Traffic Measurements of BitTorrent System Based on Netfilter

BitTorrent as a kind of P2P application for file-sharing has become tremendously popular over the last few years, now accounting for a significant share of the total network traffic. BitTorrent protocols used arbitrary ports to camouflage its traffic to avoid detection and recognition with standard measurement tools. Some new methods using application layer signature have good accuracy identification. However, these approaches would not be suitable for real-time measurement because of the high overhead. To overcome this problem, we present a measurement system which reliably detects and measures BitTorrent traffic in real-time in this paper. The measurement methodology is based on using application level signatures implemented by Netfilter extension as well as packet classifier. The results from test in a large university network indicate that this approach not only can significantly improve the BitTorrent traffic volume estimates over what pure network port based approaches provide, but also provided the performance required for practical applications