#ls2 (irc2p) | #ls2 Proposal 168 review here 8 PM UTC Tues. Dec. 3

zzz what we do: SSU2 tells NTCP2 what the external port is

dr|z3d interesting looking at the 2-tiered approach to banning peers making excessive tunnel requests.

dr|z3d first they get rejected, and for a good proportion of peers, that's sufficient to make them back off.

dr|z3d a few peers, however, keep going, and then they get temp banned for 1/2 hour. seems pretty effective, especially when targetting L/unreachable peers.

dr|z3d very rarely seeing high b/w tier routers getting snagged, their budget is higher.

dr|z3d the policy isn't totally removing the part tunnel spikes, but when they do occur, they're much less pronounced.

dr|z3d A sample with obfuscated timestamps: cake.i2p/view/vA4kBxKyx1_qRqtvUUwza0wkESOSYczgQcxPemjG8_r2Lg9BTWt4/vA4kBxKyx1.txt

zzz bitcoin jonatack doc change PR, please review/comment github.com/bitcoin/bitcoin/pull/26838/files

dr|z3d looking better.

dr|z3d "It is possible, though strongly discouraged, to change your I2P router

dr|z3d configuration to limit the amount of I2P traffic relayed by your node."

dr|z3d that's good, but then he keeps the sample config for i2pd the same as it was before. not good. there's no scenario where limiting transit tunnels to 20 works.

dr|z3d limiting transit tunnels to 500 often results in a poorly performing router, at least on java.

dr|z3d he also wants a section in there to encourage port forwarding where required, to avoid being firewalled, for optimal router performance.

dr|z3d still, progress.

Xeha amount of transit tunnels should be at least the same amount they consume

dr|z3d can you do me a favor, zzz, and confirm or deny my theory that MAX_BAD_REPLIES_PER_HOUR in ProfileOrganizer will prevent the attack of a 1000 malformed routers?

Xeha otherwise they're leechers

dr|z3d *malformed RIs

dr|z3d he's added something about that, Xeha, though more clarity wouldn't hurt. "It is also

dr|z3d important that the nodes of a popular application like Bitcoin contribute more

dr|z3d to the I2P network than they consume."

Xeha 50% share AND 20 transittunnels, thats just pure leeching

dr|z3d that's my point. I think it's probably best for zzz to carry on communicating with the dev on that ticket, no sense everyone piling in.

dr|z3d he should probably be advised that changing either b/w share _OR_ transit tunnels is sufficient to constrain b/w usage, and that 1000 tunnels minimum or 80% share of 256KB/s if the b/w is available is a reasonable config.

zzz dr|z3d, looks like "deny" - peerSendsBadReplies() is used in only one place, to skip them for a netdb verify

zzz and, ofc, you don't know where a DSM came from anyway, it's not necessarily a "reply"

dr|z3d ok, zzz, thanks. maybe that method could be extended and made a bit more robust, or not.

zzz well, most of the reply stuff is commented out, but in any case, of course, it's for replies to lookups, and it definitely won't kick in for unsolicited stores, where you don't and can't know the source

dr|z3d we're throttling unsolicited stores in OutboundMessageDistributor.

dr|z3d MAX_ROUTERS_PER_PERIOD specifically, no?

zzz re: bitcoin ticket, no, I don't want to be the only one commenting or the sole representative of the community advising on best practices, esp. when the primary router used is i2pd

dr|z3d up to you, but it's probably going to carry much more weight if you act as the i2p emissary.

zzz sure, but I can't become the i2pd whisperer

dr|z3d just remove i2pd from the equation when you're formulating your responses, the recommendations in that doc, though they're more weighted towards i2pd, are applicable to the whole network.

zzz if you don't want to contribute over there, fine, but please don't discourage others

dr|z3d no where am I discouraging others from contributing, I've all along been suggesting that you carry on the dialog with suggestions for how to improve the documentation. if you don't want to assume that role, that's fine, but don't make me the bogeyman.

zzz ok, I misunderstood. I'll weigh in when I get a chance, maybe after it shakes out a little more

zzz anybody know if the btc protocol has a flag that says 'outbound only' ?

zzz or will a router with 10 address get all of them gossipped around and everybody will try to connect to all 10?

dr|z3d ok, great. you've got jonatack's attention and he's listening to your suggestions is really all I'm saying. we don't want to dilute that if at all possible. you're essentially in the driving seat :)

zzz more drivers wouldn't hurt imho

orignal weko can you test it?

weko Test what?

orignal that your NTCP2 is reachable though the port SSU2 tell you

weko I can I think

orignal that's the good question

orignal please try

weko Okay

weko I need rebuild

orignal no, just use nc

orignal check port you receive packet from

orignal and hit TCP port on that box

weko orignal: no i cant connect with port that i recieve from SSU2 peertest

weko with my congif port i can

weko config*

orignal zzz, so it wouldn't work

zzz interesting. we would not handle that well.

zzz dr|z3d, I commented on the PR

orignal zzz so what should we do in this case?

orignal basically what port should be publised for SSU2 address

zzz whatever port works

zzz the internal/external port concept is still a good one for SSU2

zzz if the NAT does something different for UDP and TCP, that's a separate issue

Xeha zzz: could have mentioned the transit tunnels too...

zzz they do have i2pd-specific changes in the PR Xeha, I'll leave the i2pd people to comment on that if they want

zzz when I said "limits" I meant both bandwidth and tunnels

orignal what do you do if real endpoint doesn't match publised endpoint?

zzz for NTCP2?

orignal for SSU2

orignal TCP alsways uses ephemeral ports

zzz we look at the session created. If two peers agree, we change published endpoint

zzz subject to all the limitations I listed yesterday

orignal how about SessionConfirmed?

orignal shouldn't we check it when we receive actual RI?

zzz I don't know. A lot of our code on this is 20 years old and pretty fragile

orignal my concerte question is

orignal can we leave port as is if we received msg 5

zzz yes, that's my recommendation in zzz.i2p/topics/3489

orignal fine

orignal let's go this way

zzz :)

orignal will just show error status "Cone NAT"

zzz "Full cone NAT" en.wikipedia.org/wiki/Symmetric_NAT

zzz vs. restricted

zzz ru flavor without pictures :) ru.wikipedia.org/wiki/NAT

orignal I know

orignal just telling what I'm going to do

zzz it's too bad ru wiki doesn't get pictures though

orignal I'm able o read english )))

zzz :)