Sean Roach wrote:

... Something to consider. If anyone of the distributed remailers is removed from a ring, the messages that need to travel across that ring can no longer do that. This makes the loop only as strong as its most at risk remailer. The star approach has already been seen in action, the trouble here is a single choke point. Full interconnectability is only feasible in a small net, but I would advise this at first. Check for the x-loop to see if another one got it first. If none, add one and send it on down the line. A disjointed mess, if the remailers are given first access to the list, could work quite well as long as that x-loop remained to point to who sent the message, and the x-loop contained an unalterable message number, and the remailers could eliminate duplications, probably based on message number. This should work as the net grows and would only be as weak as the strongest two connected remailers. Sounds like the internet.

I'd suggest a simplier solution: to connect each server with a couple, or maybe three, other servers. This scheme is rather robust, does not consume too much CPU time and bandwidth, and is easy to implement. - Igor.