4

Could someone explain why so many Bitcoin nodes allow Bloom filtering given that DoS attacks exist [1], [2] for such nodes?

According to bitnodes.21.co, right now 3879 nodes out of the total of 5515 Bitcoin nodes have Bloom filtering enabled.

Is it that these DoS attacks are not made any worse by Bloom filtering, as documented here by Mike Hearn? I quote:

Thus you can easily trigger exactly the same DoS attack by just using regular getdata requests on large blocks over and over. You don't need Bloom filtering. If you don't want to actually download the blocks just don't TCP ACK the packets and then FIN after a few seconds .... the data will all have been loaded and be sitting in the send buffers.

So even if I refine the attack and find a way to actually deny service to someone, the fix would have to apply to regular non-filtered block fetches too, which cannot be disabled.

Improve this question
3
  • 1
    Yeah looks like after reading Hearn's comments that the underlying issue is the fact that a client is able to request a bitcoin node to do some serious work by sending getdata requests. So the DoS vector isn't really in the bloom filter code as much as it is in the fact that bitcoin nodes allow anonymous connections to cause them to generate large work loads repeatedly. I have no idea if anyone's fixed this underlying problem.
    – Brandon
    Jul 19, 2016 at 4:51
  • Thanks! I don't think it's fixable: New nodes who join need to send getdata requests to old nodes to download the blockchain.
    – Alin Tomescu
    Jul 19, 2016 at 4:58
  • No problem. Thank you for asking the question as it informed me about a potential problem I was unaware. It seems to me this could be fixed by simply rate limiting the speed at which getdata requests are handled, but perhaps there are complexities I do not understand. Hearn says you send getdata requests over and over, so I would think the node should have some defensive logic here.
    – Brandon
    Jul 19, 2016 at 5:06

1 Answer 1

Reset to default
1

So I guess the answer is "Yes, nodes accept Bloom filters because filtering does not make existing DoS attacks any worse nor do they introduce any new DoS attacks."

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.