Download BETTER Do Bittorrent
Pirjo Unzicker
A trackerless torrent dictionary does not have an "announce" key. Instead, a trackerless torrent has a "nodes" key. This key should be set to the K closest nodes in the torrent generating client's routing table. Alternatively, the key could be set to a known good node such as one operated by the person generating the torrent. Please do not automatically add "router.bittorrent.com" to torrent files or automatically add this node to clients routing tables.
The first one does the file-sharing: A swarm in bittorrent lingo is a group of peers sharing a bittorrent object (e.g. a file or directory structure). Each bittorent object has some metadata that is saved in a .torrent-file. (It includes object size, name of folder, possibly tracker information or nodes. ect.)The hash of the metadata required to download this bittorrent object is called the infohash.
The DHT basically is a second P2P application aiming to replace trackers: It stores pairs of (infohash, swarm) and updates the swarm if it receives announce messages. A new client must have knowledge of some "node" (bittorrent lingo for a peer of the DHT) to bootstrap its information of the DHT. Here the arguments given by @allquixotic apply. As the MDHT currently consists of over 7 million peers a sustained denial of service attack seems unlikely.
Field name Description Type Versions bittorrent.azureus_msgAzureus MessageLabel1.0.0 to 4.2.0 bittorrent.bdictDictionaryLabel1.0.0 to 1.10.14 bittorrent.bdict.entryEntryLabel1.0.0 to 1.10.14 bittorrent.bintIntegerSigned integer (32 bits)1.0.0 to 1.10.14 bittorrent.blistListLabel1.0.0 to 1.10.14 bittorrent.bstrStringCharacter string1.0.0 to 1.10.14 bittorrent.bstr.lengthString LengthUnsigned integer (32 bits)1.0.0 to 1.10.14 bittorrent.continuous_dataExtended MessageByte sequence2.0.0 to 4.2.0 bittorrent.extendedExtended MessageByte sequence1.6.0 to 4.2.0 bittorrent.extended.idExtended Message IDUnsigned integer (8 bits)4.0.0 to 4.2.0 bittorrent.info_hashSHA1 Hash of info dictionaryByte sequence1.0.0 to 4.2.0 bittorrent.jpc.addrCache AddressCharacter string1.0.0 to 4.2.0 bittorrent.jpc.addr.lengthCache Address LengthUnsigned integer (32 bits)1.0.0 to 4.2.0 bittorrent.jpc.portPortUnsigned integer (32 bits)1.0.0 to 4.2.0 bittorrent.jpc.sessionSession IDUnsigned integer (32 bits)1.0.0 to 4.2.0 bittorrent.lengthField LengthUnsigned integer (32 bits)1.0.0 to 1.8.15 bittorrent.msgMessageLabel1.0.0 to 4.2.0 bittorrent.msg.aztypeMessage TypeCharacter string1.0.0 to 4.2.0 bittorrent.msg.bitfieldBitfield dataByte sequence1.0.0 to 4.2.0 bittorrent.msg.lengthMessage LengthUnsigned integer (32 bits)1.0.0 to 4.2.0 bittorrent.msg.prioMessage PriorityUnsigned integer (8 bits)1.0.0 to 4.2.0 bittorrent.msg.typeMessage TypeUnsigned integer (8 bits)1.0.0 to 4.2.0 bittorrent.msg.typelenMessage Type LengthUnsigned integer (32 bits)1.0.0 to 4.2.0 bittorrent.peer_idPeer IDByte sequence1.0.0 to 4.2.0 bittorrent.piece.beginBegin offset of pieceUnsigned integer (32 bits)1.0.0 to 4.2.0 bittorrent.piece.dataData in a pieceByte sequence1.0.0 to 4.2.0 bittorrent.piece.indexPiece indexUnsigned integer (32 bits)1.0.0 to 4.2.0 bittorrent.piece.lengthPiece LengthUnsigned integer (32 bits)1.0.0 to 4.2.0 bittorrent.portPortUnsigned integer (16 bits)1.6.0 to 4.2.0 bittorrent.protocol.nameProtocol NameCharacter string1.0.0 to 4.2.0 bittorrent.protocol.name.lengthProtocol Name LengthUnsigned integer (8 bits)1.0.0 to 4.2.0 bittorrent.reservedReserved Extension BytesByte sequence1.0.0 to 4.2.0 bittorrent.versionClient versionCharacter string2.0.0 to 4.2.0
Due to the way the Palo Alto Networks firewall handles detection of p2p apps, the user may see a confusing startlog indicating that bittorrent is allowed, even though a deny rule is in place and the traffic is actually denied. The following is an explanation of how the detection works.
For many of the p2p apps and skype we use predict-flow to predict some sessions based on other sessions. With bittorrent for example, we predict many of the TCP sessions based on the UDP sessions, and for emule, one UDP session predicts many other emule UDP sessions. The predict happens as part of the decoder for the app.
While the traffic is identified as bittorrent, if the user has start log enabled and the action is set to deny for bittorrent, two logs will show up for those UDP sessions. One log saying bittorrent, allow (the one that is getting reported for bit-internal), and the other one saying bittorrent, drop.
f5d0e4f075