log: don't rate-limit "new peer" with -debug=net
What the developer wrote
Authored by 0xb10c
log: don't rate-limit "new peer" with -debug=net
Previously, when `debug=net` is enabled, we log "New [..] peer connected"
for new inbound peers with `LogInfo`. However, `LogInfo` will get
rate-limited since https://github.com/bitcoin/bitcoin/pull/32604.
When we specifically turn on `debug=net`, we don't want these log
messages to be rate-limited.
To fix this, use `LogDebug(BCLog::NET, ...)` for potentially high-
rate inbound connections. Otherwise use `LogInfo`. This means we
don't rate-limit the messages for inbound peers when `debug=net`
is turned on but will rate-limit if we created outbound at a high
rate as these are logged via `LogInfo`.
--
I ran into this message getting rate-limited on one of my monitoring
nodes with `-logsourcelocations=1`: With logsourcelocations, one of
these lines is about 338 chars (or 338 bytes) long. We rate-limit
after more than 1048576 bytes per hour, which results in about
3100 in- and outbound connections per hour. With evicted and
instantly reconnecting connections from an entity like LinkingLion,
this can be reached fairly quickly.
Co-Authored-By: Eugene Siegel <elzeigel@gmail.com>
Co-Authored-By: Anthony Towns <aj@erisian.com.au>
What changed, and why it matters
This commit fixes a logging issue in Bitcoin Core. Previously, 'new peer connected' log messages for inbound connections were written using the standard LogInfo path, which became rate-limited after a recent change. When a node operator turns on debug=net to monitor network activity, those messages could be suppressed. The fix moves inbound peer messages to LogDebug so they are not rate-limited when debug=net is enabled, while outbound peer messages remain as LogInfo and continue to be rate-limited. This is a usability/monitoring fix, not a security vulnerability fix.
No urgent action required. This is a minor logging improvement. Operators running monitoring nodes with debug=net and logsourcelocations=1 should benefit from restored visibility of inbound peer connections. Reviewers may confirm the lambda preserves the original log format and that no sensitive data is newly exposed.
Security signals we found
Rate-limited diagnostic logging could reduce visibility during network abuse or reconnaissance
No cryptographic, consensus, memory-safety, or authorization change
Change is purely in logging path and does not alter peer handling logic
Evidence from the diff
The change refactors the new-peer logging in PeerManagerImpl::ProcessMessage. It introduces a lambda new_peer_msg() to build the log line, then logs inbound connections with LogDebug(BCLog::NET, …) and outbound connections with LogInfo(…). Previously the same message used LogInfo unconditionally for outbound and only if debug=net was enabled for inbound, but because LogInfo is globally rate-limited (1 MiB/hour since PR 32604), high-rate inbound connections (e.g., reconnecting/evicted peers) could cause the message to be dropped even when debug=net was active. LogDebug is not subject to the same rate-limiting, restoring visibility for operators who explicitly enable debug=net.
Changed components
src/net_processing.cppPeerManagerImpl::ProcessMessageInbound/outbound peer connection loggingInspect captured patch +14 / −8
diff --git a/src/net_processing.cpp b/src/net_processing.cpp
index c6bd60c5..5f616840 100644
--- a/src/net_processing.cpp
+++ b/src/net_processing.cpp
@@ -3659,16 +3659,22 @@ void PeerManagerImpl::ProcessMessage(CNode& pfrom, const std::string& msg_type,
return;
}
+ auto new_peer_msg = [&]() {
+ const auto mapped_as{m_connman.GetMappedAS(pfrom.addr)};
+ return strprintf("New %s peer connected: transport: %s, version: %d, blocks=%d peer=%d%s%s\n",
+ pfrom.ConnectionTypeAsString(),
+ TransportTypeAsString(pfrom.m_transport->GetInfo().transport_type),
+ pfrom.nVersion.load(), peer->m_starting_height,
+ pfrom.GetId(), pfrom.LogIP(fLogIPs),
+ (mapped_as ? strprintf(", mapped_as=%d", mapped_as) : ""));
+ };
+
// Log successful connections unconditionally for outbound, but not for inbound as those
// can be triggered by an attacker at high rate.
- if (!pfrom.IsInboundConn() || LogAcceptCategory(BCLog::NET, BCLog::Level::Debug)) {
- const auto mapped_as{m_connman.GetMappedAS(pfrom.addr)};
- LogInfo("New %s %s peer connected: version: %d, blocks=%d, peer=%d%s%s\n",
- pfrom.ConnectionTypeAsString(),
- TransportTypeAsString(pfrom.m_transport->GetInfo().transport_type),
- pfrom.nVersion.load(), peer->m_starting_height,
- pfrom.GetId(), pfrom.LogIP(fLogIPs),
- (mapped_as ? strprintf(", mapped_as=%d", mapped_as) : ""));
+ if (pfrom.IsInboundConn()) {
+ LogDebug(BCLog::NET, "%s", new_peer_msg());
+ } else {
+ LogInfo("%s", new_peer_msg());
}
if (pfrom.GetCommonVersion() >= SHORT_IDS_BLOCKS_VERSION) {
Why this scored 20/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.