I have a router through which 10 PC's are connected to run internet, almost all PC's have uTorrent. I want to detect that how in many PC's uTorrent is running at a time.
Is there any way or tool through which I can detect this.
How is the router connection to the set of PCs?
The source IP addresses for matching packets will indicate use of BitTorrent in general (if you know its uTorrent, you have a match; but, in general I think you want to know if any bittorrent application is in use on those PCs).
This will be a passive check -- you do not need access to the PCs and those PC users will not know you are checking.
Once/If you setup such a system, you can leverage it for a lot of other security checks
I don't think you can do that, at least not by network traffic analysis.
Most BitTorrent clients allow setting random ports and using encryption when exchanging data.
Your only hope is sniffing for data exchange with trackers. If you're lucky and it proves to be regular unencrypted HTTP, you might make assumptions based on that.
You can use a thorough nmap scan to determine what ports are open and listening. If the host is listening on high ports those might be utorrent, check utorrent docs for what ports it usually chooses, iirc they are around 40k-50k.
Scan one host, even if it doesn't reply to ping:
Scan all hosts that reply to ping:
The above example assumes your network is in the 192.168.0.0/24 subnet. If you know the IP's of the PC's in question, feed the command all of the ip's, that will save you a lot of time. See nmap's man page for further reference.
When you have found the open ports I guess you could verify that it actually is utorrent running on them by:
This of course also assumes that the machines are running and have utorrent running when you scan, for regular checks you could make a batch-script of the above commands and then output its result to a file.
When I think about it I am sure there are more graceful ways. Run rflow on your router and ntop on your computer for instance.
Besides packet sniffing on your network, you could enable the web interface of uTorrent in all of them. Then going to http://192.168.1.10:8080/gui where 192.168.1.10 is your computer's IP address will give you a clue whether or not the web interface is running... If it is, so is uTorrent.