How to determine which torrents are being seeded on my network?

[dnky_bones]

Anybody know of a package that can be configured to determine what torrents are being seeded over a network firewalled by a PFS box?  I've donated bandwidth to my neighborhood wirelessly for the past 8 years or so, and recently, I've noticed traffic indicative of BitTorrent.  I installed Ntop, which confirmed my suspicions.  Under ntop, there is a section of the breakdown on the host in question under the BitTorrent section that says "unknown file".  I just want to make sure this guy isn't seeding something that will get me a nasty letter from my ISP, or worse.  Any ideas?

-M@

[tommyboy180]

If he is seeding unencrypted and using a tracker it may be possible. You may be able to capture a tracker update, but that would be very difficult since tracker updates don't happen often.
If it is encrypted or tracker less then there is no way you would be able to find out.

[dnky_bones]

Of course, but I am assuming its just the run of the mill everyman user.  So, assuming it's unencrypted….any ideas of anything easy to deploy/configure?

[GruensFroeschli]

A colleague recently wrote a python script which analyzed uTorrents upnp traffic.
Out of this he could see which client has what torrent active.
From what he said it was fairly easy.

[dnky_bones]

Interesting.  Is said colleague willing to share said script?

[GruensFroeschli]

I'll send him a mail, but he's currently out of office for a few weeks.
Might take some time.

[dnky_bones]

No worries, thanks for trying  :)

[ruz32]

Are there any updates on this question? I would also like to find out the answer to the question. :) It'll be a great help for me. Thanks in advance. :)

[GruensFroeschli]

He is back since a few weeks but i've forgotten about this thread ^^"

Attached the script.

It only works with bittorrent clients which have local peer discovery active.
Wiki says that

µTorrent, BitTorrent/Mainline, MonoTorrent, libtorrent and its derivatives, Transmission 2.0

libtorrent derivates: http://en.wikipedia.org/wiki/Libtorrent_%28Rasterbar%29#Applications
other applications using libtorrent http://www.rasterbar.com/products/libtorrent/projects.html

support it.

Da, dependencies si:
dpkt: http://code.google.com/p/dpkt/
pypcap: http://pylibpcap.sourceforge.net/

ajaxisohunt.py is to resolve the infohash into an acutal name.

ajaxisohunt.py.txt
local_discovery.py.txt