In the Bitcoin system to discover new nodes, each node communicates with its peers by sending getaddr() to the peers. Based on the bitcoin implementation:
//! the maximum percentage of nodes to return in a getaddr call
#define ADDRMAN_GETADDR_MAX_PCT 23
//! the maximum number of nodes to return in a getaddr call
#define ADDRMAN_GETADDR_MAX 2500
Based on Eclipse Attacks on Bitcoin’s Peer-to-Peer Network ∗
The peer responds with n randomly selected addresses from its tried and new tables, where n is a random number between x and 2500 and x is 23% of the addresses the peer has stored.
The reason behind this is to eliminate an eclipse attack (aka netsplit), where an attacker monopolizes the environment of a node by sending it compromised addresses.
The receiving node accepts a maximum of 1000 addresses because it is limited to a buffer size that can only hold 1000 addresses.
What is the 23% or the 2500 addresses based on?
Why is the buffer size limited to 1000 addresses?