How to track down if someone uses torrent in local network

Question

We have a router , i have an admin password for his interface, so i can monitor LAN activity. But how can i be sure if some user behind some ip is using torrent?

Router runs on AirOS from Ubiquiti Networks , using latest firmware (updated 2 weeks ago).

Solution

From the router it could a bit awkward since if the router doesn't support protocol dissection (or L7 filtering) you would need to put some rules to specific ports/hosts (for example torrent servers) and see if they match. But this is for sure not the way to do it since it is long and would not have a complete match.

AirOS has some P2P blocking capabilities: check in Firewall Policies -> Advanced -> you can disable some P2P services. But there are very basic (mostly on DNS level)

Most probably the fastest way is to attach into the network with a packet sniffer such as Wireshark which has already protocol dissection for BitTorrent. But again it depends on the torrent user aswell if he is using just encrypted peers or hiding services.

Comments

[Ramhound]

Considering you can setup a BitTorrect client to work on any port what you describe about blocking certain ports is unlikely to be effective.

[fede.evol]

What I suggested in first place, and specified that it is not a complete solution, is to match the access to torrent servers (that is trackers). That have, at least the famous and most used ones, quite specific and "stable" addresses/ports. Of course this will just trigger when the client is fetching the peers lists and will not work for some cases (such as usage of the DHT network)

[Ruslan Voronkov]

I don't want to ban using torrent network in our local place, because sometimes it is ok to download some useful things. I want to know who are using it most and limit their speed rates or something.

[Ramhound]

@RuslanVoronkov - QOS and DPI exists for that purpose. To use both in the combination you describe requires specialized hardware though.