Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a router through which 10 PC's are connected to run internet, almost all PC's have uTorrent. I want to detect that how in many PC's uTorrent is running at a time.

Is there any way or tool through which I can detect this.

Thanks

share|improve this question
add comment

6 Answers

How is the router connection to the set of PCs?
If its a single link which the router will allow you to mirror,
you can run these packets through a Snort class filter to detect BitTorrent signatures.
If you cannot mirror a port, you can still plug in a 3 port hub to 'tap' the traffic to Snort.

The source IP addresses for matching packets will indicate use of BitTorrent in general (if you know its uTorrent, you have a match; but, in general I think you want to know if any bittorrent application is in use on those PCs).

This will be a passive check -- you do not need access to the PCs and those PC users will not know you are checking.
Going one step further, if you keep Snort inline (not on a mirrored path), you can also block (most) BitTorrent activities.

Once/If you setup such a system, you can leverage it for a lot of other security checks
(just read up a bit more of Snort).

share|improve this answer
add comment

I don't think you can do that, at least not by network traffic analysis.

Most BitTorrent clients allow setting random ports and using encryption when exchanging data.

Your only hope is sniffing for data exchange with trackers. If you're lucky and it proves to be regular unencrypted HTTP, you might make assumptions based on that.

share|improve this answer
    
Many internet providers detect bittorrent transmission for throttling speed, and it appears to works whether encryption and HTTPS is enabled or not. So there has to be a verifiable signature? –  mtone Apr 28 '11 at 20:31
add comment

You can use a thorough nmap scan to determine what ports are open and listening. If the host is listening on high ports those might be utorrent, check utorrent docs for what ports it usually chooses, iirc they are around 40k-50k.

Examples:

Scan one host, even if it doesn't reply to ping:

nmap -sS -P0 -p 1-65535 192.168.0.12

Scan all hosts that reply to ping:

nmap -sS -p 1-65535 192.168.0.0/24

The above example assumes your network is in the 192.168.0.0/24 subnet. If you know the IP's of the PC's in question, feed the command all of the ip's, that will save you a lot of time. See nmap's man page for further reference.

When you have found the open ports I guess you could verify that it actually is utorrent running on them by:

telnet hostip openport

This of course also assumes that the machines are running and have utorrent running when you scan, for regular checks you could make a batch-script of the above commands and then output its result to a file.

When I think about it I am sure there are more graceful ways. Run rflow on your router and ntop on your computer for instance.

share|improve this answer
    
Where to run these commands, actually I am not a network related guy, so it'll be better for me if you can guide me where to run these commands, in "cmd" utility? I tried but its not running there, it says "unrecognized command". Please guide, thanks!! –  Prashant May 26 '10 at 6:23
add comment

Yup i guess you could use wireshark for that.

share|improve this answer
add comment

Besides packet sniffing on your network, you could enable the web interface of uTorrent in all of them. Then going to http://192.168.1.10:8080/gui where 192.168.1.10 is your computer's IP address will give you a clue whether or not the web interface is running... If it is, so is uTorrent.

share|improve this answer
    
That would assume that one has access to all those computers (for enabling the web interface), which I'm not sure it's the case. –  geek May 25 '10 at 11:37
    
@geek, yes that's not the case. I don't have access to all the PC's –  Prashant May 25 '10 at 12:12
    
Okay! Then I'm sorry but my answer does not apply to you ;) –  BloodPhilia May 25 '10 at 14:17
add comment

This application somewhat has a feature you may be looking for: http://forum.utorrent.com/viewtopic.php?id=73450

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.