I have a router through which 10 PC's are connected to run internet, almost all PC's have uTorrent. I want to detect that how in many PC's uTorrent is running at a time.

Is there any way or tool through which I can detect this.



How is the router connection to the set of PCs?
If its a single link which the router will allow you to mirror,
you can run these packets through a Snort class filter to detect BitTorrent signatures.
If you cannot mirror a port, you can still plug in a 3 port hub to 'tap' the traffic to Snort.

The source IP addresses for matching packets will indicate use of BitTorrent in general (if you know its uTorrent, you have a match; but, in general I think you want to know if any bittorrent application is in use on those PCs).

This will be a passive check -- you do not need access to the PCs and those PC users will not know you are checking.
Going one step further, if you keep Snort inline (not on a mirrored path), you can also block (most) BitTorrent activities.

Once/If you setup such a system, you can leverage it for a lot of other security checks
(just read up a bit more of Snort).


I don't think you can do that, at least not by network traffic analysis.

Most BitTorrent clients allow setting random ports and using encryption when exchanging data.

Your only hope is sniffing for data exchange with trackers. If you're lucky and it proves to be regular unencrypted HTTP, you might make assumptions based on that.

  • Many internet providers detect bittorrent transmission for throttling speed, and it appears to works whether encryption and HTTPS is enabled or not. So there has to be a verifiable signature? – mtone Apr 28 '11 at 20:31

You can use a thorough nmap scan to determine what ports are open and listening. If the host is listening on high ports those might be utorrent, check utorrent docs for what ports it usually chooses, iirc they are around 40k-50k.


Scan one host, even if it doesn't reply to ping:

nmap -sS -P0 -p 1-65535

Scan all hosts that reply to ping:

nmap -sS -p 1-65535

The above example assumes your network is in the subnet. If you know the IP's of the PC's in question, feed the command all of the ip's, that will save you a lot of time. See nmap's man page for further reference.

When you have found the open ports I guess you could verify that it actually is utorrent running on them by:

telnet hostip openport

This of course also assumes that the machines are running and have utorrent running when you scan, for regular checks you could make a batch-script of the above commands and then output its result to a file.

When I think about it I am sure there are more graceful ways. Run rflow on your router and ntop on your computer for instance.

  • Where to run these commands, actually I am not a network related guy, so it'll be better for me if you can guide me where to run these commands, in "cmd" utility? I tried but its not running there, it says "unrecognized command". Please guide, thanks!! – Prashant May 26 '10 at 6:23

Yup i guess you could use wireshark for that.

  • This is really more of a comment than a solution. – fixer1234 Oct 2 '15 at 20:55

Besides packet sniffing on your network, you could enable the web interface of uTorrent in all of them. Then going to where is your computer's IP address will give you a clue whether or not the web interface is running... If it is, so is uTorrent.

  • That would assume that one has access to all those computers (for enabling the web interface), which I'm not sure it's the case. – geek May 25 '10 at 11:37
  • @geek, yes that's not the case. I don't have access to all the PC's – Prashant May 25 '10 at 12:12
  • Okay! Then I'm sorry but my answer does not apply to you ;) – Pylsa May 25 '10 at 14:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.