How wireshark defines the bittorrent protocol?

retag add tags

I am studying the detection (I am developing my program for coursework) of P2P traffic on the network, including I need to detect bittorrent traffic. I understand that BitTorrent can be identified by port numbers, the string "BitTorrent protocol" in the payload of packets, but what other methods are there?

The Wireshark bittorrent dissector uses two methods to identify bittorrent traffic:

It uses a range of TCP ports
It uses a heuristic analysis of the packet consisting of:
1. minimum payload length
2. a length indication
3. an identification string

If there are others, these are not (yet) implemented in the dissector.

13.7k

Jaap

answered 2023-03-12 14:14:55 +0000

edit flag offensive 0 remove flag delete link

Comments

Could you describe the heuristic method in a little more detail?

unins000exe (2023-03-12 14:59:38 +0000) edit

Click the "heuristic analysis of the packet" link in @Jaap reply. It's 3 lines of code that read pretty easy.

Chuckc (2023-03-12 17:16:30 +0000) edit

The three lines say:

Length minimum 20 bytes
a byte with value 19
followed by a string "BitTorrent protocol"

Jaap (2023-03-12 20:33:39 +0000) edit

But there are packages that do not meet these conditions, but are still defined as BitTorrent. I have attached a link to this comment where you can see an example of such a package.

https://ibb.co/YfqVMQ6

unins000exe (2023-03-13 08:13:25 +0000) edit

   if (tvb_captured_length(tvb) >= 20 &&
       tvb_get_guint8(tvb, 0) == 19 &&
       tvb_memeql(tvb, 1, (const guint8*)"BitTorrent protocol", 19) == 0) {
      conversation = find_or_create_conversation(pinfo);
      conversation_set_dissector(conversation, dissector_handle);

Is the packet in the screen shot part of a conversation that matches the protocol heuristics?

Chuckc (2023-03-13 11:33:04 +0000) edit

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

How wireshark defines the bittorrent protocol? edit

Comments

1 Answer

Comments