Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any tool to sniff bittorrent traffic and reassemble data about the torrent? Im looking for file names, peers, tracker address, local IP, etc. This is purely for academic interest in which all parties would be willing participants. I also am assuming that the torrent connections are unencrypted.


locked by HopelessN00b Jan 23 '15 at 11:43

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

closed as off-topic by HopelessN00b Jan 23 '15 at 11:42

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

depends on what kind of information you would want to reassemble and where in the network you would want to install it? – sybreon Jan 2 '11 at 10:31
Id be most interested in the file names of any information about the files being transfered. Since this is in a test environment assume that I'm a peer on the same subnet so I can see all the packets the client would see. – Flamewires Jan 3 '11 at 5:15
answer updated - file names are only stored in the original torrent file so you can't reconcile traffic to files until you have the torrent – Andy Jan 3 '11 at 14:12
up vote 5 down vote accepted

Capsa Network Analyzer can group connections by protocol (including BitTorrent) and provides a wealth of information including throughput, a connection matrix (for remote/local network/peer mapping) and other expected packet sniffing capabilities. There's a tutorial here.

To identify what file names are in the torrents I'd recommend capturing any requests to known trackers and examining .torrent files - I don't know of an automated tool for this. Once the torrent has been parsed by the client it requests chunks rather than files, so sniffing BitTorrent traffic without knowing which torrent it's from may be fruitless. There's a list of 950+ trackers here that you can cross reference against requests.

If you are looking to filter requests or are interesting in packet-shaping L7-filter is an application layer "deep packet inspection" filter for a few different P2P protocols.

Here's a good white paper on BitTorrent.

Capsa's connection matrix Capsa's connection matrix


Not the answer you're looking for? Browse other questions tagged or ask your own question.