OpenSats Work-Log 7
Friday, October 31, 2025This is a copy of the 7th work-log I sent to OpenSats for my LTS grant.
Disclaimer: Some information that is not (or not yet) meant to be published may have been redacted.How did you spend your time?
Publications & Talks
- Continued my “Stats on compact block reconstructions”: thread by posting an update and some of the current work: https://delvingbitcoin.org/t/stats-on-compact-block-reconstructions/1052/24
- Created a topic for peer-observer on delving for people who want to stay up-to-date with the project: https://delvingbitcoin.org/t/peer-observer-a-tool-and-infrastructure-for-monitoring-the-bitcoin-p2p-network-for-attacks-and-anomalies/1988
- At CoreDev, did a Spark session on “When do Bitcoin node operators upgrade?”. Plan to publish a blog post on this at some point.
Bitcoin Core
- planned and attended CoreDev meeting: https://coredev.tech/2025_frankfurt.html
- opened PR “p2p: reduce false-positives in addr rate-limiting” (https://github.com/bitcoin/bitcoin/pull/33699) based on the observation documented here https://bnoc.xyz/t/bitcoin-core-addr-gossip-is-rate-limited-right-after-connection-open/47
- opened PR https://github.com/bitcoin/bitcoin/pull/33133 to fix the RPC docs of getpeerinfo ping field
- opened issue “signet: disk-space-DoS due to low mining difficulty” (https://github.com/bitcoin/bitcoin/issues/33266) after previously disclosing the signet vulnerability and it being fixed
- Bitcoin Core GUIX sigs for:
peer-observer
A tool and infrastrucuture to monitor for attacks and anomalies in the Bitcoin network with passive monitoring.
I worked on the tooling, the infrastructure, and a demo instance over the past few months.
Tool
https://github.com/0xB10C/peer-observer
Since August, there have been 180+ commits in that repo across 57 PRs by 4 authors. I’m only listing the most interesting ones below:
- https://github.com/0xB10C/peer-observer/pull/191: added a new extractor that fetches from the getpeerinfo RPC
- https://github.com/0xB10C/peer-observer/pull/256: added a new extractor that measurements against the nodes P2P interface (e.g. bitcoin-ping duration)
- https://github.com/0xB10C/peer-observer/pull/272: added a new extractor that parses the debug.log file and emits events (contributed by @m4ycon; I only reviewed it)
- https://github.com/0xB10C/peer-observer/pull/213: added a bunch of Grafana dashboards I stored elsewhere to the repo
- https://github.com/0xB10C/peer-observer/pull/215: added a metric for LinkingLion traffic based on a discussion with gmax
- https://github.com/0xB10C/peer-observer/pull/241: reduced the resource usage (CPU, bandwidth, RAM) of metrics tool by removing high-cardinallity metrics
- https://github.com/0xB10C/peer-observer/pull/249: metric for peers relaying sub-1sat/vbyte txns to track adoption
- https://github.com/0xB10C/peer-observer/pull/269: added new events for RPC-extractor based on getmempoolinfo events
- As part of https://github.com/0xB10C/peer-observer/issues/26 (Integration test the tools and extractors):
- https://github.com/0xB10C/peer-observer/pull/222: integration tests for the metrics tool
- https://github.com/0xB10C/peer-observer/pull/229: integration tests for the websocket tool
- https://github.com/0xB10C/peer-observer/pull/268: integration tests for the logger tool
- https://github.com/0xB10C/peer-observer/pull/231: integration tests for the rpc-extractor
Infrastructure
Next to the tooling component of peer-observer, there is also a infrastructure component for running nodes, connecting the extractors to the nodes, collecting system metrics, and more. Since this is infrastructure is defined as code for NixOS systems, it’s possible to track in git and share. Previously, the infrastructure and individual honey pot host definitions were mixed and sharing them would have revealed too much information about the honey pots. However, I spent a bit of time extracting an opinionated library for defining peer-observer hosts. This has multiple benefits:
- the host definitions can be tested in CI with full integration tests
- the library can be published as FOSS and used by others too, if they want
- the “production” implementation (i.e. “honey pot host definitions”) can remain private
- the library can be used to set up a fully public demo instance
The library can be found in https://github.com/0xB10C/peer-observer-infra-library but as of writing, is still missing a bunch of documentation.
A fully public demo instance (sponsored by Localhost Research) is available on https://demo.peer.observer and the infrastructure definitions (using the above library) can be found in https://github.com/0xB10C/peer-observer-infra-demo.
Bitcoin Network Operations Collective (bnoc.xyz)
I hinted at something similar in https://b10c.me/projects/024-peer-observer/#a-bitcoin-network-operations-collective. The https://bnoc.xyz is a first step in bringing such a collective forward. While I haven’t announced it publicly yet, the forum is meant for people to post their raw network observations and allow for discussions on network events.
So far, I’ve been mainly been posting old notes there and a few others have started to post their observations too. I plan to annouce it in the next few months.
Misc
- updates the NixOS bitcoind package:
- v29.0 -> v29.1: https://github.com/NixOS/nixpkgs/pull/440372
- v29.1 -> v30.0: https://github.com/NixOS/nixpkgs/pull/451606
- https://github.com/jamesob/delving-bitcoin-archive/pull/1: looked into delving archive
- Kept bitcoin-data/stale-blocks up-to-date with recent stale blocks:
- Organized and held Socratic Seminar #4 for BTCFFM: https://github.com/btcffm/website-btcffm/pull/28
What do you plan to work on next quarter?
- peer-observer-infra-library:
- work on set up documentation and better README
- plenty of other open issues
- peer-observer tooling:
- continue working on open issues. The main ones are:
- https://github.com/0xB10C/peer-observer/issues/263: more P2P-extractor events
- https://github.com/0xB10C/peer-observer/issues/199: more RPC-extractor events
- https://github.com/0xB10C/peer-observer/issues/185: alert on predefined heuristics
- https://github.com/0xB10C/peer-observer/issues/121: figure out how to archive events
- https://github.com/0xB10C/peer-observer/issues/13: finally get to anomaly detection?
- continue working on open issues. The main ones are:
- bnoc.xyz
- annouce it publicly and continue filling it with content
- set up a backup and a simple HTML mirroring for bnoc
- while at it, set up a backup for delvingbitcoin too and mirror posts
- Based on recent discussions, we noticed that we don’t have good data on block propagation. Possibly add some monitoring there.
- blog posts:
- I have data on Bitcoin nodes upgrading, and plan to publish a blog post or similar on this at some point.
- I’m expecting to get data on historical block propagation soon. This allows to look into how e.g. non-standard transaction really affect block proagation.
- The KIT DSN has been running P2P network monitoring and block propagation for close to 10 years now, however they might shutdown some of their services next year. It would be good to set up some block propatagion monitoring for our self.
My open-source work is currently funded by an OpenSats LTS grant. You can learn more about my funding and how to support my work on my funding page.
Text and images on this page are licensed under the Creative Commons Attribution-ShareAlike 4.0 International License