<p>In TCP communications it is common to use a technique known as "<a href="https://en.wikipedia.org/wiki/Piggybacking_(data_transmission)" rel="nofollow noreferrer" title="piggybacking">piggybacking</a>".
Let's say A and B are communicating over TCP. Normally, after receiving a message from A, B should send an ACK message to let A know he received it correctly. In order to minimize the number of messages, B can "encapsulate" the response message into the ACK, so that A will receive the response along with the ACK.</p>

<p>Since Bitcoin works on TCP, it is reasonable that the same technique is applied.</p>

CC BY-SA 3.0
2018-02-01T10:57:00.757Z
2018-02-01T11:16:52.050Z
2018-02-01T11:16:52.050Z
FedFranz
<p>I sent a Version message shown below:</p>

<pre><code>F9BEB4D976657273696F6E0000000000560000003EA2EDFF7111010001000000000000003CE5725A00000000010000000000000000000000000000000000FFFF5B86CFD0208D010000000000000000000000000000000000FFFF________208D847C51678AA429DE000000000000
</code></pre>

<p>I received the following message:</p>

<pre><code>F9BEB4D976657273696F6E0000000000680000002C00D4E37F1101000D00000000000000DCE0725A00000000010000000000000000000000000000000000FFFF________208D0D00000000000000000000000000000000000000000000000000E665131FDCB099B0122F5361746F7368693A302E31352E302E312FC7BC070001F9BEB4D976657261636B000000000000000000005DF6E0E2
</code></pre>

<p>The response received is in a TCP packet itself and from the packet, it seems like there is two Bitcoin protocol messages in a single TCP packet response.</p>

<p>Dissecting the above response, it is made of a VERSION command that is replied to me:</p>

<pre><code>F9BEB4D976657273696F6E0000000000680000002C00D4E37F1101000D00000000000000DCE0725A00000000010000000000000000000000000000000000FFFF________208D0D00000000000000000000000000000000000000000000000000E665131FDCB099B0122F5361746F7368693A302E31352E302E312FC7BC070001
</code></pre>

<p>And also a VERACK response:</p>

<pre><code>F9BEB4D976657261636B000000000000000000005DF6E0E2
</code></pre>

<p>Is it a typical behavious for Bitcoin protocol to bunch up as much messages into a single TCP packet before sending it out ?</p>

<p>Note: Both messages have IP address cleaned out via underscore marks.</p>

CC BY-SA 3.0
2018-02-01T11:12:46.973Z
Is this happening only for the VERSION/VERACK messages?
FedFranz
CC BY-SA 3.0
2018-02-01T11:32:32.920Z
I am using a TCP manipulation software to understand the protocol of Bitcoin and while experimenting, I have seen more than just VERACK. There is also the ALERT message (as I am emulating version 70001).
thotheolh
CC BY-SA 3.0
2018-02-01T13:35:21.627Z
Do you mean the three on the same message?

I understand you're controlling both nodes, and using the same client (Bitcoin Core 0.8.0?). Is that correct?
FedFranz
CC BY-SA 3.0
2018-02-02T00:39:36.650Z
I am using a TCP manipulation software and sending it out to a public node that I do not control. So, I have my emulator acting as a 70001 node and some unknown public node on the Internet that I am randomly interacting to.
thotheolh
CC BY-SA 3.0
2018-02-02T15:34:10.653Z
Well, I keep thinking my answer is the most reasonable I can imagine.
Since nodes advertise their client too, you could try to see if different clients act in a different way, or if this piggybacking behavior is used by all.
Also you can see if it is used for all messages or just specific ones (usually this technique can only be used when you can have the response message in a short time, so as not to make the other node waiting too much for the ack).
Let us know what you find out :)
FedFranz
<client>
Can a Bitcoin response contain multiple Bitcoin messages?
thotheolh
# Can a Bitcoin response contain multiple Bitcoin messages?

(Asked by: username_0 on 2018-02-01)

I sent a Version message shown below:

```
F9BEB4D976657273696F6E0000000000560000003EA2EDFF7111010001000000000000003CE5725A00000000010000000000000000000000000000000000FFFF5B86CFD0208D010000000000000000000000000000000000FFFF________208D847C51678AA429DE000000000000

```

I received the following message:

```
F9BEB4D976657273696F6E0000000000680000002C00D4E37F1101000D00000000000000DCE0725A00000000010000000000000000000000000000000000FFFF________208D0D00000000000000000000000000000000000000000000000000E665131FDCB099B0122F5361746F7368693A302E31352E302E312FC7BC070001F9BEB4D976657261636B000000000000000000005DF6E0E2

```

The response received is in a TCP packet itself and from the packet, it seems like there is two Bitcoin protocol messages in a single TCP packet response.

Dissecting the above response, it is made of a VERSION command that is replied to me:

```
F9BEB4D976657273696F6E0000000000680000002C00D4E37F1101000D00000000000000DCE0725A00000000010000000000000000000000000000000000FFFF________208D0D00000000000000000000000000000000000000000000000000E665131FDCB099B0122F5361746F7368693A302E31352E302E312FC7BC070001

```

And also a VERACK response:

```
F9BEB4D976657261636B000000000000000000005DF6E0E2

```

Is it a typical behavious for Bitcoin protocol to bunch up as much messages into a single TCP packet before sending it out ?

Note: Both messages have IP address cleaned out via underscore marks.

**Tags:** client

> **Comments:**
> **username_1**: Is this happening only for the VERSION/VERACK messages?  
> **username_0**: I am using a TCP manipulation software to understand the protocol of Bitcoin and while experimenting, I have seen more than just VERACK. There is also the ALERT message (as I am emulating version 70001).  
> **username_1**: Do you mean the three on the same message?  I understand you're controlling both nodes, and using the same client (Bitcoin Core 0.8.0?). Is that correct?  
> **username_0**: I am using a TCP manipulation software and sending it out to a public node that I do not control. So, I have my emulator acting as a 70001 node and some unknown public node on the Internet that I am randomly interacting to.  
> **username_1**: Well, I keep thinking my answer is the most reasonable I can imagine. Since nodes advertise their client too, you could try to see if different clients act in a different way, or if this piggybacking behavior is used by all. Also you can see if it is used for all messages or just specific ones (usually this technique can only be used when you can have the response message in a short time, so as not to make the other node waiting too much for the ack). Let us know what you find out :)  

---

## 1 answers

### Answer by username_1 on 2018-02-01. Score: 1

In TCP communications it is common to use a technique known as "[piggybacking](https://en.wikipedia.org/wiki/Piggybacking_(data_transmission) "piggybacking")".
Let's say A and B are communicating over TCP. Normally, after receiving a message from A, B should send an ACK message to let A know he received it correctly. In order to minimize the number of messages, B can "encapsulate" the response message into the ACK, so that A will receive the response along with the ACK.

Since Bitcoin works on TCP, it is reasonable that the same technique is applied.


---

