0

I sent a Version message shown below:

F9BEB4D976657273696F6E0000000000560000003EA2EDFF7111010001000000000000003CE5725A00000000010000000000000000000000000000000000FFFF5B86CFD0208D010000000000000000000000000000000000FFFF________208D847C51678AA429DE000000000000

I received the following message:

F9BEB4D976657273696F6E0000000000680000002C00D4E37F1101000D00000000000000DCE0725A00000000010000000000000000000000000000000000FFFF________208D0D00000000000000000000000000000000000000000000000000E665131FDCB099B0122F5361746F7368693A302E31352E302E312FC7BC070001F9BEB4D976657261636B000000000000000000005DF6E0E2

The response received is in a TCP packet itself and from the packet, it seems like there is two Bitcoin protocol messages in a single TCP packet response.

Dissecting the above response, it is made of a VERSION command that is replied to me:

F9BEB4D976657273696F6E0000000000680000002C00D4E37F1101000D00000000000000DCE0725A00000000010000000000000000000000000000000000FFFF________208D0D00000000000000000000000000000000000000000000000000E665131FDCB099B0122F5361746F7368693A302E31352E302E312FC7BC070001

And also a VERACK response:

F9BEB4D976657261636B000000000000000000005DF6E0E2

Is it a typical behavious for Bitcoin protocol to bunch up as much messages into a single TCP packet before sending it out ?

Note: Both messages have IP address cleaned out via underscore marks.

  • Is this happening only for the VERSION/VERACK messages? – FedFranzoni Feb 1 '18 at 11:12
  • I am using a TCP manipulation software to understand the protocol of Bitcoin and while experimenting, I have seen more than just VERACK. There is also the ALERT message (as I am emulating version 70001). – thotheolh Feb 1 '18 at 11:32
  • Do you mean the three on the same message? I understand you're controlling both nodes, and using the same client (Bitcoin Core 0.8.0?). Is that correct? – FedFranzoni Feb 1 '18 at 13:35
  • I am using a TCP manipulation software and sending it out to a public node that I do not control. So, I have my emulator acting as a 70001 node and some unknown public node on the Internet that I am randomly interacting to. – thotheolh Feb 2 '18 at 0:39
  • Well, I keep thinking my answer is the most reasonable I can imagine. Since nodes advertise their client too, you could try to see if different clients act in a different way, or if this piggybacking behavior is used by all. Also you can see if it is used for all messages or just specific ones (usually this technique can only be used when you can have the response message in a short time, so as not to make the other node waiting too much for the ack). Let us know what you find out :) – FedFranzoni Feb 2 '18 at 15:34
1

In TCP communications it is common to use a technique known as "piggybacking". Let's say A and B are communicating over TCP. Normally, after receiving a message from A, B should send an ACK message to let A know he received it correctly. In order to minimize the number of messages, B can "encapsulate" the response message into the ACK, so that A will receive the response along with the ACK.

Since Bitcoin works on TCP, it is reasonable that the same technique is applied.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.