0

I read in the Bittorrent protocol that Bittorrent sends keep-alive packets of length=0 occasionally (around every two minutes) to maintain connections. I'm trying to identify these packets, so I captured all my network traffic while using uTorrent.

When I look at the packets, I see a lot of TCP packets with length=0, but they seem to be ACK packets sent in response to receiving downloaded data. Does uTorrent use keep-alive packets? If they do, how do I identify them?

Improve this question

1 Answer 1

Reset to default
0

Bittorrent does use keep-alive packets:

https://wiki.theory.org/BitTorrentSpecification#Peer_wire_protocol_.28TCP.29

To find the keep-alive packets in your caputer, I would try setting your Wireshark display filter to bittorrent.msg.length == 0 or explore the bittorrent.msg.type filter as well.

One thing to keep in mind is that there may be no keep-alive packets sent during regular traffic (there's no need to say 'I'm still here' right after successfully sending data after all) so unless you left the application idle for at least that long you may not find anything.

See this page for some more ideas for analyzing the traffic: http://www.howtogeek.com/107945/how-to-identify-network-abuse-with-wireshark/

Improve this answer
1
  • I tried leaving the application idle for around 15 minutes after the download has completed, but there are only bittorrent handshake messages, no keep-alive ones. I'm guessing this is because someone started leeching off me? On another note, another torrent file I tried didn't even have any packets with the bittorrent protocol, though I see a lot of "TCP spurious retransmission" and UDP packets with length 103, are those significant? Thanks for the help!
    – jasep
    Dec 11, 2016 at 3:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .