Description: A keyspace region is the set of Kademlia identifiers that share a prefix, and its population is the number of online peers in it. The population of the regions follows a Poisson distribution, which can make identifying outliers challenging. This plot counts the number of regions for each population size (x-axis) and facilitates the identification and analysis of outliers. While it is normal for some regions to have populations above the average, the plot enables us to quantify these deviations. We use one crawl of our Nebula crawler every 12 hours and count the online peers that it found in the DHT routing tables. On Ethereum, the plot includes all nodes in the discv5 DHT, also the nodes of other networks.
How to read the plot: The green line represents the expected number of regions for each population size. The depth is the prefix size: there are 2^i regions at depth i. Note that the Poisson distribution is more evident at greater depths (longer prefix size), while analyzing data at lower depths provides limited insights. It is recommended to read the plot for depths between 9 and 13. Select a depth, or select a time to show one of the 32 most recent crawls.
2^i
i
What to look out for: If an isolated bar appears on the far right beyond the risk threshold (red dashed) line, it may indicate a potential eclipse attack, warranting further investigation. If the peer IDs are random, the chance that any region is above the risk threshold is less than 0.1%.
The plot shows the distribution of the PeerIDs across the Poisson curve. Too many PeerIDs outside the curve indicate a potential issue.