This is why I aim at identifying the P2P traffic (BitTorrent, DHT-based protocols and the likes).
If I succeed I can do something: blocking, limiting ...
If I cannot, then I have little to discuss.
Again, downloading a torrent file is NOTHING.
Have you tried to use a recent BitTorrent client with "KAD support"?
It doesn't need any torrent file but just the hash value, a string you can get by email or on the web.
The
DHT will make the "rest of the magics", by just requiring some more time to "look" for a list of suitable peers.
So you won't be able to block or shape anything as even the torrent file is not needed any more.
You can only block everything, as they can be using "low ports" and apply a "light disguise" to the traffic as P2P can use any TCP and UDP ports from 1 to 65535!
What I see doable here is to allow "low ports" and a few "high ports" and block or limit the bandwidth to anything else.
It's more like "traffic containment" than "traffic control", but I see no option here.
I have thinking about port mirrorring and wireshark to chek if the customers is download something.
What do you think about this solution ?
Anyway it's impossible to identify if the customers is doing something illegal... :/
(And I don't know DHT ! Thanks for this information ! I found on the forum a guy who block this type of trafic by using dns static and some things like that. )
Almost all P2P traffic is encrypted, thus inspecting the content wouldn't help much.
Moreover, even if is wasn't encrypted but just "compressed" with your favorite tool, it would require you to first download all the stuff, uncompress it and then check.
In that case the download wouldn't be blockable as it had already happened.
Wireshark on a mirrored port is a very powerful tool. But only if you know what you are looking for.
I know a large company that stores for a few weeks all traffic (but not the payloads) coming from mirrored ports for late analysis and statistics.
They can look for specific events.
But, yet, you need to know what to search for.
If you do know, than you don't need Wireshark.
It could make some sense to use nTop or a similar tool to analyze the actual traffic in real-time.
While you wouldn't still be able to see the payloads themselves, you could have a rather precise idea of the type of traffic and its endpoints and, with some training, be able to tell a good P2P from a bad one.
You could then decide to block or slow down that type of traffic based upon IPs and TCP/UDP ports.
If you want to have a precise real-time idea about your traffic, then you really need nTop.
Finally whatever solution is based on the DNS, it is trying to block the download of torrent files.
Which isn't required any more with "KAD" enabled: the torrent file di retrieved from the P2P network itself.
I'd like you to test the BT+KAD download with your favorite client.
For example, the official Ubuntu 16.04 server ISO file is also available on BitTorrent.
Its hash (as in DHT=distributed
hash tables) is a49cd0d5abc633e1ee2ad1fee8ced66614415ceb.
Try using this string to download the file.
It takes just a few minutes more than a regular download with a torrent file.
Once the download is started it will have very same speed as a regular BitTorrent download.
DHT is really a P2P protocol (actually a technology) where now server is needed.
The regular BitTorrent requires a torrent file to be downloaded from a server and there are dozens of "torrent caches" from which you can download them.
The point is that those caches don't (because they cannot) check for the legitimacy of each single torrent.
With the DNS you block the access to those caches and think you are blocking BitTorrent.
But you are not.
