Dandelion++ Explained: How Monero Hides Your IP Address From The Network
Most people know Monero hides the sender, the amount and the receiver on the chain itself. Ring signatures obscure the origin of a transaction, stealth addresses hide the recipient, and RingCT hides the value. But there is a second layer of privacy that gets far less attention: your IP address. A blockchain can be perfectly private on-chain and still leak who is broadcasting each transaction, because every node on the network sees which IP first announced it. Dandelion++ is Monero’s answer to that problem, and understanding it explains why running your own node matters more than most guides admit.
The problem: transaction origin analysis
When you broadcast a Monero transaction, your wallet sends it to the node you are connected to. That node relays it to its peers, they relay to theirs, and within a couple of seconds the whole network has it. The contents are private. The propagation is not.
An adversary running a large number of nodes, a passive listener, can log the first few IPs that announce each transaction and make a good statistical guess at the origin. Even if the guess is wrong half the time, deanonymising a fraction of users is enough to build profiles, correlate broadcasts with other network activity, and narrow suspects. This class of attack has been demonstrated against Bitcoin repeatedly, and the same logic applied to Monero before Dandelion, even though the amounts and addresses were already hidden.
How Dandelion++ works
Dandelion++ runs every new transaction through two phases.
The stem phase. Instead of shouting the transaction to all peers at once, your node picks one random outbound peer and sends it only to that peer. That peer, with probability, either continues the stem by forwarding to one more random peer, or flips the transaction into the fluff phase. The stem is typically one to a few hops long. No node in the stem knows whether it is the first hop or the fourth, so even a malicious stem peer cannot be certain the transaction originated at its upstream neighbour. This is the crucial property: origin ambiguity is created hop by hop.
The fluff phase. When a node flips the transaction to fluff, it diffuses it to all of its peers at once, and from there propagation proceeds like a normal cryptocurrency flood. The whole network receives it within seconds.
The result is that the transaction appears on the public network at a point several hops away from the true origin. A passive listener tracking first-seen IPs now follows the fluff point, not the sender.
Details that matter in practice
A few implementation specifics are worth knowing because they come up in real discussions:
- Monero implements Dandelion++, the improved 2018 variant of the original Dandelion proposal, with the plus meaning hardened handling of spy nodes and better spreading patterns over the older design.
- Stems only propagate through outbound connections where possible. Your node chooses peers it dialled itself, which an attacker has more difficulty pre-positioning against, since inbound spy nodes cannot easily force themselves into your outbound slots.
- The stem-to-fluff decision is probabilistic per hop, so stem lengths vary per transaction and are not predictable from outside.
- Dandelion++ does nothing about a malicious node you deliberately connect to. If your wallet remote node is hostile, it sees your transactions at the source, stem or no stem. This is exactly why remote nodes remain the weakest link in many setups, a point we covered in detail in our article on verifying transactions with a view key, where third-party trust cuts both ways.
What Dandelion++ does not protect against
Honesty about limits is important with privacy tech. Dandelion++ defends against passive network observers inferring transaction origin. It does not:
- Hide your IP from the node your wallet is directly connected to
- Protect against a global passive adversary with a view of every connection on the internet. It raises the cost and reduces confidence, it does not make origin analysis impossible
- Do anything at all about timing correlation. If your wallet broadcasts 30 seconds after you make a purchase in person, an observer with both data streams can still correlate. Layered privacy means layered habits too
- Defend against sybil neighbours if an attacker somehow becomes most of your peer set
Why your own node is the real fix
Put the pieces together and the conclusion is simple. Dandelion++ protects the network layer for everyone automatically. But the strongest network-layer protection available to you personally is to remove the third party entirely: run your own Monero node, local or on a private server, and point your wallet at it over a trusted connection. Then the only IP that ever sees your transaction at origin is one you control, and Dandelion++ takes care of the rest of the network on your behalf.
A pruned node runs comfortably in tens of gigabytes and syncs in a day or two on ordinary hardware, and the privacy upgrade is immediate. For users who need network-level privacy beyond that, running the daemon over Tor or I2P removes even the ISP-side visibility.
The takeaway
Monero’s privacy is a stack: ring signatures and RingCT on the chain, stealth addresses per output, Dandelion++ across the relay network, and your own opsec choices at the edges. Dandelion++ is the layer people forget, and the one that silently protects every broadcast you make. If you are evaluating your own setup, the highest-leverage change remains the boring one: your own node, your own connection. For the other half of the transaction-privacy picture, see our earlier explainer on tail emission and how the 0.6 XMR reward funds long-term security, which covers the economic assumptions underneath all of this.