Description: The plot illustrates the number of online peers whose Kademlia identifier matches each prefix for all prefixes of a given size, for a given network crawl. Each bar is one prefix (a keyspace region). We use one crawl of our Nebula crawler every 12 hours and count the online peers that it found in the DHT routing tables. Since the density of keyspace regions follows a Poisson distribution, it is expected to observe some regions that are significantly more populated than others. On Ethereum, the plot includes all nodes in the discv5 DHT, also the nodes of other networks.
How to read the plot: The selected depth indicates the prefix size. There are 2^i distinct prefixes at depth i. Select a depth, or select a time to show one of the 32 most recent crawls.
2^i
i
What to look out for: The green dashed line represents the expected density per region: the number of peers divided by the number of regions. A bar significantly exceeding the expected density suggests that a region of the keyspace might be under an eclipse attack, especially if the value is above the risk threshold (red dashed line). If the peer IDs are random, the chance that any region is above the risk threshold is less than 0.1%.
The plot shows how many peers are included in a particular region of the keyspace. Too many peers within one region indicate a potential issue.