Re: Why competing Gnutella clients help LimeWire

> On May 8, 2007, at 12:33 PM, Bill Pringlemeir wrote:

>> One attack stated is to have a lot of long uptime nodes disappear
at the same time.  The hope is to fragment the network.

--- In [email protected], Roger Kapsi <roger@...> wrote:

> They'd have to spawn a gigantic number of Nodes to accomplish this.  
> The bigger your presence in the DHT is the more traffic you must  
> handle. If you can't handle the traffic you'll be declared as dead  
> and replaced by an another Node.

I don't know how many nodes for a successful attack.  However, you
only need k (ie, 20) long live nodes in with the same leading prefix
to theoretically suceed.  The opposite prefix nodes should have the
leading k-buckets populated with these nodes.  If they all disappear
at once, there would be no reference from one half to the other.  In
reality, the attack will be much more than this, but performing the
identical attack on several levels of k-buckets is possible.  That
might only be a few hundred nodes versus millions of legitimate nodes.

Also, malicious nodes can be at the same IP address.  It would be
fairly difficult to know that multiple node ids mapped to the same
host.  And this may make sense for NAT type peers.

fwiw,
Bill Pringlemeir.