Skip to main content
Information Security

Return to Question

Fixed bittorent to BitTorrent, fixed grammar, capital letters
Source Link
edit approved Jul 10, 2015 at 17:17
Vilican
edit approved Jul 10, 2015 at 17:17
Vilican
  • 2.8k
  • 8
  • 24
  • 35

DPI bittorentBitTorrent fingerprinting

For limiting the usage of bittorentBitTorrent, I must identify bittorentBitTorrent traffic  .

For handshaking, I am simply looking for "19" and "bittorent"BitTorrent protocol" string. If it is DHT I am looking for ping or id  (d1:ad2:id20) commands.

All I am doing can be seen in the link

I generally catch bittorentBitTorrent at ~fifth packet. But sometimes, my logiclogic fails. I used wiresharkWireshark to understand when I can't tag bittorentBitTorrent traffic. I found out a UDP session with first three packets session like below picture:

enter image description hereUDP session

I am looking uTP and DHT protocol specifications, but can't find anything like the trafictraffic below. I am sure this session is bittorentBitTorrent, because in third packet, there is string "bittorent"BitTorrent protocol".

It seems even wiresharkWireshark can't tag it as bittorentBitTorrent and shows UDP. My question is, what is the rule for identifing the session below as bittorentBitTorrent protocol?

Regards

DPI bittorent fingerprinting

For limiting the usage of bittorent I must identify bittorent traffic  .

For handshaking I am simply looking for "19" and "bittorent protocol" string. If it is DHT I am looking for ping or id(d1:ad2:id20) commands.

All I am doing can be seen in the link

I generally catch bittorent at ~fifth packet. But sometimes my logic fails. I used wireshark to understand when I can't tag bittorent traffic. I found out a UDP session with first three packets session like below picture:

enter image description here

I am looking uTP and DHT protocol specifications but can't find anything like the trafic below. I am sure this session is bittorent because in third packet there is string "bittorent protocol".

It seems even wireshark can't tag it as bittorent and shows UDP. My question what is the rule for identifing the session below as bittorent protocol?

Regards

DPI BitTorrent fingerprinting

For limiting the usage of BitTorrent, I must identify BitTorrent traffic.

For handshaking, I am simply looking for "19" and "BitTorrent protocol" string. If it is DHT I am looking for ping or id  (d1:ad2:id20) commands.

All I am doing can be seen in the link

I generally catch BitTorrent at ~fifth packet. But sometimes, my logic fails. I used Wireshark to understand when I can't tag BitTorrent traffic. I found out a UDP session with first three packets session like below picture:

UDP session

I am looking uTP and DHT protocol specifications, but can't find anything like the traffic below. I am sure this session is BitTorrent, because in third packet, there is string "BitTorrent protocol".

It seems even Wireshark can't tag it as BitTorrent and shows UDP. My question is, what is the rule for identifing the session below as BitTorrent protocol?

Source Link
Kadir Erdem Demir
Kadir Erdem Demir
  • 477
  • 1
  • 6
  • 17

DPI bittorent fingerprinting

For limiting the usage of bittorent I must identify bittorent traffic .

For handshaking I am simply looking for "19" and "bittorent protocol" string. If it is DHT I am looking for ping or id(d1:ad2:id20) commands.

All I am doing can be seen in the link

I generally catch bittorent at ~fifth packet. But sometimes my logic fails. I used wireshark to understand when I can't tag bittorent traffic. I found out a UDP session with first three packets session like below picture:

enter image description here

I am looking uTP and DHT protocol specifications but can't find anything like the trafic below. I am sure this session is bittorent because in third packet there is string "bittorent protocol".

It seems even wireshark can't tag it as bittorent and shows UDP. My question what is the rule for identifing the session below as bittorent protocol?

Regards