---
# System prepended metadata

title: Untitled

---

Identify tracks observed address, i.e. the address that a remote node see when a connection established. This is useful, since a node located behind a NAT is usually not aware of its public address.

## Memory exhaustion attack against the observed address tracking

A node tracks all address observations for 10 minutes (only addresses that are observed more than 4 times within this time frame are kept, but that's irrelevant for this attack).

An attacker can therefore open a libp2p connection to the victim, and generate a large number observations for addresses. Identify Push can be used to repeatedly generate a new address observation on this connection, it is not necessary to establish a new connection every time.

By making the victim store a large number of address observations, the attacker can then consume the entire memory of the victim's node, leading to the process eventually being killed by the kernel (due to OOM). It is feasible to generate and transfer enough address observations within the 10 minutes window.

## Memory exhaustion attack against the observer tracking

For every observed address, the observer's address is tracked using the `observedAddr` struct. While an attacker only has a single remote address (per connection), it can submit observations for a number (say 1,000) different addresses, since there's no check that an observer only reports a single address observation. This allows the attacker to very effectively amortize the (CPU and bandwidth) cost of the libp2p handshake.

After submitting these 1,000 address observations, the attacker reconnects from a different address (either a different IP, a different port on the same IP, or a different transport).

Note that this attack does not require access to a large number of IPv4 addresses. The attacker can establish an IPv6 connection, which gives it an (under all practical circumstances) unlimited supply of source addresses, as IPv6 addresses are usually assigned in /64 blocks.

The list of observers is only garbage collected every 10 minutes, giving the attacker 10 minutes to fill up the victim's memory, and have the kernel kill the process due to OOM.