Run a node
What a node will never do
These limits are compiled into the node. Hopbits can tighten them from the network side, never loosen them.
On this page
Connections
- It only connects out. It never listens for an incoming connection.
- It runs a job only when the job is signed by a key it can trace back to the keys built into it.
- It is not a proxy. It never carries traffic for anyone.
Targets it refuses
- Private and local addresses:
10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,127.0.0.0/8,169.254.0.0/16and100.64.0.0/10. - Cloud metadata addresses, multicast, and reserved or documentation ranges.
- Your own network: the addresses on its interfaces, and the block around your public IP.
- IPv6 addresses that are not global unicast.
Ports it never uses
Mail, remote login, file sharing and database ports are off limits: 21, 22, 23, 25, 110, 135, 137 to 139, 143, 445, 465, 587, 993, 995, 1433, 3306, 3389, 5432, 5900, 6379, 11211 and 27017.
What a check may contain
- An HTTP check is one
GETorHEAD. No request body, no cookies, no credentials, no custom headers. - A redirect is reported, never followed.
- The node reads at most 10,000 bytes of a response to measure it, then throws them away. Page content never leaves the node.
- A TCP check opens a connection and closes it. It sends no data.
How much it may do
| Limit | Value |
|---|---|
| Measurement traffic in a UTC day | 200 MB, or the lower cap you set |
| Jobs in a minute | 30 |
| Jobs at the same time | 4 |
| Wait between jobs to the same site | 55 seconds |
| Ping packets in a second | 10 |
It says who it is
Every HTTP check carries the user agent HopbitsProbe/1 (+https://hopbits.io/probe) and an X-Hopbits-Probe header. The owner of a site can see where a request came from and ask not to be checked.