Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a router through which 10 PC's are connected to run internet, almost all PC's have uTorrent. I want to detect that how in many PC's uTorrent is running at a time.

Is there any way or tool through which I can detect this.


share|improve this question

How is the router connection to the set of PCs?
If its a single link which the router will allow you to mirror,
you can run these packets through a Snort class filter to detect BitTorrent signatures.
If you cannot mirror a port, you can still plug in a 3 port hub to 'tap' the traffic to Snort.

The source IP addresses for matching packets will indicate use of BitTorrent in general (if you know its uTorrent, you have a match; but, in general I think you want to know if any bittorrent application is in use on those PCs).

This will be a passive check -- you do not need access to the PCs and those PC users will not know you are checking.
Going one step further, if you keep Snort inline (not on a mirrored path), you can also block (most) BitTorrent activities.

Once/If you setup such a system, you can leverage it for a lot of other security checks
(just read up a bit more of Snort).

share|improve this answer

I don't think you can do that, at least not by network traffic analysis.

Most BitTorrent clients allow setting random ports and using encryption when exchanging data.

Your only hope is sniffing for data exchange with trackers. If you're lucky and it proves to be regular unencrypted HTTP, you might make assumptions based on that.

share|improve this answer
Many internet providers detect bittorrent transmission for throttling speed, and it appears to works whether encryption and HTTPS is enabled or not. So there has to be a verifiable signature? – mtone Apr 28 '11 at 20:31

You can use a thorough nmap scan to determine what ports are open and listening. If the host is listening on high ports those might be utorrent, check utorrent docs for what ports it usually chooses, iirc they are around 40k-50k.


Scan one host, even if it doesn't reply to ping:

nmap -sS -P0 -p 1-65535

Scan all hosts that reply to ping:

nmap -sS -p 1-65535

The above example assumes your network is in the subnet. If you know the IP's of the PC's in question, feed the command all of the ip's, that will save you a lot of time. See nmap's man page for further reference.

When you have found the open ports I guess you could verify that it actually is utorrent running on them by:

telnet hostip openport

This of course also assumes that the machines are running and have utorrent running when you scan, for regular checks you could make a batch-script of the above commands and then output its result to a file.

When I think about it I am sure there are more graceful ways. Run rflow on your router and ntop on your computer for instance.

share|improve this answer
Where to run these commands, actually I am not a network related guy, so it'll be better for me if you can guide me where to run these commands, in "cmd" utility? I tried but its not running there, it says "unrecognized command". Please guide, thanks!! – Prashant May 26 '10 at 6:23

Yup i guess you could use wireshark for that.

share|improve this answer
This is really more of a comment than a solution. – fixer1234 Oct 2 '15 at 20:55

Besides packet sniffing on your network, you could enable the web interface of uTorrent in all of them. Then going to where is your computer's IP address will give you a clue whether or not the web interface is running... If it is, so is uTorrent.

share|improve this answer
That would assume that one has access to all those computers (for enabling the web interface), which I'm not sure it's the case. – geek May 25 '10 at 11:37
@geek, yes that's not the case. I don't have access to all the PC's – Prashant May 25 '10 at 12:12
Okay! Then I'm sorry but my answer does not apply to you ;) – BloodPhilia May 25 '10 at 14:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .