Address Relay under stress: Attack Characteristics and Measuring Its Effects

here’s a comparison of these trends in the past 2.5 years (Feb 2024 - July 2026). h/t to @b10c for the data!

  1. this is the number of addresses added to the addrman per day from the AddrMan::Add logs. timestamp refreshes are not counted here. you can ignore the spike which happened when Alice restarted.

It’s interesting how it’s kind of steady at 1500-2000 addresses/day for 2.5 years but then dropped to 200-400 addresses/day during the spam window.

It’s because this graph is an indicator of the isTerrible trend. we can only add something into our addrman if the existing address is isTerrible and the major component is nTime > 30 days. the drop during the spam window means someone was purposefully refreshing timestamps so that the addresses in the new table do not get isTerrible.

  1. just for comparison, this is the number of addresses Alice was receiving during this time period from the ProcessAddrs logs.

  • it’s ~90k addresses received /day through 2024
  • ~150-300k addresses received/day in 2025
  • ~400-580k addresses received/day during the spam window

not all addresses which Alice receives enters her addrman. It’s a very tiny fraction which enters the addrman - most addresses end up as collision-no-eviction and don’t enter the addrman.

  1. this is the successful outbound connections which happened from new and tried table.
  • new table is only 1-2% success for outbound full relay + block relay (no feelers)
  • tried table used to be 60-80% success for 2 years and then dropped to ~43% during the spam window

this means the clearnet new table has always been very unreachable even without spam attacks. I guess it’s because we promote the reachable ones to tried table, clearnet IPs could be dynamic and rotate, node might still run default listen=1 even when it is not able to accept inbounds and end up self advertising anyways.

  1. this shows successful feelers.

  • ~5% successful feelers in 2024
  • climbing steadily to ~10-16% by early 2026
  • falling to 2-4% during the spam window

the downward trajectory during spam window shows addrman new table quality degrading. Alice attempts feelers to new table addresses but the new table addresses are fake/dead and the feelers become more unsuccessful.