How to Detect BitTorrent Traffic on your Network
What is BitTorrent Traffic?
BitTorrent is a communication protocol for peer-to-peer file sharing (“P2P”) which is used to distribute data and electronic files over the Internet. It is most famous as a method for downloading copyrighted material such as movies and music. However, it can be used for software delivery and Microsoft have some P2P capabilities built into Windows 10 for distributing Windows updates.
When it comes to monitoring BitTorrent traffic you need to understand how the protocol works. It is not like a traditional download, where you download everything from a single link or IP address. Instead, you download pieces from other clients (peers) and the management is looked after by trackers or more commonly Distributed Hash Tables. Every download has an associated INFO-HASH value which is unique to it and this is an important piece of data when it comes to identifying BitTorrent traffic.
Capturing BitTorrent Traffic
There are multiple potential data sources if you want to monitor BitTorrent traffic on your network.
- Monitor network traffic at your network edge using a SPAN, mirror port or TAP
- Flow records such as NetFlow or IPFIX
- Firewall logs
The most reliable source is network traffic as “packets don’t lie”. Flow records will not capture metadata such as INFO-HASH values, so you will never know for definite that traffic is associated with BitTorrent activity. Firewall logs may indicate the presence of BitTorrent, but they are not designed as a forensics tool to store long-term records of all traffic and application information.
The video below shows how to set up a SPAN or mirror port to capture traffic at your network edge. With a tool like LANGuardian connected to this, you can identify BitTorrent traffic and capture important metadata such as INFO-HASH, IP addresses, external clients and file names.
Analyzing BitTorrent Traffic
When it comes to analyzing BitTorrent traffic you need to be watching out for these applications:
- BitTorrent DHT Tracker
- BitTorrent Peer Traffic
Once you detect these applications on your network, you need to capture certain metadata so you don’t need to store every packet which can be expensive. The image below shows the output of a LANGuardian BitTorrent analysis report. Note how you can see the network user, IP address, INFO-HASH and file name.
If the download is associated with a private tracker you may not see any filenames. In that case you should look at the destination IP addresses as they can reveal a lot about the applications associated with the Bittorrent traffic. In the image below we can see that there is some Bittorrent activity associated with a client and looking at the destination IP addresses it would appear that the user has the uTorrent application installed.
Tracking BitTorrent Traffic on Your Network
Download a free trial of LANGuardian today, if you would like to check for any BitTorrent activity on your network. It comes with a fully featured BitTorrent reporting engine together with Active Directory integration, so you can associate network activity with usernames.