|
"Torrent Poisoner"?
|
|
Newbie
|
24. February 2011 @ 16:50 |
Link to this message
|
using uTorrent 2.2, i have completed dl a p2p that's close to dead. in response, i have been uploading "unlimited," reaching an almost constant 700-750 kB/s ul bandwidth. i notice that there is consistently one ul'er that is hogging literally all the bandwidth, and he is always on. he has already dl'd more than the 14.6GB file size.
his ip address == 34.61.97.65.in-addr.arpa
is this a "torrent poisoner"? why is he doing this? what can i do about him?
|
|
Advertisement
|
 |
|
|
Senior Member
|
25. February 2011 @ 05:57 |
Link to this message
|
|
I can not say for certain if that is a "poisoner".
But if you want to block that IP from connecting to you, then you can use the IP Filter function in uTorrent.
If you want to block it, post back and I can give some instruction on creating your own IPFilter list in Windows and setting it up in uTorrent.
This message has been edited since posting. Last time this message was edited on 25. February 2011 @ 05:58
|
Newbie
|
25. February 2011 @ 09:50 |
Link to this message
|
Originally posted by jeffw224:
I can not say for certain if that is a "poisoner".
But if you want to block that IP from connecting to you, then you can use the IP Filter function in uTorrent.
If you want to block it, post back and I can give some instruction on creating your own IPFilter list in Windows and setting it up in uTorrent.
Yes, please provide instructions.
are there undesirable consequences to creating this filter?
what else can it be besides a torrent poisoner; he consumes all the 750kB/s bandwidth?
is this the likely reason why my dl was so slow (75kB/s avg.)? what can i, qua dl'er, do about this?
what is his mechanism?
how can i ascertain whether such a prolifically-hogging dl'er (or dl'erS) is malicious; might there be legitimate reasons why 6 of 8 dl'ers each receive 0.5 kB/s dl while the other two are each consuming 400-750 kB/s?
how did this poisoner come to choose this p2p -- it's not popular, based on the fact that it's close to dead (but i would consider it prized)?
why does this ip not appear in whois?
This message has been edited since posting. Last time this message was edited on 25. February 2011 @ 17:55
|
Senior Member
|
27. February 2011 @ 09:03 |
Link to this message
|
"are there undesirable consequences to creating this filter? "
The only IP you would be adding in is that one, so the only IP blocked would be that one.
Unless you want to use a complete blocklist (which may or may not block that address).
I was only referencing blocking that individual.
To create a blocklist just for that IP, use notepad to create a document and put that IP address in the document.
Save the file as ipfilter.dat (make sure to change the file type setting to all files from txt.
Once saved, the file needs to go to the AppData folder for uTorrent-if you do not know how to get there: Start>Run and type %AppData%\uTorrent.
In uTorrent go to Options>Preferences>Advanced and look for "ipfilter.enable" and set that to "true".
You can re-start uTorrent to enable the IPFilter or highlight thhe torrent in the uTorrent window and go to the "Peers" tab below and right-click>enable IPFilter.
"is this the likely reason why my dl was so slow (75kB/s avg.)? what can i, qua dl'er, do about this?"
Maybe.
If this IP was using up your upload during your download time, then it would affect your download speed as you would not get back much upload from other downloaders. Bittorrent does work on tit for tat between downloaders.
People on the torrent may not have high upload capacity (your download speed depends on others upload speed).
Your uTorrent may not be set up properly. A good guide here:
http://www.techsupportalert.com/content/optimizing-torrent-speed.htm
"why does this ip not appear in whois?"
It is not a domain. It appears to be a computer logging on from Haliburton in Houston, Texas USA. The info on it is here:
http://www.ip-adress.com/reverse_ip/34.61.97.65
"how can i ascertain whether such a prolifically-hogging dl'er (or dl'erS) is malicious; might there be legitimate reasons why 6 of 8 dl'ers each receive 0.5 kB/s dl while the other two are each consuming 400-750 kB/s?"
That may be true. Most people do not have their bittorrent clients properly setup and do not get good download. I often get more download speed than the rest of the peers combined.
The thing that makes this suspcious is your statement that he has already downloaded more than the file size.
If others are showing their % completed increase, then usually the use of most bandwidth is probably not a problem.
"what is his mechanism?"
I would not know for sure.
"how did this poisoner come to choose this p2p -- it's not popular, based on the fact that it's close to dead (but i would consider it prized)?"
That is unusual. It is hard to say. It is not for certain that this person is a poisoner. They may have their router set up improperly and it may be corrupting data causing the bittorrent client to continually download. Either way, this person is wasting your bandwidth.
|
Newbie
|
27. February 2011 @ 15:54 |
Link to this message
|
Originally posted by jeffw224:
To create a blocklist just for that IP, use notepad to create a document and put that IP address in the document.
Save the file as ipfilter.dat (make sure to change the file type setting to all files from txt.
Once saved, the file needs to go to the AppData folder for uTorrent-if you do not know how to get there: Start>Run and type %AppData%\uTorrent.
In uTorrent go to Options>Preferences>Advanced and look for "ipfilter.enable" and set that to "true".
You can re-start uTorrent to enable the IPFilter or highlight thhe torrent in the uTorrent window and go to the "Peers" tab below and right-click>enable IPFilter.
i followed your instructions up to saving the ipfilter.dat in %appdata%\uTorrent. ipfilter.enable was already set to true. i restarted utorrent and there was no change in thge condition: he was still there and still consuming everything. i then highlighted the entry in the peers tab and right-clicked ... there is nothing resembling "enable IPFilter"!
now what?
This message has been edited since posting. Last time this message was edited on 27. February 2011 @ 15:55
|
Senior Member
|
27. February 2011 @ 16:51 |
Link to this message
|
Actually, it is Reload IPfilter-I had it wrong.
If the ipfilter.dat file is in the uTorrent AppData folder, that option should show up and it should have taken affect on re-starting to begin with.
http://www.utorrent.com/faq/misc#faq8
You do not right-click on the peer-you highlight the torrent above, click on the peers tab and right click in a blank area in the peers tab area.
Is the ipfilter file showing as a dat file or as a txt file?
Just to make sure you can download an ipfilter.dat file here and empty it and just put in that IP
http://ip-filter.emulefuture.de/
|
Newbie
|
27. February 2011 @ 16:59 |
Link to this message
|
Originally posted by jeffw224:
Actually, it is Reload IPfilter-I had it wrong.
If the ipfilter.dat file is in the uTorrent AppData folder, that option should show up and it should have taken affect on re-starting to begin with.
http://www.utorrent.com/faq/misc#faq8
You do not right-click on the peer-you highlight the torrent above, click on the peers tab and right click in a blank area in the peers tab area.
Is the ipfilter file showing as a dat file or as a txt file?
Just to make sure you can download an ipfilter.dat file here and empty it and just put in that IP
http://ip-filter.emulefuture.de/
i already thought of "Reload IP filter" -- it accomplished nothing that i could discern... registered as DAT file.. right-click in blank area accomplishes nothing different. i will try the remainder of your modifications later
|
Newbie
|
27. February 2011 @ 17:26 |
Link to this message
|
Originally posted by jeffw224:
Just to make sure you can download an ipfilter.dat file here and empty it and just put in that IP
http://ip-filter.emulefuture.de/
i dl'd and opened in notepad.. interesting stuff if i could understand it. anyway, what specifically do you want me to do after i blank it out and insert the 34.61.97.65.in-addr.arpa -- how will this differ from opening a new notepad and integrating it into %appdata%, which is what i did in the first place.
This message has been edited since posting. Last time this message was edited on 27. February 2011 @ 17:27
|
Senior Member
|
27. February 2011 @ 17:37 |
Link to this message
|
If you are seeing reload ipfilter, then you should have it correct as far as the dat part.
This just occurred to me:
Did you enter 34.61.97.65 in the dat file?
Only numbers go in, not the other part.
|
Newbie
|
27. February 2011 @ 22:11 |
Link to this message
|
Originally posted by jeffw224:
If you are seeing reload ipfilter, then you should have it correct as far as the dat part.
This just occurred to me:
Did you enter 34.61.97.65 in the dat file?
Only numbers go in, not the other part.
something seems wrong bc i amended the .dat file twice: 34.61.97.65 and 34.61.97.65. (note the final (.)), restarted utorrent, and invoked "reload ipfilter" for good measure;, and the bugger is still there (he never sleeps) just as happy as ye' please.
now what?
This message has been edited since posting. Last time this message was edited on 27. February 2011 @ 22:14
|
Senior Member
|
28. February 2011 @ 02:48 |
Link to this message
|
|
Something is wrong as that IP should be banned from connnecting to you.
Sorry, I do not know what else can be done.
|
Newbie
|
28. February 2011 @ 13:26 |
Link to this message
|
Originally posted by jeffw224:
"are there undesirable consequences to creating this filter? "
The only IP you would be adding in is that one, so the only IP blocked would be that one.
Unless you want to use a complete blocklist (which may or may not block that address).
I was only referencing blocking that individual.
To create a blocklist just for that IP, use notepad to create a document and put that IP address in the document.
Save the file as ipfilter.dat (make sure to change the file type setting to all files from txt.
Once saved, the file needs to go to the AppData folder for uTorrent-if you do not know how to get there: Start>Run and type %AppData%\uTorrent.
In uTorrent go to Options>Preferences>Advanced and look for "ipfilter.enable" and set that to "true".
You can re-start uTorrent to enable the IPFilter or highlight thhe torrent in the uTorrent window and go to the "Peers" tab below and right-click>enable IPFilter.
"is this the likely reason why my dl was so slow (75kB/s avg.)? what can i, qua dl'er, do about this?"
Maybe.
If this IP was using up your upload during your download time, then it would affect your download speed as you would not get back much upload from other downloaders. Bittorrent does work on tit for tat between downloaders.
People on the torrent may not have high upload capacity (your download speed depends on others upload speed).
Your uTorrent may not be set up properly. A good guide here:
http://www.techsupportalert.com/content/optimizing-torrent-speed.htm
"why does this ip not appear in whois?"
It is not a domain. It appears to be a computer logging on from Haliburton in Houston, Texas USA. The info on it is here:
http://www.ip-adress.com/reverse_ip/34.61.97.65
"how can i ascertain whether such a prolifically-hogging dl'er (or dl'erS) is malicious; might there be legitimate reasons why 6 of 8 dl'ers each receive 0.5 kB/s dl while the other two are each consuming 400-750 kB/s?"
That may be true. Most people do not have their bittorrent clients properly setup and do not get good download. I often get more download speed than the rest of the peers combined.
The thing that makes this suspcious is your statement that he has already downloaded more than the file size.
If others are showing their % completed increase, then usually the use of most bandwidth is probably not a problem.
"what is his mechanism?"
I would not know for sure.
"how did this poisoner come to choose this p2p -- it's not popular, based on the fact that it's close to dead (but i would consider it prized)?"
That is unusual. It is hard to say. It is not for certain that this person is a poisoner. They may have their router set up improperly and it may be corrupting data causing the bittorrent client to continually download. Either way, this person is wasting your bandwidth.
it is not at all possible that the haliburton company has anything, much less their routers, configured incorrectly http://en.wikipedia.org/wiki/Halliburton http://en.wikipedia.org/wiki/.arpa i am more inclined toward my original position that this is a malicious, anti-filesharing poisoner http://www.halliburtonwatch.org/
This message has been edited since posting. Last time this message was edited on 28. February 2011 @ 13:31
|
|
Advertisement
|
|
|
|
mrslicker
Member
|
3. March 2011 @ 03:04 |
Link to this message
|
set up a rule in your firewall. block the ip address that way.
lubricant -> Mr Slicker -> ???
|
