Address Relay under stress

While it helps against spam attacks, it could also help an eclipse attacker (i.e. someone running a number of nodes with the goal of making the victim pick all of their outbound connections to them): Especially with a larger N, there could be an amplifying effect in which a new node would quickly fill a large percentage of its Tried table with attacker-controlled nodes. However, choosing a small N, maybe just N=1, could be beneficial.

I think with N=1 there could still be some (minor?) amplification since an attacking node can respond with another of their addresses. If we then prioritize a feeler to that one and end up later connecting to it as a regular outbound connection, they could advertise another of their addresses in GETADDR and so on. Maybe the feeler priority logic could take into account the AS of the address so that even with higher N, an attacker would need multiple AS to have all of them prioritized? But maybe this doesn’t matter too much if feelers are every 30s and we’d hopefully have some honest priority feelers in the mix?

The cost might be negligible on the side that’s establishing these connections, but I fear that a 4x inbound rate to listening nodes (from a diverse set of inbound netgroups) will evict far more connections that might become long-lived connections than currently are evicted. Each eviction will in-turn cause another outbound connection being made, which might again evict a connection…

I agree, this might increase the connection churn in the network. Maybe a simulation could help here to see if it’s an acceptable amount?