<r​ucknium:monero.social> boog900: The "PEG TECH" IPs appeared reachable again. I was collecting data to test the subnet deduplication code and happened to see them in the data. _But_ it looks like the connections lasted for a minute or less. I'll try to look in the `monerod` logs for what exactly happened with the short connection times.

<r​ucknium:monero.social> Ok 5 minutes after I sent that, I realized it's a false reading. But then Matrix died

<r​ucknium:monero.social> In the log file, the node is saying that the connection attempts to those IP addresses failed. But now the question becomes: If the connection attempts failed, why is `monerod` lying to me in the `get_connections` RPC call?

<s​yntheticbird:monero.social> my rule of thumb with monerod is to always believe the logs and never believe the pretty display

<r​ucknium:monero.social> RPC isn't pretty though

<s​yntheticbird:monero.social> json is pretty

<r​ucknium:monero.social> Parsing logs is the worst

<r​ucknium:monero.social> I don't want to parse logs any more than I have to

<r​ucknium:monero.social> Especially when log outputs are multi-threaded

<s​yntheticbird:monero.social> isn't there a docker with Grafana support for monerod? idk exactly how it works but maybe it might provide the parsing you need and give you juicy logs to process

<r​ucknium:monero.social> I haven't looked closely at the monerod Grafana, but doesn't it use RPC only?

<r​ucknium:monero.social> The RPC lying should be fixed

<b​oog900:monero.social> ah that's sad, its really weird how people are injecting these unreachable peers

<b​oog900:monero.social> like if people were doing that to be malicious why all from the same ASN

<b​oog900:monero.social> initially I thought they were rejecting me over Tor, but I tied a VPN and a VPS which all fail.

<r​ucknium:monero.social> Here is an example from the log file:

<r​ucknium:monero.social> ```txt

<r​ucknium:monero.social> 2025-05-11 05:10:12.560 [P2P5] INFO net.p2p src/p2p/net_node.inl:1483 Connecting to 38.6.156.198:18080(last_seen: never)...

<r​ucknium:monero.social> 2025-05-11 05:10:12.639 [P2P5] INFO net.p2p src/p2p/net_node.inl:1491 [<none> OUT] Connect failed to 38.6.156.198:18080

<r​ucknium:monero.social> 2025-05-11 05:10:12.639 [P2P5] DEBUG net.p2p src/p2p/net_node.inl:3232 PEER EVICTED FROM GRAY PEER LIST: address: 38.6.156.198 Peer ID: 823914f4c990ef5d

<r​ucknium:monero.social> ```

<r​ucknium:monero.social> This is with `--log-level=net.p2p:DEBUG`

<r​ucknium:monero.social> I also poll `get_connections` through RPC every 30 seconds. And that IP appeared in one RPC return, erroneously.

<b​oog900:monero.social> did you poll in the .1 second you were connected?

<r​ucknium:monero.social> No...it was about 2 minutes _after_ that log message appeared

<b​oog900:monero.social> ah yeah that seems strange

<r​ucknium:monero.social> And it happened a lot. Here was data from the last 24 hours:

<r​ucknium:monero.social> `Top subnets (254 possible /24 IPs each): 38.6.157.0/24: 17, 38.6.156.0/24: 10, 38.6.155.0/24: 7, 100.42.27.0/24: 6, 154.199.217.0/24: 6, 193.142.4.0/24: 3, 209.222.252.0/24: 3, 91.198.115.0/24: 3, 162.218.65.0/24: 2, 199.116.84.0/24: 2`

<r​ucknium:monero.social> The first three belong to PEG TECH

<r​ucknium:monero.social> Wait a minute. I may be mixed up on timing

<r​ucknium:monero.social> Since the log is from the wrong date 😅

<r​ucknium:monero.social> Ok, the few PEG TECH IPs I checked only appear in the log file one, a few days ago, with a failed connection message. Yet they are in my data as a valid connection from the RPC data collection, from the last 24 hours

<r​ucknium:monero.social> 🤷‍♂️

<b​oog900:monero.social> Dam the PEG TECH guys are good

<b​oog900:monero.social> Damn the PEG TECH guys are good

<b​oog900:monero.social> manage to hide from the logs

<b​oog900:monero.social> have you checked your address book?

<b​oog900:monero.social> to see if any of their addresses are in the white list

<r​ucknium:monero.social> White and gray lists?

<r​ucknium:monero.social> Not yet. Let me see

<r​ucknium:monero.social> No, don't see them in my white_list

<s​yntheticbird:monero.social> `Rucknium's peerlist` is `saved`.

<s​yntheticbird:monero.social> Billions must ignore

<r​ucknium:monero.social> Some of them still in my gray_list

<b​oog900:monero.social> weird.

<b​oog900:monero.social> To anyone who operates a node, I would be interested to know if any of these addresses are in your nodes `white_list`:

<b​oog900:monero.social> ```

<b​oog900:monero.social> 154.199.217.0 156.229.183.0 198.2.210.0 198.2.248.0 38.6.155.0 38.6.156.0 38.6.157.0

<b​oog900:monero.social> ```

<s​yntheticbird:monero.social> how do we check the white list already?

<b​oog900:monero.social> only the first 3 numbers in the address must match

<b​oog900:monero.social> here is the RPC request: docs.getmonero.org/rpc-library/monerod-rpc/#get_peer_list

<b​oog900:monero.social> pretty sure there is a command in monerod itself as well

<s​yntheticbird:monero.social> thx

<3​21bob321:monero.social> Yest

<s​yntheticbird:monero.social> I got the full `154.199.217.0/24`, `38.6.155.0/24`, `38.6.156.0/24`, `38.6.157.0/24`

<s​yntheticbird:monero.social> none for the other subnets

<b​oog900:monero.social> in the white list?

<b​oog900:monero.social> or grey list?

<s​yntheticbird:monero.social> oh wait I was using grep i need to check

<s​yntheticbird:monero.social> grey list only

<s​yntheticbird:monero.social> alright

<s​yntheticbird:monero.social> you won

<s​yntheticbird:monero.social> # I was the spy node

<s​yntheticbird:monero.social> all this time I was linking lion and peg tech was my second attempt at spying