I am running windows 7, and using Wireshark I can see that my girlfriend's computer is sending UDP traffic to on port 6771. I looked up info on that IP address, and it says it's part of a reserved IP space, or a "bogon" IP address that should not appear on the internet.

Here is a snippet of some of the data I see that it is sending:

Port: 6881
Infohash: ********************* (censored)
cookie: **** (censored)

What's going on here?

2 Answers 2


It's multicast traffic used for BT Local Peer Discovery. See https://en.wikipedia.org/wiki/Local_Peer_Discovery.

The Local Peer Discovery protocol is an extension to the BitTorrent file-distribution system. It is designed to support the discovery of local BitTorrent peers, aiming to minimize the traffic through the Internet service provider's (ISP) channel and maximize use of higher-bandwidth local area network (LAN).

Local Peer Discovery is implemented[1] with HTTP-like messages on User Datagram Protocol (UDP) multicast group which is an administratively scoped multicast address. While it is implemented in several clients (µTorrent,[2] BitTorrent/Mainline,[3] MonoTorrent,[4] libtorrent[5] and its derivatives, Transmission 2.0,[6] aria2 [7]) and implementation is very simple, no formal specification had been created as of December, 2009. Alternative multicast protocol extension is published as BEP 26.


6881 is a common bittorrent port. Is she torrenting stuff?

Also, does she know you're sniffing her traffic? :P

  • I have redacted the infohash and cookie for protection. But why would it be sending UDP data to a bogon IP address?
    – ansichart
    Oct 15, 2015 at 6:17
  • I am running wireshark because I am concerned about the security on my home network. I've been digging deep into taskmgr and process monitor, and wireshark. Trying to lock down my LAN
    – ansichart
    Oct 15, 2015 at 6:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .