Wireshark-dev: [Wireshark-dev] Torrent traffic lookup
From: Johannes Buchner <buchner.johannes@xxxxxx>
Date: Wed, 19 Sep 2007 23:47:54 +0200
Hi! 

If I have a bittorrent tracker package, like the appended, it would be
cool to have a feature to find out what torrent it is (e.g. torrent file
name). Of course, with the info_hash being a hash, this is not so easy. 

At [0] you can find a reverse info_hash database I made from 12000 of
the most popular torrents from The Pirate Bay. A lot (if not most) of
the torrent tracker traffic should be distinguishable, and it is not
that big (1.3M). 

Also, a howto is linked there for making such a database. 

Tell me what you think, 
Johannes


[0] http://twoday.tuwien.ac.at/jo/stories/305252/
PS: The utilities I used are not optimized for calculation speed
Bittorrent tracker packet example. 

[cEh9@@^R>.5\G
h@M;GET http://vip.tracker.thepiratebay.org/announce?info_hash=91t%90p%
D5%BC%0F%E9%CD%CE%CE9%BD%F7%A4%19%A5%E5%
8E&peer_id=-AZ2504-12G14xvFnkNL&supportcrypto=1&port=20640&azudp=20640&uploaded=114339239&downloaded=78866513&left=321912832&numwant=100&no_peer_id=1&compact=1&key=MOfuvbDY&azver=3 HTTP/1.1
User-Agent: Azureus 2.5.0.4;Linux;Java 1.5.0_12
Connection: close
Accept-Encoding: gzip
Proxy-authorization: Basic bGhzMDI6bGhzMDI=
Host: vip.tracker.thepiratebay.org
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Proxy-Connection: keep-alive


Attachment: signature.asc
Description: This is a digitally signed message part