How to detect Bittorrent traffic? Ideally with automatic notification

Question

I got a letter from my ISP a while back, complaining about a movie I was supposedly downloading. At first I wrote it off until I later saw my roommate watching that movie, I asked him about it, and he admitted to downloading it. I asked him to refrain from using bittorrent illegally, and he said he would, but I recently saw him shuffling torrents around in uTorrent. Now, I'm the only one who pays for the connection, and it's all in my name. I talked to him about it again, but I'm wondering if there's a way I could setup a Wireshark script something to alert me if/when it finds bittorrent traffic.

Answer 1

I don't have a direct way via wireshark or that directly, however - I do have a few options for you.

OpenDNS:

-You could set-up a DNS server for your place and route all traffic through it. You can limit certain types of connections and various websites. Let's suppose you knew he used the piratebay, block *.piratebay.* or whatever. (other common ones: 1337, publicbt, openbittorrent, h33t, istole.it, desync).

Router:

1: Block Sites / Protocols

Just as easily, you could block sites (or ports) via most routers. This could be accomplished with blocking common bittorrent ports (and if you experience issues with your normal web use, you could adjust this easily).

2: Block their access

Less Extreme:

Sounds like if your name is on stuff, they need to listen to you. #1, if you are splitting the cost of service - stop accepting their money. That then covers you for later disallowing them access. You can either MAC filter or change the codes. However - this is limited in usefulness as someone with physical access can change settings or do a full reset (thusly doing nothing).

Moderate:

Create a written contract. Enumerate what you want to happen. 1) No torrenting or illegal downloading of any kind. 2) They are responsible for all instances of #1 3) If #1 is broken, you have the right to discontinue service at will or institute network monitoring &/or network limitations. And so-forth. If they break it, move to Very Extreme

Very Extreme:

Cancel your service to the ISP. Instead, if you are able, tether your phone for your needs (basic needs would be okay, but streaming video or anything would not work well). If they need it, they will either go elsewhere or put it under their name (unless their a slime-ball and try to impersonate you).

Hope their is some value there for you. Another option could be setting up a PC or tomato router and having that do some packet shaping - but I do not have enough experience with that to provide useful comments.

Answer 2

This is best done on the router.

In OSes with a solid and configurable network layer it's possible to monitor everything with the built-in kernel firewall, on "home routers" with custom systems it may be less straight forward or even impossible. Your best bet it to install a "proxy" machine that does routing with BSD or Linux (there are router-distros which are good for this) that will monitor the network and notify you via email when needed.

Answer 3

There's no easy way to detect Bittorrent traffic because you can force encryption. When ISPs were trying to slow down (or even drop packets via Sandvine), forcing encryption was able to trick the routers to allow traffic through.

Solution 1: Remove your name and have him take over the account. He might actually do what you want.

Solution 2:

Solution 2 recognizes that your roommate will not change and it is better to work with the situation.

In the µTorrent client:

• Set the global number of peers to something very low like 25.
• Seed to 1%.

You are receiving the letter because anti-piracy services are recording IP address and sending the notice to the ISP that owns the IP address. The ISP then figures out which account was using the IP address at the time the movie was being received or sent. The problem is that your roommate is seeding on a public tracker.

The two settings changes on the µTorrent client will minimize exposure of the IP address. The first setting will limit how many peers he can connect to. The chances of a monitoring service intersecting with your IP address is greatly reduced. Also, when you seed to 1% (aka hit-and-run), the time the IP address is exposed is greatly reduced.