|
Torrents start by searching for peers using a certain port range, I think it's like 6881-6999. However they can negotiate sessions over TCP or UDP on other ports; thereby making it very difficult to follow them.
What is your intention here? To stop this, to protect against improper network usage, to avoid excessive use of your network by torrents, or to monitor activities in a proactive manner and determine which torrents are work related versus which are improper network use?
I don't think you can make that last determination if that's your intention. I do understand that torrent use is beneficial for people who need to download large data or release images; however as of late, with companies generally blocking peer to peer sessions many legal and acceptable large download servers now support other methods besides torrent so as to allow users to obtain information and releases without using torrent.
There really are two ways to identify the hosts using torrent. Trace on the ports which fit within the initial torrent negotiation ranges and this will identify the hosts using torrents. Hosts which are not configured nicely to restrict their network use will stand out as taking a great deal of bandwidth. And those hosts will also potentially have a great deal of peer to peer sessions, if you can detect those.
I believe if you block the initial torrent port ranges, then what will happen is users of torrent will not be able to establish sessions with peers and then be unable to move their P2P sessions to other ports beyond your scope of tracing and/or control.
|
