Strange ONION_RECV_3 packets

[kpp]

We receive these packets time to time:

• [140, 105, 127, 8]
• [140, 251, 100, 49]
• [140, 187, 23, 17]
• [140, 195, 48, 106]

They are 4-bytes length and start from 140. NET_PACKET_ONION_RECV_3 = 0x8c, // 140. From https://github.com/TokTok/c-toxcore/blob/master/docs/Prevent_Tracking.txt#L134:

Onion packet (response):

initial (sent from node D to node C):

[uint8_t packet id (140)][nonce (for the following symmetric encryption)]encrypted with temp symmetric key of Node C:
[IP_Port (of Node B)[nonce (for the following symmetric encryption)]
encrypted with temp symmetric key of Node B:[IP_Port (of Node A)[nonce (for the following symmetric encryption)]
encrypted with temp symmetric key of Node A: [IP_Port (of us)]]][data to send back]

According to docs should the packets be a little bit longer than 4 bytes (id + Nonce)?

[kurnevsky]

There is one more strange thing - often we receive OnionAnnounceRequest with too big payload. But as I can see c-toxcore has check for exact size:

c-toxcore/toxcore/onion_announce.c

Lines 376 to 378 in 17a7bf3

	if (length != ANNOUNCE_REQUEST_SIZE_RECV) {
	return 1;
	}

So it should send OnionAnnounceRequest packets with fixed size payload. What could be wrong?

[nurupo]

Interesting. Do you think it's toxcore that sends those packets during its normal operation or someone is fuzzing DHT nodes?

[kpp]

Messages like [140, Nonce] are pretty much repetitive, there are no other failure messages <> 4 bytes

[kpp]

Any ideas?