I am studying the detection (I am developing my program for coursework) of P2P traffic on the network, including I need to detect bittorrent traffic. I understand that BitTorrent can be identified by port numbers, the string "BitTorrent protocol" in the payload of packets, but what other methods are there?
The Wireshark bittorrent dissector uses two methods to identify bittorrent traffic:
If there are others, these are not (yet) implemented in the dissector.
Could you describe the heuristic method in a little more detail?
But there are packages that do not meet these conditions, but are still defined as BitTorrent. I have attached a link to this comment where you can see an example of such a package.
if (tvb_captured_length(tvb) >= 20 &&
tvb_get_guint8(tvb, 0) == 19 &&
tvb_memeql(tvb, 1, (const guint8*)"BitTorrent protocol", 19) == 0) {
conversation = find_or_create_conversation(pinfo);
conversation_set_dissector(conversation, dissector_handle);
Is the packet in the screen shot part of a conversation that matches the protocol heuristics?
Asked: 2023-03-12 13:52:14 +0000
Seen: 329 times
Last updated: Mar 12 '23
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.