Definition
The Address Manager, known in the Bitcoin Core source as addrman, is the in-memory database every full node uses to track the IP addresses of other nodes it has learned about. It is persisted to peers.dat so that a node can quickly rebuild its peer connections after a restart instead of starting from the DNS seeds each time. For a sovereign Bitcoiner running a node at home, addrman is the quiet machinery that decides who your node talks to.
The new and tried tables
addrman is split into two tables. The new table holds addresses your node has heard about via gossiped addr messages but has not yet successfully connected to; it spans 1024 buckets. The tried table holds addresses your node has actually connected to and verified as reachable; it spans 256 buckets. An address is placed into a bucket using a cryptographic hash of the source peer's network group and the destination address, which is the heart of addrman's security model.
Why bucketing matters
The bucketing scheme exists to make it expensive for an attacker to flood your address table with their own malicious nodes. Because bucket placement depends on the attacker's network group (their autonomous system or /16 range), poisoning the table meaningfully would require controlling addresses across many distinct networks rather than a single cheap subnet. This randomized bucketing is a core defense against the kind of address poisoning that precedes a full network isolation.
addrman feeds the node's outbound peer selection, so a healthy, diverse address table is foundational to staying connected to the honest network. See related entries on the feeler connection that refreshes the tried table and on eclipse-attack resistance.
In Simple Terms
The Address Manager, known in the Bitcoin Core source as addrman, is the in-memory database every full node uses to track the IP addresses of…