[popol12]

Let’s call these 2 nodes N1 and N2. The case you mention only works if N1 is connected to the network only through N2, in which case when the attacker’s nodes receive a new transaction from N2 there is plausible deniability for both N1 and N2. In any other network topology, N1 and N2 are broadcasting their transactions to attackers node, which can then link then directly to N1 or N2. So no, this attack doesn’t require to own all the network.

I don’t know which threshold makes the attack practical though. I guess there is probably no threshold: the bigger the share of the network you own, the bigger your percentage of successful IP tagging is.

[zigararu]

I dont think that's how dandelion++ works; one of us is mistaken. In any network topology, I think it is possible that in the first step of the stem phase the transaction is propagated only from N1 to N2. It will be impossible for the other nodes to know if that happened or not, so they can't know whether N1 or N2 transmitted the transaction first. I could be mistaken but this is how i understand it.

I agree with what you say about the threshold.