: id ip user agent ta…

[Previous page](https://bnoc.xyz/c/observations/6.md)
