7

For what reason could I use the monerod 'ban' command?
What harm can it prevent?

  • Great question! I'm curious about this myself. I've always seen the ban command but never knew what it was for. – user4 Oct 12 '16 at 23:43
4

Banning is usually done to avoid connecting to peers that are on a different fork, to avoid the noise. A peer will be banned automatically after a few times if they send bad blocks or transasctions (ie, if they violate the consensus rules as understood by the local daemon).

Manual banning should be used in those cases if automatic banning doesn't happen (maybe in some cases the code does not cause particular violation to result in a ban).

Banning for anti (intentional) DoS purposes does not really serve any purpose, since it will be slower than banning the IP using a firewall (eg, iptables), so this is not intended as an anti DOS mechanism. Besides, an attacker could then target other ports, and the daemon would only be able to drop connections to the P2P port it's listening on.

Note that bans are only temporary (though the user can set a manual expiration time if wanted). This is because a peer on a bad fork is expected to end up on the right fork at some point, and indefinite banning would just cause the Monero network to become more brittle.

6

If you run an instance of monerod with internet open bind ports, you may want to ban ips that are malicious or suspecious, like one trying a DOS attack or a node running a buggy version.

Dropping the packet based on its IP, before parsing it, drastically reduces the load on the server and the attack surface.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.