What does tcpdump show?  Run it briefly and then terminate.  Take note if there are any packets filtered by the interface - this would likely indicate that there is a lot you could be sniffing but don't have your server configured correctly.

Awesome - look forward to seeing your implementation.  I recall seeing a few of your github commits before.
Ya, requires multiple kernel support, kernel loading/unloading.  And very likely a re-write of the config system to support multiple card configs for different algorithms.
Ya, I would say anytime you need a different kernel, you probably need a config.  In an ideal system, right now I could see having a separate GPU config for scrypt(1024, 1, 1), scrypt(2048, 1, 1), scrypt(4096, 1, 1), scrypt-chacha([various n]), and sha3 kekkek. Imagine being able to hot-swap between kernels like that.  Of course, a pool utilizing this would need to take into consideration the (potentially heavy) time cost of loading/unloading kernels, and a slower "shifting" pool that prefers to leave miners on the same algorithm would probably make sense.

I keep meaning to look into a buffer size implementation I saw recently - removed the need to specify thread-concurrency, and sounded beneficial/more accurate.  Need to find that branch again and do some testing soon.

This is the data source I have found for comparing multi-pools, thus far:

http://yevych.com/poolStats.html

Unlike the rather useless poolpicker, yevych actually generates their own data by mining with identical hashing power on each pool, and then once daily compares total WU submitted to the increase in exchange/unexchange/balance.

Scrypt (N=10) is backwards compatible with Scrypt-Adaptive-N, but not forwards compatible.  The biggest chunks of work that would need to be done are to extend the stratum implementation to pass nfactor along with work, and then have the miner understand this and use the correct nfactor for a given work item.  Problems crop up, however, as different nfactors perform better at different settings (clock rates, intensities, thread concurrences).

Also, I believe nfactor is fixed in existing kernel implementations, so a kernel for each nfactor would need to be compiled by the miner.

So, for a multi-pool to support coins like vertcoin, it would need to develop it's own miner (modifications to sgminer probably), have a custom stratum server implementation with a non-standard nfactor extension, and probably require that miners specify configurations for all the various nfactors they wish to mine.

Suffice to say, it's not a small job.  It will probably happen eventually tho.

Of course I can't sniff your traffic arbitrarily.  You can only view traffic on the wire where you are located - so, if you have a server in a data center on the same switch as a pool, for example, you could view all the traffic inbound to the pool.

And OVH is far from a "virtual hoster" - they are one of the largest private data center providers in the world.

---

This is all pretty basic networking stuff.  You want a demo of sniffing packets?  Connect two machines to the same network switch, fire up wireshark on one machine and start monitoring (can filter based on the other machine's IP if you want), and then go to a few websites on the second machine.

---

A forums post made by an OVH tech that was written last month, suggests that intercepting traffic was definitely still possible at OVH (they claim they are updating their switch configuration with a feature that prevent this):
https://forum.ovh.us/showthread.php/306-Misdirected-traffic-on-dedicated-server

It looks like in the case of OVH, some form of DoS attack may be necessary to knock the intended host offline in order to intercept tcp headers.  That OVH employee post certainly confirms in my mind that, when combined with another server at a host that fails to implement BCP38, the attack method I proposed is definitely possible.

Compare pool reported hashrate to WU, not hashrate.  See if that matches more closely.

WafflePool West - I removed all other pools from the config.  I do not believe this is a at all related to a rogue pool.

Switches, by very nature of the equipment, cannot isolate traffic to a specific port without the use of VLANs.  Routing requests based on IP data (Transport layer - layer 4 in the OSI model) requires a "ROUTER" - switches function only on the data link layer (layer 2), aka MAC addresses.  Suffice to say, a switch does not generally know what port a packet is intended for.

I know from personal experience that you used to be able to sniff traffic at OVH in their France datacenter.  I doubt this has changed.

It could be someone with access to some significant backbone routers - but I highly doubt that.

I went solo (found 1 block) and some p2pool.

Kinda.  Scrypt-Adaptive-N is fully backwards compatible with Scrypt.  "Scrypt" PoW is simply with N=10.  It wouldn't be difficult to automatically switch between scrypt and scrypt-n coins, although different intensity values would likely be desirable.  The main things that needs to be done, is to have stratum pass the value of N along with work - this will ultimately be necessary for ease of use with adaptive-n coins anyway, as the value of N is of course adaptive (changes - in the case of vertcoin, increasing periodically over time).

The latest version of SGMiner already supports Nscrypt by simply specifying --nfactor in your config.

The real work that needs to be done is extending the stratum implementation to also pass the value of N to the sgminer (and have sgminer understand).  Then a pool could switch between different scrypt-n coins.

I did some vertcoin mining while WafflePool was being DDoS'd, and I am planning to stay long on vertcoin for now - I think it's likely to do quite well as scrypt ASIC power ramps up.  Already, vertcoin is consistently more profitable to mine then LTC by my calculations (and we are still at the very beginning of the scrypt ASIC era).

It's definitely possible.

No...

Here is my speculative analysis of the attack (when I re-enabled redirect on one of my miners, it was redirected repeatedly to a server in Panama and I was able to do a bit of analysis):
- I do not believe this attack involves DNS manipulation
- The attack seems more closely related to the NTP Amplification attacks, whereby it abuses networks that do not properly implement BCP38 (speculative, but makes sense).

Here is how I would attempt to execute such an attack, based on :
- buy a server in the same data center as a large pool
- sniff packets intended for the pool (this used to be possible on OVH if you were on the same subnet as the intended host, probably still is)
- when a miner connects to the pool, snag it's IP, and pass that IP to another server that is hosted on a network that allows source IP address spoofing (e.g., it does not follow BCP38).
- from your server that can spoof source IP addresses, send a packet to the miner with a redirect command, using the WP server as the source.

btc-e is an exchange, not a wallet.  If you weren't using an address that you hold the private key to (you don't for any deposit address on an exchange), then you can't sign a message from that address.

Specifying shaders has no effect if you have also specified thread-concurrency.  TC is a better tuning method, generally.  I have found the best values for the 290s are a tc at 20479 or 28672 (depends on the BIOS/card as to which is more optimal).  Various other tc values are commonly used, but these have been the most optimal for me (and I have tested 100s of tc values on my banks of 290s).

I have never seen CM profits actually pass WP profits in reality.  I have run side by side tests many times, and the CM numbers never bear true after you take into account under-reported hashrate and rejected shares.

lol... WafflePool does mine the most profitable scrypt coins.  And the litecoin diff JUST changed.  Give it 24 hours to see what WP profits are like.

Besides, unless you are using a real PPS pool (only one I know of is litecoinpool.org, as LTCRabbit is a modified PPS scheme), mining LTC will never earn you "100%" of LTC profits - some days will be less, some more.

Looks like the pool has been mainly mining Fluttercoin, DogeCoin, and Litecoin so far today.  These would indeed be the most profitable coins to mine.  (We haven't mined mint in ages - we just have unexchanged coins stuck in coinmarket.io from a long time ago, we aren't mining flappycoin - we are sitting on a bunch because there is no buy interest, and I haven't seen worldcoin being mined yet today).

Ya, glad you added it, PW. Manually trading will hopefully be worthwhile - profitability has been good on this coin lately, and the random doubling of spends is kinda an interesting feature.  Maybe we'll get lucky and our deposits to the exchange will get multiplied =).

--

@PoolWaffle: how about adding DigiByte (DGB)?  Seems to be doing pretty well lately after the publicity from their code being used in Doge.  Diff staying above 10, and listed on crypsty.  Can't recall if there is anything particularly odd about their implementation that would make it unprofitable, but I don't believe so.

It's been talked about many times.  Chinese operation - you can look up the user 'sfire' on these forums for a bit of background.  He was originally the "MiddleCoin Whale", left there and was mining litecoin for a while, and then was on WafflePool for quite a while (their hash contribution grew from 5GH, 8GH, 10GH, to 20GH+), went over to GHash.IO for the 2x/1.25x promotion, came back to WP for a bit, and it looks like they are back at ghash again mining LTC.

They are operating mainly off of GPUs, but I believe they recently doubled up their operation with gridseed ASICs (based on worker names).

1000s of GPUs tho - yes.  And 1000s of little ASIC chips.  Economies of scale - if it makes sense for all of us to do it in our homes, then it makes even more sense for someone to do it in multiple factories with the advantages of bulk purchasing and commercial utility rates.

Looks great to me.  WafflePool always seems to do best at around the 10GH mark.  sfire is off elsewhere with his 20-25GH, and I won't be sad if he doesn't return to WP.  That power did a lot to decrease variance when mining litecoin.  But, variance is honestly kinda fun.  And smaller coins are nice to mine.

What issues do you expect resolved?  How about this:  if you aren't mining here, you stop posting here?  You and comeonalready have been just littering this thread with dribble for a while.

WTF... are you 16 or something?  Posting that you 'tracked down' someone's identity reeks of a pathetic and overly exaggerated sense of self-importance.  (Not that I think for a moment you actually did... but who cares)

The personalities in this thread seem to becoming more and more MiddleCoin like lately =(.  Following that thread was a chore.

---

If you are paranoid about getting ripped off by a pool owner, go use p2pool (or, go read about p2pool shares if you don't know how that works).  You'll probably end up back mining on a pool tho =p

The GHash proxy was a completely unrelated sort of redirect...  And the rest of your post is just as dumb.  

Publishing source code would do nothing to alleviate suspicions - you can obviously run something different in the production environment vs the code your publish. What it would do is remove some of WafflePool's market advantage that comes from PoolWaffle's custom stratum implementation, profitability switcher, and other code.

Quite frankly, I am really tired of hearing about this redirect shit.  Disable it in your miners and move on.  Someone found a cool way to abuse a feature in the mining software we all use - it will probably happen again.  Patch, compile, and move on.

Yes... they could.  If they were going to, they wouldn't do it by redirecting mining power to another server - that would make almost no sense.  The easier way to skim off a pool is simply to not publish some of the blocks you find.  The chances of a miner noticing that is a lot less then a miner noticing he is hashing for a different server (I would say, anyway).

But if a multipool skimmed 5% off the top all the time (or any pool for that matter), it is very likely nobody would mine there.  5% is a pretty noticeable thing when you're talking about the tight margins on mining profitability sometimes.

The reason I keep my hash power on WafflePool most of the time, is because WafflePool always published block found stats.  And since the very beginning, I was matching my blocks found against the blocks found by my equipment.  After over 1000 blocks discovered for this pool, WafflePool reported all of them correctly.  Sadly, due to database load, PoolWaffle did remove the individual blocks found stats.  This is less relevant for clarity now that we are mining mainly higher diff coins, but I still miss that reporting - it is certainly part of why most of my hashing power is sitting on VertCoin and not WafflePool right now (oh, and because the profitability margin advantage of multipools has dropped significantly in the past weeks ofc).

Here is the best part:
"cuautm" is apparently still taking applications for the role of of the President...

http://www.cuautm.com/?page_id=86

---

Really tho, this is just a student club...  might be some rich student that invested in the exchange to save it.  or... this might all be bullshit!

From what we know so far, they have basically no LTC, BTC, or BC left to offer to withdrawal.

The real angle to consider, IMO:

[03:50] <rat4> I'm surprised that someone uses accounts of daemon

Ya... the developer is surprised someone used a feature included in their software?  Most altcoins are shit and patches typically undergo barely any testing before release.

CrytoRush definitely messed up horribly by relying on coin daemons in general tho.  Isolation is important when you're dealing with so many shit altcoins.

192.99.35.62 would be an OVH hosted server.  The hostname of which is ns236914.ip-192-99-35.net.

You didn't get an ip for ns236914 ?

zomg!!! netstat -n !!!

The coins are stuck at coinmarket.io.  They might be lost entirely, but after coinmarket was hacked, the admins continue to claim they are working to fix 'stuck' withdrawals, and that they still have the coins.

https://bitcointalk.org/index.php?topic=454186.msg5764017#msg5764017

https://bitcointalk.org/index.php?topic=454186.msg5871842#msg5871842

They are now saying they will send them tonight... so let's see what happens.

Good riddance. Please don't post here again.  Bye!

I mean damn... learn how to use a forum - double posts are stupid, but triple posts are downright ignorant.  There is an EDIT function you know.

--

And while we are talking about forum etiquite... damn, please everyone, you don't have to quote a whole page.  Snip quotes to the part you are responding to.

Ahhh

There is no way that Dogecoin profit figure is accurate. You will NOT earn that much from a Doge pool.

As for WafflePool, it is being DDOSed and we aren't finding any blocks, so of course the.profitability figure is falling.