For limiting the usage of BitTorrent, I must identify BitTorrent traffic.
For handshaking, I am simply looking for "19" and "BitTorrent protocol" string. If it is DHT I am looking for ping or id (d1:ad2:id20) commands.
All I am doing can be seen in the link
I generally catch BitTorrent at ~fifth packet. But sometimes, my logic fails. I used Wireshark to understand when I can't tag BitTorrent traffic. I found out a UDP session with first three packets session like below picture:
I am looking uTP and DHT protocol specifications, but can't find anything like the traffic below. I am sure this session is BitTorrent, because in third packet, there is string "BitTorrent protocol".
It seems even Wireshark can't tag it as BitTorrent and shows UDP. My question is, what is the rule for identifing the session below as BitTorrent protocol?