IPv4 Sharing on Mainnet

Question

How many peer_ids and clients share the same IPv4 address on mainnet?

Background

On the Ethereum P2P network, each node has a unique peer_id derived from its cryptographic identity. Nodes running different client implementations (lighthouse, prysm, nimbus, etc.) can be identified via their agent string in libp2p.

Multiple peer_ids sharing an IP address can indicate:

• Node operators running multiple nodes behind NAT
• Cloud providers hosting many nodes on shared infrastructure
• Sybil attacks attempting to gain disproportionate influence

This analysis uses data from synthetic heartbeat messages - periodic pings that TYSM nodes send to peers, capturing their IP and client information. We measure concurrent peers using hourly snapshots rather than cumulative counts over time, which avoids conflating peer churn with actual density.

Investigation

Distinct Nodes Over Time

Over the week, we consistently observe around 10,000-12,000 distinct nodes per hour via synthetic heartbeat.

Nodes by Client Type

Lighthouse dominates with ~7,100 nodes, followed by Prysm (~3,900), Nimbus (~1,600), and Teku (~1,300).

How are concurrent peer_ids distributed across IPs?

The vast majority of IPs have only a single peer_id active at any given time. The max concurrent peers observed on any IP is around 10.

Takeaways

• Xatu is connected to a lot of nodes: ~10,000 to 12,000 nodes in any given hour!
• Most IPs have a single concurrent peer: The vast majority of IPv4 addresses have only one peer_id active at any given hour
• Low concurrent density: The maximum concurrent peers on any IP is around 10