Modern versions of bitcoin core establish a fixed number of outbound connections: 8 outbound-full-relay connections and 2 block-relay-only connections. What is the purpose of block-relay-only connections and how are they used?

Here are two example log entries of a node establishing these connections:

2022-03-10T14:50:36Z New outbound peer connected: version: 70015, blocks=726709, peer=1566 (outbound-full-relay)
2022-03-10T14:55:28Z New outbound peer connected: version: 70016, blocks=726710, peer=1576 (block-relay-only)

Here is an example CLI query showing all connected peers:

$ bitcoin-cli -netinfo
Bitcoin Core v22.0.0 - 70016/Satoshi:22.0.0/

            ipv4    ipv6   onion   total   block  manual
    in         0       0      24      24
    out        2       0       9      11       2       1
    total      2       0      33      35

Local addresses
REDACTED     port   8333    score      4

Note: this node has one addnode entry in its bitcoin.conf file. Nodes connected to in this fashion do not count against the 8 and 2 outbound connection limits so this adds an additional 11th outbound peer.

1 Answer 1


Block relay connections were added to bitcoin core in v0.19.0.1 in November 2019. Their purpose is to harden the peer-to-peer network against partition attacks. They do this through a clever combination of factors:

Protection from Network Topology Information Leaks

A bitcoind node will not gossip address or transaction information over a block-relay-only connection. This prevents the node from leaking network topology information. A network topology map can be dangerous for two reasons:

  • It can be used to trace the origin IP of a bitcoin transaction.
  • It can be used to perform an eclipse attack.

Increase Outbound Connections Without Significantly Increasing Network Traffic

Address and transaction gossip messages make up the majority of a node's network bandwidth consumption. So adding additional outbound connections that do not gossip these messages allows for a more tightly integrated network graph with a very limited impact on the bandwidth required to run a node.

Anchor Nodes

Normally, a bitcoin node will connect to random peers upon startup. An anchor connection is an outbound node connection that persists across a restart. Block-relay-only connections were converted to anchor connections in v0.21.0 released in January 2021.

Anchor connections protect from a remote restart attack, which is the most likely vector of an eclipse attack. The attack works like this:

  • Flood the target node's address manager with malicious node addresses.
  • Use some other exploit to force the target node to restart (or wait for a software upgrade). This tricks the target node into clearing its outbound connections and connecting only to malicious nodes.

Too many anchor nodes can be a bad thing because it will entrench a malicious node connection and make it difficult for a node to defend or recover from an eclipse attack. They can also make the network topology graph more static, and therefore easier to map and easier to partition. But you definitely want to have a few anchor nodes to protect from remote restart eclipse attacks with some redundancy. Using block-relay-only connections as anchor connections strikes a nice balance in this regard. This configuration also benefits from the fact that block-relay-only connections are difficult for an attacker to detect due to their lack of ADDR and TX messages.

Anchor connections harden the peer-to-peer network using the "one honest peer" principle. As long as a bitcoin node is connected to one honest peer it will be able to stay informed about the chain of valid blocks with the greatest total proof of work. The node is able to rely on the unforgeable costliness of proof of work as the ultimate security guarantee. This, in turn, depends on an attacker not gaining control of a majority of the hashpower on the network. To put it succinctly, block-only-relay nodes bind the peer-to-peer security model more closely to the proof of work security model.

Additional Resources

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.