An xOneRS node picks peers to dial from a random sample of its discovery table, not from the same nearest 16 nodes each time. It keeps a score for each connected peer: a malformed, invalid, oversized or too-fast message adds points, and a peer that reaches 100 points is disconnected and, unless it is trusted, banned for 30 minutes. Operators can also ban a node by hand. The three parts are separate.
For the checks on a peer's chain before sync, see peer chain verification; for manual bans in detail, see banning a peer by hand.
How does the node choose whom to dial?
Every five seconds, a dial pass offers nodes from the discovery table. Before PR #887 (merged 2026-11-14) the pass offered the 16 nodes closest to a fixed id, so the same nodes came first on every pass. Now Table::sample(seed, n) returns n nodes of the whole table in an order fixed by the seed, and each pass draws a new seed.
The endpoint proof, the subnet limits, the dial history and the handling of trusted and static peers did not change. Trusted and static dials do not use the table. The PR's test takes 200 seeded samples of a table with 2,000 inserts and finds more than 100 distinct nodes outside the nearest 16; the same seed gives the same sample.
How is a connected peer scored?
Each peer identity has a budget (PeerLimits, peer.rs). The defaults:
| Offence | Points |
|---|---|
| Malformed (does not decode) | 10 |
| Invalid (decodes, fails a rule: signature, header) | 25 |
| RateExceeded (queue or bucket overflow) | 5 |
| Oversized (above the size cap of its class) | 100 |
The threshold is 100 points and the score decays by 10 points per minute. So 10 malformed messages in a short window, or one oversized message, reach the threshold, while a peer that errs once every 2 minutes never does (ADR-007 section 5). The source marks these values as proposals of ADR-007.
What happens at the threshold?
The peer is disconnected. Unless it is trusted, it is also banned until a time: 30 minutes by default. The ban is keyed by the node id, so it survives a reconnect from a new address. A trusted peer is disconnected but may reconnect at once (score.rs). The table of scores is bounded at 8,192 peers; at the limit, budgets that have fully decayed go first, so a new identity never resets other offenders.
Where do manual bans fit?
Operator bans (admin_banPeer, from PR #951) are a separate set: up to 4,096 node ids, in memory, refused in and out whatever their trusted or static mark, until admin_unbanPeer or a restart. A manual ban or unban does not change the automatic score. PR #993 adds a file format for persisted manual bans; its wiring is still open.
What limits does this design have?
ADR-007 states it: a score per peer does not stop many peers. That is held by the global limits and a limit on inbound connections per /24 subnet. The per-class size caps in the ADR are marked as to be set against the geth-XDC limits.
The collected competitor articles state one related claim: ethrex reported peer scores with MAX_SCORE 50, MIN_SCORE -50 and MIN_SCORE_CRITICAL -150 in the road to networking stability, 2026-05-07. The scales differ, so the numbers do not compare one to one.
Frequently asked questions
How does an xOne node pick peers to dial?
From a seeded random sample of its discovery table, with a new seed on each 5-second pass. Trusted and static peers are dialled directly.
When does xOne ban a peer automatically?
When its score reaches 100 points: one oversized message, or about 10 malformed ones in a short window. The ban lasts 30 minutes and is keyed by node id. Trusted peers are disconnected but not banned.
Does a manual unban clear the automatic score?
No. Manual bans and the automatic score are separate. An unban removes only the manual entry.
Can a peer avoid a ban by changing its IP address?
No. Bans are keyed by the node id, not the address.
Sources
This article describes the source and evidence at its review date. Check the linked repository for current implementation and qualification status.
Explore the engineering evidenceEdit this page on GitHub opens the Markdown source (content/blog/peer-qualification/index.md). GitHub may ask you to sign in. Report a correction opens a prefilled GitHub issue for this page.