BitTorrent Client Recognition Software

[Klaus_1250]

Does anyone know if there is a utility that can listen on BT-ports and list the clients/user-agents that are sending data to BT-ports? (or have a mechanism to discover the clients user-agent)

I use DHT in µTorrent, but find that this leads to a continous stream of DHT-traffic many days after using DHT. I'm wondering which programs/clients are actually behaving like that or better, if it is one or several applications which are bugged somehow. It could also be that the traffic is related to anti-p2p or some other malicious groups of users, but right now, I don't have a clue.

PS: I'm not looking for such functionality that is implemented in a BitTorrent-client. I'm looking for something I can run when BitTorrent (µTorrent) is not running/active.

[Firon]

I get a lot of anti-P2P hits on DHT (PG2 lists UDP blocks constantly), but there's not much you can do about it. There's also buggy clients. If you have a firewall, it may be blocking ICMPs (which can also be the cause of so much excessive traffic).

[Switeck]

I spotted lots of incoming TCP/IP connections on my router logs on my BitTorrent ip ports. I switched a few times, and still see traffic on ports I used days/weeks ago. I was wondering about the cause of the traffic too.

Thanks for shedding some light on this.

[Klaus_1250]

I specifically do not block ICMP's, such as many firewall (including the built-in Windows Firewall) do, so that's not the cause. I don't think many p2p-programs use ICMP anyway :-(

Some of the hits are indeed blocked by Peerguardian, but only a very small minority. What I did notice is that a good portion of hits seem to come from China. I know a lot of 'attacks' originate from China, but it are just too many (I think).

So I was wondering if a particulair BT-client was very populair there, but I need to connect to them to figure it out.

[splintax]

I switched a few times, and still see traffic on ports I used days/weeks ago. I was wondering about the cause of the traffic too.

if it's an outgoing connection then you don't control the port it runs on.. it is to whatever port the recipient has open