15:14:49 <m-relay> <r​ucknium:monero.social> boog900: The "PEG TECH" IPs appeared reachable again. I was collecting data to test the subnet deduplication code and happened to see them in the data. _But_ it looks like the connections lasted for a minute or less. I'll try to look in the `monerod` logs for what exactly happened with the short connection times.
19:50:56 <m-relay> <r​ucknium:monero.social> Ok 5 minutes after I sent that, I realized it's a false reading. But then Matrix died
19:52:22 <m-relay> <r​ucknium:monero.social> In the log file, the node is saying that the connection attempts to those IP addresses failed. But now the question becomes: If the connection attempts failed, why is `monerod` lying to me in the `get_connections` RPC call?
19:53:43 <m-relay> <s​yntheticbird:monero.social> my rule of thumb with monerod is to always believe the logs and never believe the pretty display
19:54:16 <m-relay> <r​ucknium:monero.social> RPC isn't pretty though
19:54:28 <m-relay> <s​yntheticbird:monero.social> json is pretty
19:54:31 <m-relay> <r​ucknium:monero.social> Parsing logs is the worst
19:54:46 <m-relay> <r​ucknium:monero.social> I don't want to parse logs any more than I have to
19:55:19 <m-relay> <r​ucknium:monero.social> Especially when log outputs are multi-threaded
19:56:43 <m-relay> <s​yntheticbird:monero.social> isn't there a docker with Grafana support for monerod? idk exactly how it works but maybe it might provide the parsing you need and give you juicy logs to process
19:57:21 <m-relay> <r​ucknium:monero.social> I haven't looked closely at the monerod Grafana, but doesn't it use RPC only?
19:57:47 <m-relay> <r​ucknium:monero.social> The RPC lying should be fixed
20:00:22 <m-relay> <b​oog900:monero.social> ah that's sad, its really weird how people are injecting these unreachable peers
20:00:56 <m-relay> <b​oog900:monero.social> like if people were doing that to be malicious why all from the same ASN
20:02:00 <m-relay> <b​oog900:monero.social> initially I thought they were rejecting me over Tor, but I tied a VPN and a VPS which all fail.
20:02:04 <m-relay> <r​ucknium:monero.social> Here is an example from the log file:
20:02:04 <m-relay> <r​ucknium:monero.social> ```txt
20:02:06 <m-relay> <r​ucknium:monero.social> 2025-05-11 05:10:12.560  [P2P5]  INFO    net.p2p src/p2p/net_node.inl:1483       Connecting to 38.6.156.198:18080(last_seen: never)...
20:02:08 <m-relay> <r​ucknium:monero.social> 2025-05-11 05:10:12.639  [P2P5]  INFO    net.p2p src/p2p/net_node.inl:1491       [<none> OUT] Connect failed to 38.6.156.198:18080
20:02:10 <m-relay> <r​ucknium:monero.social> 2025-05-11 05:10:12.639  [P2P5]  DEBUG   net.p2p src/p2p/net_node.inl:3232       PEER EVICTED FROM GRAY PEER LIST: address: 38.6.156.198 Peer ID: 823914f4c990ef5d
20:02:12 <m-relay> <r​ucknium:monero.social> ```
20:03:14 <m-relay> <r​ucknium:monero.social> This is with `--log-level=net.p2p:DEBUG`
20:04:23 <m-relay> <r​ucknium:monero.social> I also poll `get_connections` through RPC every 30 seconds. And that IP appeared in one RPC return, erroneously.
20:05:43 <m-relay> <b​oog900:monero.social> did you poll in the .1 second you were connected?
20:06:15 <m-relay> <r​ucknium:monero.social> No...it was about 2 minutes _after_ that log message appeared
20:07:02 <m-relay> <b​oog900:monero.social> ah yeah that seems strange
20:07:35 <m-relay> <r​ucknium:monero.social> And it happened a lot. Here was data from the last 24 hours:
20:07:36 <m-relay> <r​ucknium:monero.social> `Top subnets (254 possible /24 IPs each): 38.6.157.0/24: 17, 38.6.156.0/24: 10, 38.6.155.0/24: 7, 100.42.27.0/24: 6, 154.199.217.0/24: 6, 193.142.4.0/24: 3, 209.222.252.0/24: 3, 91.198.115.0/24: 3, 162.218.65.0/24: 2, 199.116.84.0/24: 2`
20:07:39 <m-relay> <r​ucknium:monero.social> The first three belong to PEG TECH
20:10:43 <m-relay> <r​ucknium:monero.social> Wait a minute. I may be mixed up on timing
20:11:55 <m-relay> <r​ucknium:monero.social> Since the log is from the wrong date 😅
20:14:51 <m-relay> <r​ucknium:monero.social> Ok, the few PEG TECH IPs I checked only appear in the log file one, a few days ago, with a failed connection message. Yet they are in my data as a valid connection from the RPC data collection, from the last 24 hours
20:15:15 <m-relay> <r​ucknium:monero.social> 🤷‍♂️
20:15:32 <m-relay> <b​oog900:monero.social> Dam the PEG TECH guys are good
20:15:48 <m-relay> <b​oog900:monero.social> Damn the PEG TECH guys are good
20:16:01 <m-relay> <b​oog900:monero.social> manage to hide from the logs
20:16:31 <m-relay> <b​oog900:monero.social> have you checked your address book?
20:16:43 <m-relay> <b​oog900:monero.social> to see if any of their addresses are in the white list
20:16:47 <m-relay> <r​ucknium:monero.social> White and gray lists?
20:16:56 <m-relay> <r​ucknium:monero.social> Not yet. Let me see
20:22:05 <m-relay> <r​ucknium:monero.social> No, don't see them in my white_list
20:25:05 <m-relay> <s​yntheticbird:monero.social> `Rucknium's peerlist` is `saved`.
20:25:06 <m-relay> <s​yntheticbird:monero.social> Billions must ignore
20:25:32 <m-relay> <r​ucknium:monero.social> Some of them still in my gray_list
20:51:26 <m-relay> <b​oog900:monero.social> weird.
20:51:26 <m-relay> <b​oog900:monero.social> To anyone who operates a node, I would be interested to know if any of these addresses are in your nodes `white_list`:
20:51:28 <m-relay> <b​oog900:monero.social> ```
20:51:30 <m-relay> <b​oog900:monero.social> 154.199.217.0 156.229.183.0 198.2.210.0 198.2.248.0 38.6.155.0    38.6.156.0 38.6.157.0 
20:51:32 <m-relay> <b​oog900:monero.social> ```
20:51:48 <m-relay> <s​yntheticbird:monero.social> how do we check the white list already?
20:51:50 <m-relay> <b​oog900:monero.social> only the first 3 numbers in the address must match
20:52:06 <m-relay> <b​oog900:monero.social> here is the RPC request: https://docs.getmonero.org/rpc-library/monerod-rpc/#get_peer_list
20:52:31 <m-relay> <b​oog900:monero.social> pretty sure there is a command in monerod itself as well
20:52:33 <m-relay> <s​yntheticbird:monero.social> thx
20:53:54 <m-relay> <3​21bob321:monero.social> Yest
21:00:19 <m-relay> <s​yntheticbird:monero.social> I got the full `154.199.217.0/24`, `38.6.155.0/24`, `38.6.156.0/24`, `38.6.157.0/24`
21:00:32 <m-relay> <s​yntheticbird:monero.social> none for the other subnets
21:00:43 <m-relay> <b​oog900:monero.social> in the white list?
21:00:48 <m-relay> <b​oog900:monero.social> or grey list?
21:01:01 <m-relay> <s​yntheticbird:monero.social> oh wait I was using grep i need to check
21:03:53 <m-relay> <s​yntheticbird:monero.social> grey list only
21:06:46 <m-relay> <s​yntheticbird:monero.social> alright
21:06:51 <m-relay> <s​yntheticbird:monero.social> you won
21:06:58 <m-relay> <s​yntheticbird:monero.social> # I was the spy node
21:07:15 <m-relay> <s​yntheticbird:monero.social> all this time I was linking lion and peg tech was my second attempt at spying