TABCONF 8 · HACKER ROOM · OCT 13, 2026
You Can't Fix What
You Can't See.
Monitoring the Bitcoin network
Octavio Lucca
Vinteum fellow
AGENDA
What we will cover today
01
What monitoring is, and why it matters
02
No conductor: why Bitcoin is hard to watch, and two ways to do it
03
Who watches: a few people, BNOC, and the map
04
peer-observer and the archiver
05
Forks, mining pools, mempool and chain
06
What monitoring has found, and what is still hard
STARTING POINT
What is monitoring?
Watching a running system all the time, so you know how it normally behaves and notice when that changes.
Is it healthy?
Are nodes reachable? Are blocks and transactions getting through?
Is something off?
Attacks, bugs and odd behavior, noticed while they happen.
What happened?
Data kept, so an incident can be investigated afterwards.
MOTIVATION
Why monitor the Bitcoin network?
If transactions and blocks do not propagate, nothing built on top works.
Keep it stable
A complex, open, permissionless network, with no operator.
Peers can misbehave
Participants are anonymous. Attacks and bugs happen.
Catch it early
Know about a problem before users are affected.
Decide with data
Protocol development needs numbers, not guesses.
Adapted from b10c's monitoring workshop
Bitcoin has no conductor
The music – Token
Native asset and medium of exchange
The score – Protocol
Rules for valid transactions and blocks
The musicians – Network
Infrastructure of communicating nodes
Analogy: Edil Medeiros, "Who Watches the Gossip?", BRI Workshop 2026
A BETTER PICTURE
A school of fish
No fish has a map. Each reacts to its neighbors, and a pattern emerges.
Analogy and video: Edil Medeiros, BRI Workshop 2026
HOW TO WATCH
Two ways to watch the network
ACTIVE · GLOBAL VIEW
Crawl every reachable node
- Custom client connects to all listening nodes
- Size of the network, block and transaction propagation
- Costs the network connection slots
PASSIVE · LOCAL VIEW
Watch from your own node
- Normal Bitcoin node with monitoring tools attached
- Behavior of connected peers and of the node itself
- No network-wide view from one node
WHERE THE KNOWLEDGE LIVES
Much of what we know rests on a few people
What we know about how the network behaves comes from dashboards, logs and tools that a handful of maintainers keep running and share at bnoc.xyz.
Drawing: Edil Medeiros, BRI Workshop 2026
BITCOIN NETWORK OPERATIONS COLLECTIVE
BNOC: a NOC, but for Bitcoin
Not a center. Anyone can monitor Bitcoin, no permission needed.
Share
Observations, tools and data, discussed in the open.
Remember
A journal of past events the network can go back to.
Join
Forum: bnoc.xyz
Chat: bnoc.zulipchat.com
bnoc.xyz
An open experiment
THE LANDSCAPE
Map of Bitcoin Monitoring
P2P network
Who relays what, to whom?
P2P NETWORK · PASSIVE
peer-observer: honeypot nodes
Well-behaved Bitcoin nodes, with monitoring attached, waiting for something to happen to them.
Undisclosed
Number and locations are not public. Sponsored by Brink, Chaincode Labs, Localhost Research and 0xb10c.
Different on purpose
Tor, I2P, CJDNS. Pruned, blocks-only, ASMap, ban lists, sanitizer builds.
Private where it counts
Node addresses and raw data stay private, so the honeypots are hard to avoid.
PEER-OBSERVER
How does it work?
Bitcoin node
ebpf-extractor
rpc-extractor
p2p-extractor
log-extractor
ipc-extractor
NATS
protobuf messages
pub-sub queue
logger
metrics
websocket
alerts
archiver
connectivity-check
extractors publish
tools subscribe
Diagram after b10c · github.com/peer-observer/peer-observer
PEER-OBSERVER · WHAT I WORK ON
The archiver: keep every event
Subscribes to the event queue and writes events to disk, so they can be replayed and analyzed later.
Compact on disk
Protobuf events, zstd-compressed as they are written, in rotating files.
Low-data mode
Drops raw transactions and blocks, keeps ids and all metadata. Long recordings become feasible.
Recording jobs
Filter by event type: only address relay, or only connections with handshakes.
Drop an archive on a web page. Decoded in your browser, nothing uploaded.
TRY IT YOURSELF
A public instance with full access
Grafana metrics from the nodes.
P2P messages as they arrive.
The header tree, with stale blocks.
Debug logs and addrman snapshots.
demo.peer.observer
Two nodes, hal and len · run by b10c · sponsored by Localhost Research
FORKS
Do all nodes agree on the tip?
Connect to many nodes, compare their header trees, alert when they disagree.
fork-observer
Shows the header tree across multiple networks. Feeds for stale blocks, invalid blocks, lagging and unreachable nodes.
Bitcoin Core · btcd · Floresta · Electrum · esplora
forkmonitor
Detects stale tips across nodes. Same feeds, plus a check for inflated blocks that create too many coins.
Bitcoin Core · btcd · bcoin
MINING POOLS
How do mining pools behave?
Template vs. block
Compares a node's template with the mined block: missing, extra and sanctioned transactions.
Stratum on record
Records stratum v1 messages to a database, for analysis after the fact.
Merge mining evidence
Stale Bitcoin blocks found in headers kept by merge-mined chains.
MEMPOOL · CHAIN
What is waiting, what got mined
MEMPOOL
mempool.space
Block explorer and fee estimator. Also stratum jobs, mining pool and Lightning data.
MEMPOOL · CLUSTERS
Cluster Mempool Observer
Every cluster in a node's mempool: the feerate diagram, cluster sizes, arrivals, confirmations and evictions over time.
CHAIN
mainnet-observer
Over 100 charts from blockchain data: script types, UTXOs, fees, payments, mining and pools.
HOW IT WORKS IN PRACTICE
Observe, maybe analyze, maybe react
MANY OBSERVATIONS
Observe
Observe and save everything we can, so it can be analyzed later if it turns out useful.
FEW REACTIONS
React
Patch, document, disclose.
Example: bnoc.xyz/t/61 · Adapted from b10c's monitoring workshop
OUTCOMES
What monitoring has found
BUG · FIXED
May 2023: nodes at 100% CPU, dropping peers. Traced, fixed, disclosed in 2024.
VULNERABILITY · FIXED
A crafted P2P message made ViaBTC mine on an old block. Reported and fixed in 2024.
PRIVACY · EXPOSED
One entity opens many connections to hear who announces a transaction first.
ATTACK · MEASURED
2026: fake addresses flooded gossip. Measured across many nodes as it happened.
SYBIL RISK · SHOWN
36 real instances behind 3,042 addresses, with 113k inbound connections at peak.
MINING · DOCUMENTED
Sanctioned transactions that pools could have mined, but left out of their blocks.
Sources: b10c.me/observations · bnoc.xyz
WHY MANY OBSERVERS
No single observer sees the network
Different places
Location and network change what you see: clearnet, Tor, I2P, CJDNS.
Different operators
Independent sources cross-check each other. One observer can be wrong, or targeted.
Different times
Archive events now, so tomorrow's question can be asked of yesterday's network.
WHY IT IS HARD
Four challenges in monitoring Bitcoin
01 · SEARCH SPACE
Unknown unknowns
We learn what to look for from past problems.
02 · RESOURCES
Can't record everything
Someone has to choose which data to collect.
03 · PEOPLE
Who is looking?
Data, dashboards and logs need someone to read them.
04 · INTERPRETATION
Metrics are not insight
Acting on a number takes real understanding of Bitcoin.
Adapted from b10c's monitoring workshop
WHAT IS MISSING
Gaps, and where to start
Open gaps
- Orphanage monitoring: no tool yet
- Alerting and anomaly detection
- People who read the data
Octavio Lucca · octavio.xyz · x.com/Octavio_lucca
GET THE SLIDES
