Re: Re: Why competing Gnutella clients help LimeWire

On May 9, 2007, at 8:27 PM, Bill Pringlemeir wrote:

>> On May 8, 2007, at 12:33 PM, Bill Pringlemeir wrote:
>
>>> One attack stated is to have a lot of long uptime nodes disappear
> at the same time.  The hope is to fragment the network.
>
> --- In [email protected], Roger Kapsi <roger@...> wrote:
>
>> They'd have to spawn a gigantic number of Nodes to accomplish this.
>> The bigger your presence in the DHT is the more traffic you must
>> handle. If you can't handle the traffic you'll be declared as dead
>> and replaced by an another Node.
>
> I don't know how many nodes for a successful attack.  However, you
> only need k (ie, 20) long live nodes in with the same leading prefix
> to theoretically suceed.  The opposite prefix nodes should have the
> leading k-buckets populated with these nodes.  If they all disappear
> at once, there would be no reference from one half to the other.  In
> reality, the attack will be much more than this, but performing the
> identical attack on several levels of k-buckets is possible.  That
> might only be a few hundred nodes versus millions of legitimate nodes.
>
> Also, malicious nodes can be at the same IP address.  It would be
> fairly difficult to know that multiple node ids mapped to the same
> host.  And this may make sense for NAT type peers.

That's why you want to limit the number of Nodes per k-bucket per  
Class C Network. Under the assumption the DHT is big and the Node IDs  
are globally/random the chances are slim to none that two or more  
Nodes end up in the same k-bucket of somebody's RouteTable.

The same applies to FIND* responses. It's suspicious if a certain  
number of the k-contacts in the response is from the same IP range.

We already take care of the latter and I'll add some code for the  
first case soon.

  Roger