<p>The reason behind the network groups concept as used in Bitcoin Core (which correspond to AS numbers if you use asmap) is the rather vague notion that an attacker may get many IP addresses in a single range/network, but is unlikely to get access to IP addresses that belong to many distinct networks. It is very approximate, but it permits making some decisions that avoid Eclipse attacks and others as long as this assumption holds.</p>
<p>This notion does not apply in Tor, or other anonymization overlay networks like I2P or CJDNS. There is no concept of locality of address ranges in these networks: getting two addresses that are close or far apart has no bearing on cost, as these addresses are hashes of public key material.</p>
<p>Bitcoin Core treats all onion/I2P addresses as being in just 4 network groups for bucketing purposes, just so that not all keys map to the same thing, but there is little basis in reality for this. The whole idea of network grouls just doesn't apply to these networks.</p>

CC BY-SA 4.0
2022-10-11T21:25:58.657Z
So based on the bucketing algorithm, looks like if the source and the actual address are for an addr message both .onion,and if the node only accepts these kind of messages, then the node will only fill 256 buckets of the 1024 in the new table(theoretically). Or am I mistaken?
Vinay Shetty
CC BY-SA 4.0
2022-08-25T23:40:07.780Z
2022-08-25T23:40:07.780Z
Pieter Wuille
<p>I understand that the AS information plays a part in how addresses are populated in the buckets of the new table for IPv4/IPv6 addresses, but how does it work for .onion addresses?</p>
<p>I understand the address assignment into buckets for IPv4/IPv6 via <a href="https://github.com/bitcoin/bitcoin/blob/505ba3966562b10d6dd4162f3216a120c73a4edb/src/addrman.h#L57" rel="nofollow noreferrer">here</a> but the process for .onion address is not clear to me. The only thing I know is that the group for the .onion address is the first 4 bytes of the address(without the .onion)</p>

<bitcoin-core><address-generation><tor>
.onion addresses in buckets
Vinay Shetty
# .onion addresses in buckets

(Asked by: username_0 on 2022-08-25)

I understand that the AS information plays a part in how addresses are populated in the buckets of the new table for IPv4/IPv6 addresses, but how does it work for .onion addresses?

I understand the address assignment into buckets for IPv4/IPv6 via [here](https://github.com/bitcoin/bitcoin/blob/505ba3966562b10d6dd4162f3216a120c73a4edb/src/addrman.h#L57) but the process for .onion address is not clear to me. The only thing I know is that the group for the .onion address is the first 4 bytes of the address(without the .onion)

**Tags:** bitcoin-core, address-generation, tor


---

## 1 answers

### Answer by username_1 on 2022-08-25. Score: 4 | Accepted answer

The reason behind the network groups concept as used in Bitcoin Core (which correspond to AS numbers if you use asmap) is the rather vague notion that an attacker may get many IP addresses in a single range/network, but is unlikely to get access to IP addresses that belong to many distinct networks. It is very approximate, but it permits making some decisions that avoid Eclipse attacks and others as long as this assumption holds.

This notion does not apply in Tor, or other anonymization overlay networks like I2P or CJDNS. There is no concept of locality of address ranges in these networks: getting two addresses that are close or far apart has no bearing on cost, as these addresses are hashes of public key material.

Bitcoin Core treats all onion/I2P addresses as being in just 4 network groups for bucketing purposes, just so that not all keys map to the same thing, but there is little basis in reality for this. The whole idea of network grouls just doesn't apply to these networks.

> **Comments:**
> **username_0**: So based on the bucketing algorithm, looks like if the source and the actual address are for an addr message both .onion,and if the node only accepts these kind of messages, then the node will only fill 256 buckets of the 1024 in the new table(theoretically). Or am I mistaken?  

---

