<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	
	>
<channel>
	<title>Comments on: Monitoring BitTorrent Activity on a Network Using WireShark</title>
	<atom:link href="https://torrentfreak.com/monitoring-bittorrent-activity-on-a-network-using-wireshark-130612/feed/" rel="self" type="application/rss+xml" />
	<link>https://torrentfreak.com/monitoring-bittorrent-activity-on-a-network-using-wireshark-130612/</link>
	<description>Breaking File-sharing, Copyright and Privacy News</description>
	<lastBuildDate>Wed, 29 Oct 2014 11:00:22 +0000</lastBuildDate>
		<sy:updatePeriod>hourly</sy:updatePeriod>
		<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.9.2</generator>
	<item>
		<title>By: T T</title>
		<link>/monitoring-bittorrent-activity-on-a-network-using-wireshark-130612/#comment-1122952</link>
		<dc:creator><![CDATA[T T]]></dc:creator>
		<pubDate>Sun, 18 Aug 2013 04:28:00 +0000</pubDate>
		<guid isPermaLink="false">http://torrentfreak.com/?p=71889#comment-1122952</guid>
		<description><![CDATA[Well if you are the administrator for one of these switches, you can easily mirror (probably the wrong terminology) the port headed out towards the internet. You could also sit in between the the switch and gateway. This of course assumes you have some administrative rights.]]></description>
		<content:encoded><![CDATA[<p>Well if you are the administrator for one of these switches, you can easily mirror (probably the wrong terminology) the port headed out towards the internet. You could also sit in between the the switch and gateway. This of course assumes you have some administrative rights.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Clownius</title>
		<link>/monitoring-bittorrent-activity-on-a-network-using-wireshark-130612/#comment-1095960</link>
		<dc:creator><![CDATA[Clownius]]></dc:creator>
		<pubDate>Fri, 21 Jun 2013 16:15:00 +0000</pubDate>
		<guid isPermaLink="false">http://torrentfreak.com/?p=71889#comment-1095960</guid>
		<description><![CDATA[It doesn&#039;t use 100% of your CPU 100% of the time it uses 100% of your CPU for fractions of time.  If you want to get really silly about it.


Of course we often talk about a % CPU usage   Every OS even lists it.  what it means is what percentage of time the CPU is in use.


Seriously no one gives a crap if you say 5% CPU use or 100% of CPU use 5% of the time.  Its just a useless distinction made by someone trying to look smart.]]></description>
		<content:encoded><![CDATA[<p>It doesn&#8217;t use 100% of your CPU 100% of the time it uses 100% of your CPU for fractions of time.  If you want to get really silly about it.</p>
<p>Of course we often talk about a % CPU usage   Every OS even lists it.  what it means is what percentage of time the CPU is in use.</p>
<p>Seriously no one gives a crap if you say 5% CPU use or 100% of CPU use 5% of the time.  Its just a useless distinction made by someone trying to look smart.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Clownius</title>
		<link>/monitoring-bittorrent-activity-on-a-network-using-wireshark-130612/#comment-1095958</link>
		<dc:creator><![CDATA[Clownius]]></dc:creator>
		<pubDate>Fri, 21 Jun 2013 16:11:00 +0000</pubDate>
		<guid isPermaLink="false">http://torrentfreak.com/?p=71889#comment-1095958</guid>
		<description><![CDATA[I see your one of the Private trackers are evil crowd.  If thats your thing so be it.


But ask people trying to maintain a ratio (because its required or they are just good sharers) how well 3.3 is going for them.


We get regular complaints about never getting connected to seeds using 3.3 and switching back to 3.2.3 and suddenly they share just fine again.  Guess what the problem might by.  The only change was client version.


But it must be a user setting im sure......


The other common complaint is with file allocation where disk use hits 100% and the client locks up.


But heck keep telling yourself client doesnt matter.]]></description>
		<content:encoded><![CDATA[<p>I see your one of the Private trackers are evil crowd.  If thats your thing so be it.</p>
<p>But ask people trying to maintain a ratio (because its required or they are just good sharers) how well 3.3 is going for them.</p>
<p>We get regular complaints about never getting connected to seeds using 3.3 and switching back to 3.2.3 and suddenly they share just fine again.  Guess what the problem might by.  The only change was client version.</p>
<p>But it must be a user setting im sure&#8230;&#8230;</p>
<p>The other common complaint is with file allocation where disk use hits 100% and the client locks up.</p>
<p>But heck keep telling yourself client doesnt matter.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Baneki Privacy Labs</title>
		<link>/monitoring-bittorrent-activity-on-a-network-using-wireshark-130612/#comment-1094227</link>
		<dc:creator><![CDATA[Baneki Privacy Labs]]></dc:creator>
		<pubDate>Tue, 18 Jun 2013 10:18:00 +0000</pubDate>
		<guid isPermaLink="false">http://torrentfreak.com/?p=71889#comment-1094227</guid>
		<description><![CDATA[You can ask wireshark to store only packets meeting certain criteria, or only the header info in packets (which is rather handy, in that &#039;metadata&#039; can say a great deal all by itself), and so on. Yes, doing full packet capture can generate gigs of tcap logfiles rather quickly.. but it&#039;s possible to do quite a bit of analysis with a much smaller sample than that.

It&#039;s nice to see wireshark being discussed a bit more, outside of a purely technical context. A thought experiment we suggest to activists concerned with their online security is this: imagine that someone&#039;s sitting just &#039;outside&#039; of your physical network adapter, running tcpdump/wireshark and capturing every packet leaving your machine. What will that logfile look like? What information is available in it, were a determined adversary to sit at a console and do some serious work at understanding what it contains?

That&#039;s an excellent &#039;Gedankenexperiment&#039; despite the fact that, definitionally, it&#039;s an unlikely attack vector in purely practical terms. That is, if one can say with confidence that even an attacker sitting on the other side of one&#039;s network adapter wouldn&#039;t get anything compromising from that packet traffic, one has in place some reasonably competent network security at a baseline level. Conversely, if one can&#039;t &quot;visualize&quot; the concepts in question, it&#039;s perhaps a good indicator that more work understanding these concepts would be constructive.



There&#039;s plenty of tools that will/would subvert such an attack scenario, and do so elegantly. First and foremost, a competent, serious VPN service will result in that packet stream leaving from (and arriving to) the local machine is shorn both of useful payload data _and_ useful header/metadata. That&#039;s a rather impressive traffic profile to present to the world. 


(note of course that if someone could run wireshark on one&#039;s local machine, then such an attacker would definitionally have escalated local OS access and the packet stream being encrypted or not would be irrelevant given that access: that&#039;s why it&#039;s a thought experiment, and not really an attack scenario one would expect to see in the wild)]]></description>
		<content:encoded><![CDATA[<p>You can ask wireshark to store only packets meeting certain criteria, or only the header info in packets (which is rather handy, in that &#8216;metadata&#8217; can say a great deal all by itself), and so on. Yes, doing full packet capture can generate gigs of tcap logfiles rather quickly.. but it&#8217;s possible to do quite a bit of analysis with a much smaller sample than that.</p>
<p>It&#8217;s nice to see wireshark being discussed a bit more, outside of a purely technical context. A thought experiment we suggest to activists concerned with their online security is this: imagine that someone&#8217;s sitting just &#8216;outside&#8217; of your physical network adapter, running tcpdump/wireshark and capturing every packet leaving your machine. What will that logfile look like? What information is available in it, were a determined adversary to sit at a console and do some serious work at understanding what it contains?</p>
<p>That&#8217;s an excellent &#8216;Gedankenexperiment&#8217; despite the fact that, definitionally, it&#8217;s an unlikely attack vector in purely practical terms. That is, if one can say with confidence that even an attacker sitting on the other side of one&#8217;s network adapter wouldn&#8217;t get anything compromising from that packet traffic, one has in place some reasonably competent network security at a baseline level. Conversely, if one can&#8217;t &#8220;visualize&#8221; the concepts in question, it&#8217;s perhaps a good indicator that more work understanding these concepts would be constructive.</p>
<p>There&#8217;s plenty of tools that will/would subvert such an attack scenario, and do so elegantly. First and foremost, a competent, serious VPN service will result in that packet stream leaving from (and arriving to) the local machine is shorn both of useful payload data _and_ useful header/metadata. That&#8217;s a rather impressive traffic profile to present to the world. </p>
<p>(note of course that if someone could run wireshark on one&#8217;s local machine, then such an attacker would definitionally have escalated local OS access and the packet stream being encrypted or not would be irrelevant given that access: that&#8217;s why it&#8217;s a thought experiment, and not really an attack scenario one would expect to see in the wild)</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Baneki Privacy Labs</title>
		<link>/monitoring-bittorrent-activity-on-a-network-using-wireshark-130612/#comment-1094221</link>
		<dc:creator><![CDATA[Baneki Privacy Labs]]></dc:creator>
		<pubDate>Tue, 18 Jun 2013 10:07:00 +0000</pubDate>
		<guid isPermaLink="false">http://torrentfreak.com/?p=71889#comment-1094221</guid>
		<description><![CDATA[Good points, and thanks for confirmation that even a switched network wouldn&#039;t provide comprehensive frame/packet visibility. 

We do notice folks sometimes assuming magical powers when it comes to wireshark. Alas, it can&#039;t capture packets unless it&#039;s in the right topological position on the network. That&#039;s usually the tricky part...]]></description>
		<content:encoded><![CDATA[<p>Good points, and thanks for confirmation that even a switched network wouldn&#8217;t provide comprehensive frame/packet visibility. </p>
<p>We do notice folks sometimes assuming magical powers when it comes to wireshark. Alas, it can&#8217;t capture packets unless it&#8217;s in the right topological position on the network. That&#8217;s usually the tricky part&#8230;</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Pft.</title>
		<link>/monitoring-bittorrent-activity-on-a-network-using-wireshark-130612/#comment-1094174</link>
		<dc:creator><![CDATA[Pft.]]></dc:creator>
		<pubDate>Tue, 18 Jun 2013 07:11:00 +0000</pubDate>
		<guid isPermaLink="false">http://torrentfreak.com/?p=71889#comment-1094174</guid>
		<description><![CDATA[&quot;If you torrent client cant handle choosing what to upload/download it wont.&quot;


No computer program does that without using 100% of your CPU. You apparently don&#039;t know anything about low level language functions either.]]></description>
		<content:encoded><![CDATA[<p>&#8220;If you torrent client cant handle choosing what to upload/download it wont.&#8221;</p>
<p>No computer program does that without using 100% of your CPU. You apparently don&#8217;t know anything about low level language functions either.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Anon</title>
		<link>/monitoring-bittorrent-activity-on-a-network-using-wireshark-130612/#comment-1094172</link>
		<dc:creator><![CDATA[Anon]]></dc:creator>
		<pubDate>Tue, 18 Jun 2013 07:09:00 +0000</pubDate>
		<guid isPermaLink="false">http://torrentfreak.com/?p=71889#comment-1094172</guid>
		<description><![CDATA[The adverts and statistics are a side effect of, not the intenet of, the software. i.e. it isn&#039;t adware or spyware.


Your computer and your voice are the exact same. If you&#039;d stop running porn.avi.exe and stop shouting, you&#039;d &quot;disable&quot; the unwanted behaviors.]]></description>
		<content:encoded><![CDATA[<p>The adverts and statistics are a side effect of, not the intenet of, the software. i.e. it isn&#8217;t adware or spyware.</p>
<p>Your computer and your voice are the exact same. If you&#8217;d stop running porn.avi.exe and stop shouting, you&#8217;d &#8220;disable&#8221; the unwanted behaviors.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Anon</title>
		<link>/monitoring-bittorrent-activity-on-a-network-using-wireshark-130612/#comment-1094171</link>
		<dc:creator><![CDATA[Anon]]></dc:creator>
		<pubDate>Tue, 18 Jun 2013 07:08:00 +0000</pubDate>
		<guid isPermaLink="false">http://torrentfreak.com/?p=71889#comment-1094171</guid>
		<description><![CDATA[It&#039;s neither adware nor spyware, and the advertising functions are disablable. The statistics sending is as well.

The adverts and statistics are a side effect of, not the intenet of, the software. i.e. it isn&#039;t adware or spyware.]]></description>
		<content:encoded><![CDATA[<p>It&#8217;s neither adware nor spyware, and the advertising functions are disablable. The statistics sending is as well.</p>
<p>The adverts and statistics are a side effect of, not the intenet of, the software. i.e. it isn&#8217;t adware or spyware.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Anon</title>
		<link>/monitoring-bittorrent-activity-on-a-network-using-wireshark-130612/#comment-1094170</link>
		<dc:creator><![CDATA[Anon]]></dc:creator>
		<pubDate>Tue, 18 Jun 2013 07:06:00 +0000</pubDate>
		<guid isPermaLink="false">http://torrentfreak.com/?p=71889#comment-1094170</guid>
		<description><![CDATA[The entire network being switched wouldn&#039;t matter, as a switch doesn&#039;t give you every frame sent by every host. That&#039;s a repeater or a hub, which aren&#039;t even built anymore.


nmap wouldn&#039;t help you do anything other than see how many hosts are on the local network and what ports they&#039;re advertising. Good luck getting scanning all ports above 1024, or even ports in the 6000-7000 range for 254 hosts just to see who is using a BitTorrent client- maybe- possibly- potentially- I guess.]]></description>
		<content:encoded><![CDATA[<p>The entire network being switched wouldn&#8217;t matter, as a switch doesn&#8217;t give you every frame sent by every host. That&#8217;s a repeater or a hub, which aren&#8217;t even built anymore.</p>
<p>nmap wouldn&#8217;t help you do anything other than see how many hosts are on the local network and what ports they&#8217;re advertising. Good luck getting scanning all ports above 1024, or even ports in the 6000-7000 range for 254 hosts just to see who is using a BitTorrent client- maybe- possibly- potentially- I guess.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Ben Jones</title>
		<link>/monitoring-bittorrent-activity-on-a-network-using-wireshark-130612/#comment-1093942</link>
		<dc:creator><![CDATA[Ben Jones]]></dc:creator>
		<pubDate>Mon, 17 Jun 2013 19:06:00 +0000</pubDate>
		<guid isPermaLink="false">http://torrentfreak.com/?p=71889#comment-1093942</guid>
		<description><![CDATA[Like me?
Sure it can have a factor in one way - if your settings are bad, recent versions have a lower tollerance for it. But the speed slowdown is not caused by the client, but by the bad settings the USER has decided on.


With settings appropriate for the linespeed, client really doesn&#039;t matter.


You might want to remember something - this is what we do. As many times as we&#039;ve heard the &#039;client matters&#039;, do you THINK we haven&#039;t checked it out? Set up test swarms, and checked things for ourselves?
Or do you think we just accept the word of random comments left on youtube and activity-monitoring (aka &#039;private&#039;) trackers by people who have no idea what they&#039;re talking about?


Think on that, eh?]]></description>
		<content:encoded><![CDATA[<p>Like me?<br />
Sure it can have a factor in one way &#8211; if your settings are bad, recent versions have a lower tollerance for it. But the speed slowdown is not caused by the client, but by the bad settings the USER has decided on.</p>
<p>With settings appropriate for the linespeed, client really doesn&#8217;t matter.</p>
<p>You might want to remember something &#8211; this is what we do. As many times as we&#8217;ve heard the &#8216;client matters&#8217;, do you THINK we haven&#8217;t checked it out? Set up test swarms, and checked things for ourselves?<br />
Or do you think we just accept the word of random comments left on youtube and activity-monitoring (aka &#8216;private&#8217;) trackers by people who have no idea what they&#8217;re talking about?</p>
<p>Think on that, eh?</p>
]]></content:encoded>
	</item>
</channel>
</rss>
