I am running windows 7, and using Wireshark I can see that my girlfriend's computer is sending UDP traffic to on port 6771. I looked up info on that IP address, and it says it's part of a reserved IP space, or a "bogon" IP address that should not appear on the internet.

Here is a snippet of some of the data I see that it is sending:

Port: 6881
Infohash: ********************* (censored)
cookie: **** (censored)

What's going on here?


It's multicast traffic used for BT Local Peer Discovery. See https://en.wikipedia.org/wiki/Local_Peer_Discovery.

The Local Peer Discovery protocol is an extension to the BitTorrent file-distribution system. It is designed to support the discovery of local BitTorrent peers, aiming to minimize the traffic through the Internet service provider's (ISP) channel and maximize use of higher-bandwidth local area network (LAN).

Local Peer Discovery is implemented[1] with HTTP-like messages on User Datagram Protocol (UDP) multicast group which is an administratively scoped multicast address. While it is implemented in several clients (µTorrent,[2] BitTorrent/Mainline,[3] MonoTorrent,[4] libtorrent[5] and its derivatives, Transmission 2.0,[6] aria2 [7]) and implementation is very simple, no formal specification had been created as of December, 2009. Alternative multicast protocol extension is published as BEP 26.


6881 is a common bittorrent port. Is she torrenting stuff?

Also, does she know you're sniffing her traffic? :P

  • I have redacted the infohash and cookie for protection. But why would it be sending UDP data to a bogon IP address? – ansichart Oct 15 '15 at 6:17
  • I am running wireshark because I am concerned about the security on my home network. I've been digging deep into taskmgr and process monitor, and wireshark. Trying to lock down my LAN – ansichart Oct 15 '15 at 6:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.