Help for my full node - 60 connections from the same bitconj IP

[dende93]

Hi there! I run bitcoin core from a couple of weeks and I have a doubt about an Ip that is connected to me from yesterday, iptracker say it's from Beijing.

Usually I have 50/60 different peer connections , but now I see that I have 96 total connections, with 60 peer with the same address running bitcoinj.

Looking at the details of the peer, first of all I see, while being connected for 24 hours, they all have sent and received only 1 MB.

The other strange thing is that, unlike the others "normal" nodes I have on which I see this for example



39.104.xxx.xx:49194 (id nodo: 29173)

via 2.230.xxx.xxx:8333



where the first is the peer connected and the second my Ip, with the incriminated node I see this



47.106.143.234:49285 (id nodo: 26494)

via 127.0.0.1:8333



Why is the only I see connected via 127.0.0.1? Instead all the others I see go through my public IP.



Some ideas?

Maybe I'm making problems for nothing but I'm moving my first steps so I have to learn a lot!

[1715111664]

1715111664

[1715111664]

1715111664

[1715111664]

1715111664

[1715111664]

1715111664

[KingZee]

I looked around a bit but couldn't find anything in the bitcoinj documentation.

https://bitcoinj.github.io/networking

Since you're not using bitcoinj yourself the only thing I can think of is that the "via 127.0.0.1:8333" is a part that's just sent from the connecting peer, which means it could be set to any value depending on their client and probably means nothing.

I can't figure out more than that and you'd probably have more information if you asked around the bitcoinj community rather than here.

Or since you already know his IP you could like, just ban him. :p

[jackg]

127.0.0.1 when I’ve used it is the internal hoatname of your server.

Ban it if it’s bugging you and see if anything happens ... What harm can it do?

[HCP]

Why is the only I see connected via 127.0.0.1? Instead all the others I see go through my public IP.

Some ideas?

Is it possibly just the difference between incoming/outgoing connections?

Looking at my node... all the Outbound connections show the "via aaa.bbb.ccc.ddd:8333" line (where aaa.bbb.ccc.ddd is my public IP)... whereas the inbound connections all appear to show as "via 127.0.0.1:8333".

[dende93]

I looked around a bit but couldn't find anything in the bitcoinj documentation.

https://bitcoinj.github.io/networking

Since you're not using bitcoinj yourself the only thing I can think of is that the "via 127.0.0.1:8333" is a part that's just sent from the connecting peer, which means it could be set to any value depending on their client and probably means nothing.

I can't figure out more than that and you'd probably have more information if you asked around the bitcoinj community rather than here.

Or since you already know his IP you could like, just ban him. :p

I'll try to watch in the bitcoinj community thanks, anyway the strangest thing is that I had 60 connections only from that IP.

[dende93]

127.0.0.1 when I’ve used it is the internal hoatname of your server.

Ban it if it’s bugging you and see if anything happens ... What harm can it do?

Yes, the simplest thing to do was to ban him. And I did it   

[dende93]

Why is the only I see connected via 127.0.0.1? Instead all the others I see go through my public IP.

Some ideas?

Is it possibly just the difference between incoming/outgoing connections?

Looking at my node... all the Outbound connections show the "via aaa.bbb.ccc.ddd:8333" line (where aaa.bbb.ccc.ddd is my public IP)... whereas the inbound connections all appear to show as "via 127.0.0.1:8333".

No I don't think so, because yes outbound connections show the "via xxx.xxx.xxx:8333" that is my pubblic IP, but also most of the inbound show the same except these peers running bitcoinj and another one that has as user agent /btc-seeder:0.0001/ (idk what it is). Those I've seen so far at least 

[KingZee]

No I don't think so, because yes outbound connections show the "via xxx.xxx.xxx:8333" that is my pubblic IP, but also most of the inbound show the same except these peers running bitcoinj and another one that has as user agent /btc-seeder:0.0001/ (idk what it is). Those I've seen so far at least  

Taken from :
https://en.bitcoin.it/wiki/Protocol_documentation#version

I'm sure that the IP you see there is not necessarily correct. It's just what bitcore reads from the initial version message that is sent from the other peer. You could literally set the value to any ip and send it and that's what the other peer will see. Because it doesn't make sense for you to see a localhost ip in there, it's impossible. I honestly don't know the docs that well to know which value it is, it's probably addr_from, but I'm 100% sure those values don't mean anything like I said in my last post.

[jackg]

No I don't think so, because yes outbound connections show the "via xxx.xxx.xxx:8333" that is my pubblic IP, but also most of the inbound show the same except these peers running bitcoinj and another one that has as user agent /btc-seeder:0.0001/ (idk what it is). Those I've seen so far at least  

Taken from :
https://en.bitcoin.it/wiki/Protocol_documentation#version

I'm sure that the IP you see there is not necessarily correct. It's just what bitcore reads from the initial version message that is sent from the other peer. You could literally set the value to any ip and send it and that's what the other peer will see. Because it doesn't make sense for you to see a localhost ip in there, it's impossible. I honestly don't know the docs that well to know which value it is, it's probably addr_from, but I'm 100% sure those values don't mean anything like I said in my last post.

It's addr_from that has the address of the node you're connected to.
There's also a nonce that's sent so if might be that the IP API checkers that are used are returning the wrong address (or someone's badly edited that value)... Tl:Dr, IP detection isn't accurate enough for the core devs to like it so we should assume  it's likely it's wrong.