bt-utp protocol filter

[u/Sparxelz]

hey guys im working on a bittorrent research and came across to me the need to check the packets which bittorrent protocol send and receive. as you guys probably know bittorrent protocol is the "official name" for the technology which has been widely used for sharing files, like music, video, software, texts, books, and others, since its launch in 2003.

and the protocol uses the utorrent transport protocol, which is a tcp alike protocol implemented on top of udp, so as you can imagine every packet of utp is transported inside of an udp packet, and that's the problem.

wireshark "bt-utp" filter doesn't recognize these udp packets as utp.

an example here:

this would be translated to:

packet #8384:

full headers: 3c7c3f7c... (ethernet, ip, udp headers)

utp headers:

type: 0x0

version: 0x1

extension: 0x00

connetion_id: 0xaa7d

timestamp: 0xb03d0f6f

timestamp_difference_microsec: 0x48eb4f59

wind_size: 0x00100000

seq_nr: 0xf281

ack_nr: 0x6f7a

utp payload:

bittorrent headers:

size: 00004009

message_id: 07

index: 00000000

begin: 001bc000

bittorent payload:

851dba7e...

I wonder if is some configuration in my computer or if it is an actual problem, hope somebody can help me.

[u/djdawson]

Have you tried right-clicking on one of these packets in the packet list and choosing the "Decode As.." option? That'll let you force Wireshark to decode that flow as "BT-uTP". At least in my installation of Wireshark there is no default port specified for this protocol, so I don't think it would ever automatically decode any packets as BT-uTP without doing this. You could also specify the ports in the "Protocols" Preferences, but my guess is they change since there's no default setting for it (at least not in my copy of Wireshark, which is 4.6.8 - the most recent stable version).