How many uTorrent clients are running in a network?

Question

I have a router through which 10 PC's are connected to run internet, almost all PC's have uTorrent. I want to detect that how in many PC's uTorrent is running at a time.

Is there any way or tool through which I can detect this.

Thanks

Answer 1

How is the router connection to the set of PCs?
If its a single link which the router will allow you to mirror,
you can run these packets through a Snort class filter to detect BitTorrent signatures.
^{If you cannot mirror a port, you can still plug in a 3 port hub to 'tap' the traffic to Snort.}

The source IP addresses for matching packets will indicate use of BitTorrent in general (if you know its uTorrent, you have a match; but, in general I think you want to know if any bittorrent application is in use on those PCs).

This will be a passive check -- you do not need access to the PCs and those PC users will not know you are checking.
^{Going one step further, if you keep Snort inline (not on a mirrored path), you can also block (most) BitTorrent activities.}

• Here is a recent presentation on details of Detecting BitTorrent using Snort (PDF file).
• Another Wiki reference to O'Reilly Snort Cookbook on BitTorrent detection.
• Oldish article on setting up Snort
• Cisco/Juniper span-port (port mirroring) reference (your platform may be different)

Once/If you setup such a system, you can leverage it for a lot of other security checks
(just read up a bit more of Snort).

Answer 2

I don't think you can do that, at least not by network traffic analysis.

Most BitTorrent clients allow setting random ports and using encryption when exchanging data.

Your only hope is sniffing for data exchange with trackers. If you're lucky and it proves to be regular unencrypted HTTP, you might make assumptions based on that.

Answer 3

You can use a thorough nmap scan to determine what ports are open and listening. If the host is listening on high ports those might be utorrent, check utorrent docs for what ports it usually chooses, iirc they are around 40k-50k.

Examples:

Scan one host, even if it doesn't reply to ping:

nmap -sS -P0 -p 1-65535 192.168.0.12

Scan all hosts that reply to ping:

nmap -sS -p 1-65535 192.168.0.0/24

The above example assumes your network is in the 192.168.0.0/24 subnet. If you know the IP's of the PC's in question, feed the command all of the ip's, that will save you a lot of time. See nmap's man page for further reference.

When you have found the open ports I guess you could verify that it actually is utorrent running on them by:

telnet hostip openport

This of course also assumes that the machines are running and have utorrent running when you scan, for regular checks you could make a batch-script of the above commands and then output its result to a file.

When I think about it I am sure there are more graceful ways. Run rflow on your router and ntop on your computer for instance.

Answer 4

Yup i guess you could use wireshark for that.

Answer 5

Besides packet sniffing on your network, you could enable the web interface of uTorrent in all of them. Then going to http://192.168.1.10:8080/gui where 192.168.1.10 is your computer's IP address will give you a clue whether or not the web interface is running... If it is, so is uTorrent.

Answer 6

This application somewhat has a feature you may be looking for: http://forum.utorrent.com/viewtopic.php?id=73450