Wonder who this solominer is? 88.6.216.9

[Clipse]

Strangest thing the blocks relayed by that IP is allways without any transactions.

[1714103801]

1714103801

[1714103801]

1714103801

[1714103801]

1714103801

[1714103801]

1714103801

[1714103801]

1714103801

[1714103801]

1714103801

[DeathAndTaxes]

Not strange.  Someone who only cares about revenue can save overhead by mining blank blocks. Pretty lame but there is little advantage of including transactions, and none for free transactions. Likely running a modified version of bitcoind who's get work consists of just the coinbase.

Personally I wish he would join p2pool.

[Clipse]

Well considering the daily blocks solved by that relay would make it the 3rd biggest pool atleast in alst 24hrs.

Edit: ah seems to be same Spanish mining farm, interesting.

[eleuthria]

Very interested to find out what this IP is.  Been looking at it, and the way the transactions work, paired with the size makes me fear it's a botnet.  The easiest way to run a botnet without a pool:  Make a special server that distributes a wallet address, a hash of the previous block, and the current difficulty, and let the bot do all its own work instead of the grabbing work from bitcoind.

If it's not a botnet, then we've got a major player coming in that is effectively "attacking" {generating blocks but purposely not putting in transactions} the network.  Obviously luck could be a factor, but the current generation rate is well over 1TH/sec.

[Clipse]

Yeh, 1.5TH seems just a bit out of the blue for a solofarm, thats some serious investment.

[DeathAndTaxes]

Very interested to find out what this IP is.  Been looking at it, and the way the transactions work, paired with the size makes me fear it's a botnet.  The easiest way to run a botnet without a pool:  Make a special server that distributes a wallet address, a hash of the previous block, and the current difficulty, and let the bot do all its own work instead of the grabbing work from bitcoind.

If true then it is nothing to be feared.  It adds to the protection of the network and without causing disruptions to pools. 

It would be one hell of a botnet.  Looking at blocks in last 24 hours unless it is on one monster lucky spree it would need to have ~1800 GH/s.  Since average CPU is maybe 1 MH/s (unless it is a botnet which just targets i-7 nodes) we are talking 1.8 million active nodes.

[rjk]

Very interested to find out what this IP is.  Been looking at it, and the way the transactions work, paired with the size makes me fear it's a botnet.  The easiest way to run a botnet without a pool:  Make a special server that distributes a wallet address, a hash of the previous block, and the current difficulty, and let the bot do all its own work instead of the grabbing work from bitcoind.

As you yourself have pointed out previously, such a large botnet would require a massive investment in proxy hardware that could stand up to it. I would be interested in what kind of profits such a botnet would have, after deducting the cost of the proxy.

Also, I heard something on IRC back in November about some guy that had access to "some kind of hardware" and was asking us how to utilize it without anyone being able to locate it. Our advice was to run a proxy from his home or from a cheap VPS. Still wondering how that turned out, as well as what the hardware might have been.

[eleuthria]

As you yourself have pointed out previously, such a large botnet would require a massive investment in proxy hardware that could stand up to it. I would be interested in what kind of profits such a botnet would have, after deducting the cost of the proxy.

Also, I heard something on IRC back in November about some guy that had access to "some kind of hardware" and was asking us how to utilize it without anyone being able to locate it. Our advice was to run a proxy from his home or from a cheap VPS. Still wondering how that turned out, as well as what the hardware might have been.

I stated previously the kind of hardware it would take for a botnet to proxy around and use a traditional pool.  THIS type of behavior would be drastically different.  A custom coded server that responds to a bot with:  UniqueWallet,PrevBlockHash,Difficulty, and a solo miner that takes that information and continually generates its own work instead of relying on a central bitcoind to generate work on its behalf.

[Clipse]

Simple answer: Spain enforces every citizen to bitcoin mine to make up for the countries limited TAX returns

[roomservice]

I bet this company here is testing one of their fpga/asic products: http://www.sevensols.com/

It's located in Granada, Spain. That's where the ip is from.

[Clipse]

I bet this company here is testing one of their fpga/asic products: http://www.sevensols.com/

It's located in Granada, Spain. That's where the ip is from.

Well colour me chocolate, that is a good find

[rjk]

As you yourself have pointed out previously, such a large botnet would require a massive investment in proxy hardware that could stand up to it. I would be interested in what kind of profits such a botnet would have, after deducting the cost of the proxy.

Also, I heard something on IRC back in November about some guy that had access to "some kind of hardware" and was asking us how to utilize it without anyone being able to locate it. Our advice was to run a proxy from his home or from a cheap VPS. Still wondering how that turned out, as well as what the hardware might have been.

I stated previously the kind of hardware it would take for a botnet to proxy around and use a traditional pool.  THIS type of behavior would be drastically different.  A custom coded server that responds to a bot with:  UniqueWallet,PrevBlockHash,Difficulty, and a solo miner that takes that information and continually generates its own work instead of relying on a central bitcoind to generate work on its behalf.

I see, interesting. I can understand that a solominer of this scale would need fewer resources than a proxy. It would be fun to know exactly how much resource would be needed.

[TurdHurdur]

watching

posting

[c_k]

watching

Goat, just click 'notify' instead of posting in the thread to 'watch' it

[eleuthria]

I see, interesting. I can understand that a solominer of this scale would need fewer resources than a proxy. It would be fun to know exactly how much resource would be needed.

Tough to say exactly what you'd need to respond to it, but just some rough numbers.  Assuming a 1 million bot botnet (which might be conservative):

If each bot checks in once per minute to see if the block has changed, you're looking at 16.6k connections per second.  Lets assume its still using HTTP just for simplicity.  The response will be ~200 bytes including headers/overhead give or take if no block change has occurred, and ~300 bytes if it did (a response would have to include wallet address, prevblockhash, and difficulty).  A block change every 10 minutes would mean every 10 minutes you have 2375 bytes of data being transferred, per bot.

That comes out to 1.95 gigabytes per 10 minutes, or 27 mbps.  You'd probably have a fairly even distribution since each bot started at different times, though it would actually be 25 mbps 9 minutes out of 10, and 38 mbps for the minute after a block change.

16.6k connections per second is the real bottleneck there.  However, if the system was distributed to where the slaves contact any one of 25 cheap $5 VPSes, you have about 600 connections per second, and each VPS would only need ~1 mbps of transfer.  Basically 1 hour worth of bot activity would likely pay for an entire month of servers.  They could add/remove servers quickly and use DNS as a method for distributing the bots without a central control location.


The above is why I stated this type of activity is scary, even though it is inevitable.  You're looking at a system that could easily grow to make up a majority of the network, for a few hundred dollars a month in expenses to the operator.  It can, and eventually will make mining unprofitable for any legitimate party*.  It would be good for network security, unless it was turned into a 51% attack attempt.  Alternatively, it could be a sort of strangulation attack, where the the botnet is pumping out 0 tx blocks, and difficulty gets driven up to the point legit blocks can't fit all the transactions into them, causing a growing backlog.

*: By "any legitimate party" I'm not including very small miners. While some people do have free electricity, very few can grow beyond a few GPUs before a landlord gets suspicious/angry.  And even then, it could reach the point where the mining income doesn't match the cost to replace dying hardware.

[eleuthria]

Just to be completely clear, everything I'm posting is pure theory.  There is nothing that says 88.6.216.9 is a botnet bitcoind node, or has any setup like what I described above.  A lot of what I've posted came from originally looking at what it would take to redesign the current miner/pool communication model, but modified to how it could work if designed for a malicious user.

I suppose in the end this is preferred to the alternative:  1 million bot miners bouncing between pools and taking them offline with the obscene levels of overhead/traffic it would generate if acting legit.

[Garr255]

watching

Goat, just click 'notify' instead of posting in the thread to 'watch' it

But then they wouldn't get their precious post count as high as it is

[Retired]

Simple answer: Spain enforces every citizen to bitcoin mine to make up for the countries limited TAX returns

What do you mean?

[c_k]

watching

Goat, just click 'notify' instead of posting in the thread to 'watch' it

But then they wouldn't get their precious post count as high as it is

Hmm, yeah I guess that makes sense.

And here I was think GigaVPS was just trolling after my post

[rjk]

watching

Goat, just click 'notify' instead of posting in the thread to 'watch' it

But then they wouldn't get their precious post count as high as it is

Hmm, yeah I guess that makes sense.

And here I was think GigaVPS was just trolling after my post

lol. Clicking "notify" enables email notifications, but doesn't subscribe the thread to your "new posts" replies page.