Eclipse is network isolation, not a consensus-rule bypass. A Full Node still rejects invalid data, but can be delayed, censored or kept on an older valid branch.
The attacker must capture the victim's relevant network paths, not merely establish one connection. A working connection to an honest peer can disrupt complete control. [Heilman et al. — Eclipse Attacks on Bitcoin] [Bitcoin Optech — Eclipse attacks]
The 2015 study by Heilman and coauthors examined filling address tables with attacker addresses and capturing reconnection. Outcomes depend on resources and implementation; a historical experiment is not a test of today's version. [Heilman et al. — Eclipse Attacks on Bitcoin] [Bitcoin Core v29.0 — addrman]
The attacker chooses which blocks and transactions pass in or out. It can withhold messages and observe transaction origins even without majority hash power. [Heilman et al. — Eclipse Attacks on Bitcoin] [Bitcoin Optech — Eclipse attacks]
A Full Node still checks signatures, scripts and issuance rules. Isolation alone cannot make an invalid block valid, but validation cannot reveal a valid block that never reaches the node. [Bitcoin Developer Guide — Block Chain]
Without new honest blocks, the node can remain at an old tip; an isolated miner can waste work on a branch the rest of the network abandoned. Availability and freshness are distinct from validity. [Heilman et al. — Eclipse Attacks on Bitcoin] [Bitcoin Optech — Eclipse attacks]
A recipient can see confirmations on an attacker's valid branch and later see it reorganized when connectivity returns. That branch still requires Proof of Work; an invented confirmation count alone cannot fool a Full Node. [Heilman et al. — Eclipse Attacks on Bitcoin] [Bitcoin Developer Guide — Block Chain] [Bitcoin Optech — Eclipse attacks]
Address bucketing and diverse outbound paths reduce concentration. Different addresses can still belong to the same adversary; diversity does not guarantee independence. [Bitcoin Core v29.0 — addrman] [Bitcoin Core v29.0 — Peer connections]
Bitcoin Core uses trial feeler connections and extra block-relay connections to seek additional paths. The former test addresses, the latter can bring new headers; neither alone guarantees an end to isolation. [Bitcoin Core v29.0 — Peer connections]
A manually configured known peer can add a path, but requires trust in its availability and network connectivity. More connections through one provider need not mean independent paths. [Bitcoin Developer Guide — P2P Network] [Bitcoin Optech — Eclipse attacks]
Eclipse targets a node or selected group, while a broader network partition separates whole network regions. Defense examines paths and the adversary model, not just the number of open connections. [Heilman et al. — Eclipse Attacks on Bitcoin] [Bitcoin Optech — Eclipse attacks]
For the clearest picture, read this entry together with Sybil attack, Block propagation, Compact block relay, Nakamoto consensus. The reverse links also lead from Double-spend, Sybil attack, Neutrino.