I'm trying to understand the likelihood that a node would connect to a sybil attacker, and the critical piece to this that I don't understand is: how often does a bitcoin node connect to a random node that might be part of a recently-created fleet of sybil attacker nodes.
A node has a number of ways it finds addresses to connect to. Nodes have some seed addresses (IP and DNS) hard-coded into the software. Nodes that have never connected before will connect to some of those hard coded addresses and request more addresses. Nodes that have connected before will attempt to connect to addresses in its database.
My first question is: for any given outgoing connection, what is the approximate likelihood a node is able to connect to an address in its database vs one from a hardcoded address (which are presumably sources of more "random" addresses)?
My second question is: how often are random addresses added into a node's database, and how often are address entries removed from a node's database?
The larger question I'm trying to get an estimate to is: what is the average minimum age of a peer that a node connects to? By "minimum age" I mean, for any given peer, how long must that peer have been around in the network in order for a node to connect to it with a given method. For example, an address entry in a node's database will at least be as old as the database entry. Also, addresses obtained from the hardcoded DNS seed have some average minimum age.
Does anyone have any information that would illuminate some of these questions?
