Continuous Measurement of Bitcoin-Derived P2P Networks with DaeConn

matthias · July 7, 2026, 8:34am

I just came across this recent paper written by a team from Uni Zurich: Demo: Continuous Measurement of Bitcoin-Derived P2P Networks with DaeConn

It describes a measurement tool that finds peers in the network and collects information about them. Thus, the tool is an implementation of a `spy node’ similar to bitnodes. The tool is available at GitHub - DogukanBaysal/DaeConn · GitHub

matthias · July 7, 2026, 8:44am

Related to this, the same authors simulated the Bitcoin P2P network and analyzed the simulated network’s topology and how blocks are propagated in a simulated network:

b10c · July 7, 2026, 11:20am

It seems I don’t have access to this paper.

We recently saw /python-bitcoinlib:0.12.2/ client getting addr-ratelimited (since 2026-04-10) from Uni Zurich, but looking at the DaeConn tool a bit, it has a different UA.

github.com/DogukanBaysal/DaeConn

app/network/scanner.py

e183a4300


      
          def build_msg(cmd: str, payload: bytes) -> bytes:
              name = cmd.encode("ascii")
              if len(name) > 12: raise ValueError("command too long")
              header = struct.pack("<I", MAGIC) + name + b"\x00"*(12-len(name))
              header += struct.pack("<I", len(payload)) + sha256d(payload)[:4]
              return header + payload
          
          def build_version_payload() -> bytes:
              version = VERSION; services = 0; ts = int(time.time())
              nonce = int.from_bytes(sha256d(str(ts).encode())[:8], "little")
              ua = b"/connector/"
              payload  = struct.pack("<iQq", version, services, ts)
              payload += struct.pack("<Q", services) + ip6_from_ipv4("0.0.0.0") + struct.pack(">H", DEFAULT_PORT)
              payload += struct.pack("<Q", services) + ip6_from_ipv4("0.0.0.0") + struct.pack(">H", 0)
              payload += struct.pack("<Q", nonce)
              payload += bytes([len(ua)]) + ua
              payload += struct.pack("<i", 0) + b"\x00" 
              return payload
          
          def build_ping_payload(nonce: int) -> bytes:
              return struct.pack("<Q", nonce)

and seems to also hardcode an IP I haven’t seen here before:

github.com/DogukanBaysal/DaeConn

app/network/scanner.py

e183a4300


      
                  self.sock = None
          
          def scan_peer(host: str, port: int = DEFAULT_PORT) -> Optional[List[Dict]]:
              cli = DogeLiveScanner(host, port)
              if not cli.connect(): return None
              print(f"[+] Connected to {host}:{port}")
              cli.handshake()
              return cli.run()
          
          if __name__ == "__main__":
              host = sys.argv[1] if len(sys.argv) > 1 else "185.252.234.250"
              port = int(sys.argv[2]) if len(sys.argv) > 2 else DEFAULT_PORT
              rows = scan_peer(host, port)
              if not rows:
                  print("[-] No peers found.")
              else:
                  print(f"[+] Rows: {len(rows)}")
                  for r in rows[:5]:
                      print(r)

stratospher · July 8, 2026, 7:59am

interesting! thanks for sharing!

DaeConn seems to be a crawler with the connector UA and the hard coded IP is just testing the crawler works.

maybe the other paper (or some other research) might have this python-bitcoinlib UA and address rate limiting? though the timeline feels a bit short - it was presented in June and the addr spam started in April/May.