[bittorrent] strange mainline version ID

Arvid Norberg c99ang at cs.umu.se
Sat Aug 13 11:22:15 EDT 2005


On Aug 13, 2005, at 15:06, Arnaud Legout wrote:
> Hello Arvid,
>
> Arvid Norberg wrote:
>> It's BitComet. It has a "feature" where it copies or spoofs peer ids,
>> but it still always end with UDP0.
>>
> Thanks for the information, that explains the behavior I observed that
> was close to
> the behavior of BitComet. How did you find it? Is it in a document, or
> did you perform experiment on it?

One user of libtorrent posted a logfile that looked like this:

received peer_id: 00024253addfb586c775eb1654555fa055445030 client:  
BitSpirit
as ascii: ..BS ßµ?Çuë.TU_ UDP0
[...]
2005-Jun-11 19:36:11 *** CONNECTION CLOSED

received peer_id: 2d4d503130325d2dc775eb1654555fa055445030 client:  
MooPolice 1.0.2.38
as ascii: -MP102]-Çuë.TU_ UDP0
2005-Jun-11 19:45:28 *** CONNECTION CLOSED

The log is from the same IP, and with so short delay between the  
reconnect (the second connection was incoming) it was very likely  
that it was the same peer. And since the second peer-id was from an  
unreleased version of his client, it was obvious that it was spoofed  
(actually copied and changed the last bytes).
I believe that there's some kind of connection between BitSpirit and  
BitComet, and I didn't find an email address to anyone involved in  
BitSpirit so I mailed BitComet instead, and they confirmed this  
behavior.

I have access to a local tracker where most people are using  
BitComet, and it is very common seeing spoofed peer-ids ending in  
UDP0 there.

--
Arvid Norberg





More information about the BitTorrent mailing list