Monero Node Traffic: Fleet Totals, Tor and I2P

The retained Monero Love node traffic history contains an estimated 11.98 TB sent and 2.34 TB received, beginning October 16, 2026 and ending November 6 at 19:10 UTC. Those are observed host-interface totals across a growing set of reporting hosts. They include traffic from other services sharing the machines.

This expanded report uses the full retained history available at the research cutoff, replacing the earlier seven-day window. It keeps the fleet view throughout. Direct checks around 19:13 UTC recorded 232 Tor and 146 I2P connection endpoints, together representing 36.5% of the fleet's observed Monero peer connections.

Data begins October 16, with changing coverage

The earliest retained physical-interface sample is October 16 at 05:13:22 UTC. The five-minute graph begins at 05:15. Coverage starts with one reporting host and expands to six, so a higher aggregate later in October can reflect more reporting hosts as well as changing activity.

The last host's raw measurements begin October 26 at 15:14:40 UTC. The first shared five-minute traffic point is October 26 at 15:20 UTC. From there through the cutoff, every plotted traffic timestamp has measurements from six hosts.

Earlier measurements remain in the charts and transfer estimates. Missing observations contribute no estimate, and the calculation does not interpolate across gaps. This preserves the older data without suggesting that six hosts were continuously measured from October 16.

Transfer totals across the full history

Measurement window	Coverage	Estimated received	Estimated sent
October 16 to November 6	Available hosts, increasing to six	2,338.3 GB	11,981.8 GB
October 26, 15:20 to November 6, 19:10 UTC	Six hosts at every plotted point	1,439.7 GB	7,433.0 GB
Final 24 hours, ending November 6, 19:10 UTC	Six hosts	132.9 GB	752.0 GB

During the shared six-host period, outbound traffic averaged 61.7 Mbps, compared with 11.9 Mbps inbound. The final day averaged 69.6 Mbps outbound and 12.3 Mbps inbound. Outbound traffic exceeded inbound traffic by about 5.2 times over the shared period and 5.7 times over the final day.

Physical-interface measurements include more than Monero transaction bytes. Wallet access, peer traffic, anonymity-network services and other applications can contribute. The separate daemon-byte counters cover only four hosts and record approximately 849.3 GB received and 1,764.9 GB sent across their available intervals. They cover fewer hosts and measure traffic at a different point, so they cannot provide a fleet-wide comparison.

Traffic exchanged between monitored hosts appears at both ends. Adding received and sent figures does not produce a unique internet-transfer total, and these estimates should not be treated as a provider's billing record.

Peaks and daily traffic patterns

The longer history reveals an inbound peak that the seven-day report missed: 415.2 Mbps on October 26 at 16:50 UTC. The largest sampled outbound rate remains 364.0 Mbps on November 4 at 22:30 UTC.

Both figures are aggregate rates sampled every five minutes. Shorter bursts may be higher. The measurements establish the timing and scale of these peaks, but they cannot identify their cause. Distinguishing synchronization, wallet activity and other traffic requires matching application records.

Among complete UTC days, November 4 had the largest outbound estimate at 819.8 GB. October 30, October 31 and November 1 each exceeded 740 GB outbound. Those dates fall inside the shared six-host period, making their totals more comparable than the earlier days with changing coverage.

October 16 and November 6 are partial days. The lower November 6 bar includes only traffic through 19:10 UTC and should not be read as a full-day decline. The final-24-hours figure above uses a separate rolling window.

Fleet connections over Tor, I2P and clearnet

The refreshed direct checks counted 1,037 connection endpoints across six Monero daemons. Clearnet combines IPv4 and IPv6.

Transport	Inbound	Outbound	Total	Share
Clearnet	323	336	659	63.5%
Tor	67	165	232	22.4%
I2P	100	46	146	14.1%
All transports	490	547	1,037	100%

Tor was predominantly outbound, with 165 outbound connections against 67 inbound. I2P had the opposite balance, with 100 inbound and 46 outbound. The two anonymity networks together accounted for 378 observed endpoints.

These counts describe connections recorded by daemons. They do not count unique remote peers, people, wallets, Tor circuits or I2P tunnels. A connection between fleet members can appear at both ends. Collection also spans a short interval, so the table is not a simultaneous measurement of every daemon.

Historical Tor and I2P connection trends

The retained transport series begin on October 16 at 06:25 UTC. Valid Tor history covers up to two hosts, while I2P history covers up to three. These subset totals cannot be compared directly with the six-host snapshot above.

The recorded Tor subset peaked at 61 endpoints on October 27 at 10:45 UTC and ended at 45. The I2P subset peaked at 80 on October 25 at 23:25 UTC and ended at 72. Early coverage changes and missing observations affect these lines, so a dip alone does not establish a network outage.

One historical collector labels IPv6 records as Tor and omits actual Tor records. The Tor trend excludes that series. The direct snapshot uses the correct address types from Monero's network enumeration. Retained aggregate counters cannot reconstruct the missing historical Tor connections.

Recorded Tor and I2P traffic

Service-byte history starts October 16 at 06:25 UTC and continues through November 6 at 19:10 UTC. These counters cover one of the six hosts. The figures below describe the measured subset. They cannot establish full-fleet transport totals.

Recorded service	Estimated received	Estimated sent	Combined estimate
Tor	110.0 GB	116.8 GB	226.8 GB
I2P	16.8 GB	17.1 GB	34.0 GB

The measured Tor service traffic was roughly balanced between directions. I2P was also close to balanced, with 16.8 GB received and 17.1 GB sent. Service traffic can include protocol overhead and activity beyond Monero peer connections. Connection-count shares cannot divide the host-bandwidth totals between transports.

A separate Tor-reported byte series begins 20 minutes later and yields 65.5 GB received and 65.1 GB sent. The retained data does not explain the difference between these counters. They measure overlapping activity. Adding them to the service or host totals would count some traffic twice.

The retained tunnel and circuit gauges have the same limited one-host coverage. At the cutoff they report 735 built Tor circuits, 37 I2P client tunnels and two transit tunnels. These service-level observations cannot establish Monero peer counts or successful wallet transactions. They do not establish fleet-wide anonymity-network health.

Measurement coverage and limits

Data family	Maximum reporting coverage	Use in this report
Physical-interface traffic	Six hosts	Full retained history and shared-period totals
Direct peer snapshot	Six daemons	Current transport and direction counts
Historical Tor peer counts	Two hosts after excluding the invalid mapping	Partial connection trend
Historical I2P peer counts	Three hosts	Partial connection trend
Monero daemon-byte counters	Four hosts	Separate observed transfer estimates
Tor/I2P service bytes and circuit/tunnel gauges	One host	Explicitly limited subset measurements

The traffic analysis queries beyond the start of retained data and stops at November 6, 2026, 19:10 UTC. Direct peer checks extend the research cutoff to approximately 19:13 UTC. It cannot recover measurements that were never collected or have already expired.

The calculations use time-aligned samples and integrate rates over adjacent observed intervals. Byte counters use five-minute windows with Prometheus's rate function, which handles counter resets. Where monitoring exports rates directly, the charts use those values. Transfer figures use decimal GB and TB and remain estimates. Raw interface samples begin before the first plotted rate point, and the graphs summarize retained history at five-minute resolution.

Monero's Tor and I2P documentation separates anonymous peer connections from wallet access to a node. This report measures network activity, not individual wallet usage or transaction privacy. The node directory lists current service endpoints, and the Tor connection guide explains wallet access.