BitTorrent protocol encryption: Difference between revisions

Revision as of 10:01, 21 December 2019

Revision as of 15:55, 3 April 2020

Line 46:

Analysis of the BitTorrent protocol encryption (a.k.a. MSE) has shown that statistical measurements of packet sizes and packet directions of the first 100 packets in a TCP session can be used to identify the obfuscated protocol with over 96% accuracy.<ref name="breaking">{{cite web|url=http://www.iis.se/docs/hjelmvik_breaking.pdf|title=Breaking and Improving Protocol Obfuscation |last1=Hjelmvik |first1=Erik |last2=John |first2=Wolfgang |date=2010-07-27 |publisher=Department of Computer Science and Engineering, [[Chalmers University of Technology]] |issn=1652-926X}}</ref>

The [[Sandvine]] application uses a different approach to disrupt BitTorrent traffic by making seeding impossible. Sandvine intercepts peer-to-tracker communication to identify peers based on the IP address and port numbers in the peer list returned from the tracker. When Sandvine later sees connections to peers in the intercepted peer lists, it may (according to policy) break these connections by sending counterfeit TCP resets. Various solutions exist to protect against Sandvine's attack including encrypting both peer-to-tracker and peer-to-peer communication, using Microsoft's [[Teredo tunneling|Teredo]] so that TCP connections are tunneled within UDP packets, filtering TCP resets before they reach the TCP layer in the end-host, or switching entirely from a TCP-based transport to a UDP-based transport. Each solution has its trade-offs. Filtering out TCP resets typically requires kernel access, and the participation of the remote peer since Sandvine sends the reset packet to the local and remote peers.{{citation needed|date=September 2012}}

==Criticism==