Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there any tool to sniff bittorrent traffic and reassemble data about the torrent? Im looking for file names, peers, tracker address, local IP, etc. This is purely for academic interest in which all parties would be willing participants and therefore please dont upvote responses that talk merely about legal issues with using this kind of approach on a production network. I also am assuming that the torrent connections are unencrypted.

Thanks

share|improve this question
    
depends on what kind of information you would want to reassemble and where in the network you would want to install it? –  sybreon Jan 2 '11 at 10:31
    
Id be most interested in the file names of any information about the files being transfered. Since this is in a test environment assume that I'm a peer on the same subnet so I can see all the packets the client would see. –  Flamewires Jan 3 '11 at 5:15
    
answer updated - file names are only stored in the original torrent file so you can't reconcile traffic to files until you have the torrent –  Andy Jan 3 '11 at 14:12
add comment

1 Answer

up vote 5 down vote accepted

Capsa Network Analyzer can group connections by protocol (including BitTorrent) and provides a wealth of information including throughput, a connection matrix (for remote/local network/peer mapping) and other expected packet sniffing capabilities. There's a tutorial here.

To identify what file names are in the torrents I'd recommend capturing any requests to known trackers and examining .torrent files - I don't know of an automated tool for this. Once the torrent has been parsed by the client it requests chunks rather than files, so sniffing BitTorrent traffic without knowing which torrent it's from may be fruitless. There's a list of 950+ trackers here that you can cross reference against requests.

If you are looking to filter requests or are interesting in packet-shaping L7-filter is an application layer "deep packet inspection" filter for a few different P2P protocols.

Here's a good white paper on BitTorrent.


Capsa's connection matrix Capsa's connection matrix

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.