Revision history [back]

The Wireshark bittorrent dissector uses two methods to identify bittorrent traffic:

1. It uses a range of TCP ports
2. It uses a heuristic analysis of the packet consisting of:
   1. minimum payload length
   2. a length indication
   3. an identification string

If there are others, these are not (yet) implemented in the dissector.