1

For limiting the usage of BitTorrent, I must identify BitTorrent traffic.

For handshaking, I am simply looking for "19" and "BitTorrent protocol" string. If it is DHT I am looking for ping or id (d1:ad2:id20) commands.

All I am doing can be seen in the link

I generally catch BitTorrent at ~fifth packet. But sometimes, my logic fails. I used Wireshark to understand when I can't tag BitTorrent traffic. I found out a UDP session with first three packets session like below picture:

UDP session

I am looking uTP and DHT protocol specifications, but can't find anything like the traffic below. I am sure this session is BitTorrent, because in third packet, there is string "BitTorrent protocol".

It seems even Wireshark can't tag it as BitTorrent and shows UDP. My question is, what is the rule for identifing the session below as BitTorrent protocol?

Improve this question

1 Answer 1

Reset to default
1

If a host has a single port that is connected to many remote hosts and this single port has a big port number (for example 50000 TCP/UDP port) and the same thing is true for destination ports, then most probably the mentioned host uses a BitTorrent client. This method can eliminate all p2p connections, not only BitTorrent.

In your case you may be interested in this topic: Can BitTorrent Clients be Fingerprinted?

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .