Peer Discovery

A zero-configuration service discovery protocol used in local networks (LAN). It allows nodes to discover each other's services without a central directory.

• Peers broadcast their presence using UDP multicast packets to a well-known address (224.0.0.251).
• Commonly used in libp2p for local peer discovery and by IoT blockchain networks.
• Limited to a single network segment, making it unsuitable for global discovery.

Hardcoded or configurable initial contact points that provide the entry vector into the peer-to-peer network. A new node uses these to get its first peer list.

• Static List: Pre-configured addresses in client software (e.g., Ethereum's mainnet.json).
• DNS-based Lists: Clients resolve a DNS TXT record to get a list of bootstrap nodes, allowing for easier updates.
• After initial connection, the node uses the active protocol (e.g., Discv5) for further discovery.

A gossip mechanism where connected peers actively share lists of other known peers. It supplements structured discovery protocols like DHTs.

• BitTorrent uses PEX messages to exchange peer IP/port tuples.
• In blockchain clients, it helps maintain a healthy, diverse peer set and recover from network partitions.
• Can be vulnerable to sybil attacks if not combined with identity/trust mechanisms.

An eclipse attack occurs when a malicious actor isolates a target node by monopolizing all its incoming and outgoing connections with adversarial peers. This prevents the victim from seeing the honest network, enabling double-spends or censorship.

• Mechanism: Attackers populate the victim's peer table with IPs they control.
• Prerequisite: Requires the ability to establish many Sybil identities.
• Mitigation: Use diverse peer selection, outbound connection limits, and peer reputation systems.

A Sybil attack is where an adversary creates a large number of pseudonymous identities (Sybil nodes) to gain a disproportionately large influence over the network. This is a foundational threat to peer discovery.

• Impact: Can subvert consensus, spam the network, or enable eclipse attacks.
• Defense: Resource-based costs (Proof-of-Work, stake), trusted bootnodes, or identity verification through social or institutional graphs.

Many networks rely on DNS seeders or hardcoded bootnodes for initial peer discovery. Compromising these centralized points of trust can poison the peer lists for new nodes.

• Risk: Redirects nodes to connect only to malicious peers.
• Example: The 2018 attack on Ethereum's Geth client via compromised DNS records.
• Hardening: Use multiple, independently operated seeders, DNSSEC, and fallback to peer lists stored in the client.

The underlying P2P protocols used for discovery, such as Kademlia (DHT) or Discv5, can have implementation flaws or design vulnerabilities.

• Kademlia Issues: Vulnerable to eclipse attacks due to predictable nodeID generation and lookup paths.
• Discv5 Improvements: Introduces stricter cryptographic handshakes and topic-based advertising to reduce attack surface.
• General Defenses: Regular client updates, fuzz testing, and adherence to specification.

Network partitioning can be induced at the internet infrastructure level, such as through BGP hijacking, to isolate a subset of nodes from the main network.

• Mechanism: An AS (Autonomous System) falsely advertises ownership of IP prefixes, rerouting traffic.
• Consequence: Creates temporary forks, disrupting consensus and enabling double-spends on the isolated segment.
• Resilience: Decentralized infrastructure across diverse ASes and geographic regions is critical.

Secure peer discovery implementations combine several strategies to mitigate risks.

• Diversity: Connect to peers from multiple sources (DNS, DHT, manual, persisted list).
• Limits & Rotation: Enforce max peer counts and regularly rotate connections.
• Reputation Systems: Score peers based on uptime and valid message history, ban malicious ones.
• Cryptographic Verification: Use node IDs derived from public keys to authenticate peers.

A Distributed Hash Table (DHT) is a decentralized key-value storage system that underpins peer discovery in networks like IPFS and BitTorrent. Nodes collectively maintain a map of network information without a central server.

• Kademlia DHT is the most common algorithm, where each node stores information about peers closest to its own ID in the address space.
• Enables efficient peer lookup with O(log n) complexity.
• Provides fault tolerance as the network state is replicated across many participants.

Bootstrap nodes are hardcoded, well-known entry points that provide the initial connection to a peer-to-peer network. They are essential for a new node's first connection.

• Act as the seed list for discovering the first active peers.
• In Ethereum, clients come with a list of bootstrap nodes run by the Ethereum Foundation and client teams.
• Once connected, a node uses the discovered peers to find more via the active peer discovery protocol, reducing reliance on the initial bootstrap list.

A node's identity is its unique cryptographic identifier, often derived from a public key. The Ethereum Node Record (ENR) is a standard format for this identity and associated metadata.

• An ENR contains the node's public key, IP address, port, and supported network protocols.
• It is signed by the node's key, ensuring authenticity.
• This record is exchanged during discovery (e.g., via Discv5) so peers can verify who they are connecting to and what services they offer.

While peer discovery finds nodes, gossip protocols (or Publish-Subscribe/PubSub) are used for broadcasting messages between connected peers.

• After discovery, nodes use gossip to propagate transactions, blocks, and other network data.
• Floodsub and Gossipsub are common implementations, with Gossipsub providing more efficient, topic-based message routing.
• This creates a mesh network of connected peers that efficiently disseminates information across the network.

NAT Traversal is the technique used to establish direct connections between peers located behind routers or firewalls (Network Address Translators).

• UDP Hole Punching is a common method where two peers coordinate via a publicly reachable server to open temporary ports in their respective NATs, allowing a direct P2P link.
• Critical for maintaining a healthy, decentralized network where many residential nodes are behind NAT.
• Protocols like libp2p have built-in mechanisms to facilitate this process.

Discv5 is the current node discovery protocol used by Ethereum and other networks. It is a UDP-based protocol designed for privacy and efficiency.

• Uses a Kademlia-based DHT to manage peer information.
• Implements Topic Advertising for finding peers interested in specific sub-protocols (e.g., a specific blockchain).
• Designed to resist eclipse attacks by making it difficult for an attacker to monopolize a node's peer connections.