Why is uTorrent downloading w/o any active torrents?

[pkx]

It's maxing out my internet connection. I've even disabled DHT - same thing.

[Switeck]

Turn on the LOGGER features in the logger tab...gotta be SOME traffic there that will explain the activity!

[Firon]

Seems to me like you're getting DDoSed...

[pkx]

Thanks for the reply Switeck & Firon,

I'm completely stumped. I selected a new port for uTorrent and turned uPNP and NAT PMP portmapping OFF. I went into my broadband router and turned all port forwarding OFF. My PC is on a NAT'd IP. There is no way any traffic should be getting in.

Here's a new screen shot taken after logging was turned on and uTorrent was restarted. When this screen shot was taken, uTorrent had only been running for 2-3 mins - it's already downloaded 160mb! ...with no log entries!! My internet connection slows to a crawl until I shut down uTorrent.

Any other ideas?

[Switeck]

Check your router logs for what ips are connecting to your computer.

...I admit something EXTREMELY WEIRD is going on, so anything I say is likely to be only marginally helpful at best!

You may need to reset µTorrent's settings.

(Copy them down first, possibly using screenshots or copy-and-paste to a text file.)

There may be an obscure loopback bug with firewall detection, and µTorrent is in a sense DoS attacking itself. ...But that's the 'best guess' I have at the moment for that behavior.

TCP view (or NETSTAT -n using CMD prompt) may also clue you into what ip/s are doing this.

...Another thought: Try disabling DHT completely and then restarting µTorrent.

[Haruk]

I have also always had this problem! I thought it was a just a bug, but just recently I found that it really is downloading something, even sometimes it says it's uploading something!

[Invy]

How can you be downloading if you have 0 torrents in uTorrent. o_O

[Firon]

Try disabling local peer discovery and ensure that the webui and bt.enable_tracker are disabled...

[Honeyfrog]

Install Peer Guardian 2 (remove it later, if you like) and log all the traffic; at least you'll see who's connecting to you.

[Switeck]

Something else to try is the latest v1.8 alpha build.

My guess is it's a very obscure bug in µTorrent coupled with VERY strange networking conditions...but without LOTS more info, we can only guess.

[pkx]

I got around to spending a bit more time troubleshooting this... First, I upgraded to the latest 1.8 alpha - no change - problem still occurring.

I then ran a netstat -a and found a bunch of active HTTP sessions open to a host at cachefly.com. I remembered that they are a diggnation sponsor and I have a few revision3.com RSS feeds set up in utorrent. I disabled them (un-checked them) and restarted utorrent - it was still using all my bandwidth! I then completely removed them and restarted again - voila, no problems.

Seems like a very obscure bug in the RSS module?

[Firon]

It must've been downloading -something- from the feed.

[Greg Hazel]

If you post the feed url, or better yet a snapshot of the feed while the problem is occuring, I can try to track down why it's downloading so much.

[pkx]

Here you go.. I was able to re-add the feed and the problem did reoccur. I simply added this then told it to update the feed. As you can see, nothing is downloading and it's still using up all my bandwidth.

[Switeck]

Does the MASSIVE download problem go away when you remove that feed?

Did you ever check to see what ips are actually connecting to your computer?

(We can't rule out hostiles at this point!)

[pkx]

The massive downloading goes away when I remove the feed *then* restart utorrent.

netstat shows that its all HTTP connections to cachefly.com (revision3.com's caching serving company.....). Once I shut down utorrent, the connections go away..

[Firon]

That's not the .torrent feed... http://revision3.com/diggnation/feed/xvid-large.torrent is.

You're telling µtorrent to download all the xvids, not the torrent files.

[pkx]

Hm.. so why is it downloading them without showing me that its downloading anything?

[Ultima]

Because µTorrent is attempting to download whatever is in the enclosure. µTorrent can't tell whether what it downloads is a .torrent file or not until it actually finishes downloading it and attempting to load it. It won't show that it's downloading anything until it finishes getting the referenced file and attempting to load it. In the case of the feed you're using, it's attempting to download the entire .AVI file before it can tell whether it's a proper .torrent file. Why not check by extension? Because extension doesn't tell everything, and not every .torrent file needs to have .torrent in the URL (think PHP redirects, for example). The former is the case with the RSS feed that Firon posted as well -- its extension is .torrent, but it's actually an RSS feed.