Table of Contents
Fetching ...

Charting the Uncharted: The Landscape of Monero Peer-to-Peer Network

Yu Gao, Matija Piškorec, Yu Zhang, Nicolò Vallarano, Claudio J. Tessone

TL;DR

This work tackles the challenge of analyzing Monero's P2P network under a protocol update that hides timestamp data by proposing a timestamp-free neighbor inference method based on TCP flow observations. It collects peer-list data from three globally distributed nodes and uses frequency analysis with $k$-means clustering to distinguish real neighbors from incidental peers, validating results against ground-truth connections via the Monero RPC. The study reveals a highly centralized core around 14 supernodes, with substantial overlap among their one-hop neighbors, and demonstrates robustness to random failures but vulnerability to targeted attacks on core nodes. These findings offer concrete insights into Monero's topology and suggest protocol design adjustments to improve decentralization and resilience while maintaining security and privacy properties.

Abstract

The Monero blockchain enables anonymous transactions through advanced cryptography in its peer-to-peer network, which underpins decentralization, security, and trustless interactions. However, privacy measures obscure peer connections, complicating network analysis. This study proposes a method to infer peer connections in Monero's latest protocol version, where timestamp data is unavailable. We collect peerlist data from TCP flows, validate our inference algorithm, and map the network structure. Our results show high accuracy, improving with longer observation periods. This work is the first to reveal connectivity patterns in Monero's updated protocol, providing visualizations and insights into its topology. Our findings enhance the understanding of Monero's P2P network, including the role of supernodes, and highlight potential protocol and security improvements.

Charting the Uncharted: The Landscape of Monero Peer-to-Peer Network

TL;DR

This work tackles the challenge of analyzing Monero's P2P network under a protocol update that hides timestamp data by proposing a timestamp-free neighbor inference method based on TCP flow observations. It collects peer-list data from three globally distributed nodes and uses frequency analysis with -means clustering to distinguish real neighbors from incidental peers, validating results against ground-truth connections via the Monero RPC. The study reveals a highly centralized core around 14 supernodes, with substantial overlap among their one-hop neighbors, and demonstrates robustness to random failures but vulnerability to targeted attacks on core nodes. These findings offer concrete insights into Monero's topology and suggest protocol design adjustments to improve decentralization and resilience while maintaining security and privacy properties.

Abstract

The Monero blockchain enables anonymous transactions through advanced cryptography in its peer-to-peer network, which underpins decentralization, security, and trustless interactions. However, privacy measures obscure peer connections, complicating network analysis. This study proposes a method to infer peer connections in Monero's latest protocol version, where timestamp data is unavailable. We collect peerlist data from TCP flows, validate our inference algorithm, and map the network structure. Our results show high accuracy, improving with longer observation periods. This work is the first to reveal connectivity patterns in Monero's updated protocol, providing visualizations and insights into its topology. Our findings enhance the understanding of Monero's P2P network, including the role of supernodes, and highlight potential protocol and security improvements.

Paper Structure

This paper contains 13 sections, 1 equation, 4 figures, 2 tables, 1 algorithm.

Figures (4)

  • Figure 1: Data collection pipeline.
  • Figure 2: Visualization of the LCC, with node colors representing betweenness centrality and node sizes proportional to their degree centrality.
  • Figure 3: One-hop neighbor overlap rate among the 14 top-degree nodes. The value in each cell represents the overlap rate of the one-hop neighbors between the nodes indexed by the X and Y ticks.
  • Figure 4: LCC attack by removing high betweenness and degree centrality nodes, where the turning point of LCC $\approx 0$ are 0.094 and 0.12 for betweenness centrality and degree centrality.