Cyberbeing

The other day I was looking at PeerGuardian, and I have no idea how it handles TCP and UDP traffic logging. Posting here was an afterthought, so I hadn't checked my router firewall log (to see if it was showing the same thing as PeerGuardian) or run a network analysis tool. Since I only very rarely (once a month?) run into a client using uTP, so far I haven't cared enough to prepare myself to fully investigate when it does happen.

I hear what you're saying Ultima. Going with the small uTP packets Switeck has seen, this begins to make a bit of sense. If the UDP packets are a fraction of the size of the TCP packets, and both are logged on a per packet basis that would explain seeing so many more. The alternative of TCP being logged on a source<->destination per connection basis, and UDP on a source<->destination per packet basis, would also make sense. Either way, I expect it's going to put a lot of stress on and possibly crash any firewall which tries to log the mass UDP traffic on a per packet basis. Especially if it chooses to deal with each UDP packet as an individual connection instead of grouping them together on a source/destination/port basis (in the sense that most firewalls can only handle the processing of so many connections at once). If the developers have thoroughly tested this and don't believe this is a problem, then I will just hope for the best and see what happens when uTorrent 1.9 is released. In any case, since it sounds like 1.8.3+ and 1.9 are able to reject both incoming and outgoing uTP connections, if it becomes a problem, it's nice to know people have a way to block it as a last resort.

@Ultima It still doesn't seem normal to me for a single uTP peer to show up as making more connections (sending more packets, since you say it's connectionless) then the all of the 100+ peers on the torrent combined. For every two packets sent from the entire swarm, these single misbehaving uTP clients are sending ten or more. I have a hard time believing that a single uTP IP sending something like 5 times as many packets as the entire swarms from multiple torrents is normal. What I am suspecting is uTP clients over a high latency, low bandwidth link are flooding me with very, very, very, very small udp packets. It seems the release notes mention variable packet size, so if there is no minimum size, this seems to make the most sense to me as the IP doing this yesterday was from Malaysia. If not that, could someone be exploiting the uTP advanced settings to send an excessive amount of packets? In any case, you better make sure this is not a bug, since I'm unsure how well most consumer gear (e.g. NAT) will handle being flooded with 100,000+ udp packets/sec when uTorrent 1.9 goes mainstream and everybody is using uTP.

The peer was connected and was shown as uTorrent 1.9 [utp]. I'm not too familiar with how uTP is supposed to work, but I'm referring to udp connections. I have no idea what sort of data was contained in those connections since I haven't analyzed the traffic. All I know is an excessive number of udp connections were being made in an extremely short about of time, all of which were coming from a single uTP client IP address. This is now the third time I've seen this happen with uTorrent 1.9 uTP clients. Most seem to behave but some go crazy and flood me with udp connections which stands out like a sore thumb. I already had bt.transp_disposition set to 0 (TCP only) in 1.8.2, and that doesn't prevent what I am seeing since it is only for outgoing connections and these are incoming connections.

I've noticed that at times when uTorrent 1.9 clients with uTP enabled connect to me (I use 1.8.2) they send something crazy like 100+ udp connections per second for as long as they are connected. Is this expected behavior? If uTP is going to flood people with udp packets in a DoS like manner, you should consider adding an option to block uTP in uTorrent 1.8.x.