# TORRENT Detection -BRO

**URL:** <https://community.zeek.org/t/torrent-detection-bro/4849>\
**Category:** Zeek\
**Created:** [May 19, 2017, 9:38am UTC](https://community.zeek.org/t/torrent-detection-bro/4849 "2017-05-19T09:38:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Raj\_Kumar](https://avatars.discourse-cdn.com/v4/letter/r/f05b48/32.png) [@Raj\_Kumar](https://community.zeek.org/u/Raj_Kumar)\
**Post date:** [May 19, 2017, 9:38am UTC](https://community.zeek.org/t/torrent-detection-bro/4849/1 "2017-05-19T09:38:18Z")

</div>

Hi All,

Will I be able to detect torrent download using bro, i could see some torrent analyzers,is there any load statement should i include in local.bro or how to detect?

Thanks,

![image.png](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/699d80aafb0ce99edd520c0babbbde4a3546c0d1.png)

---

<div class="post-metadata">

**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\
**Post date:** [May 30, 2017, 5:12pm UTC](https://community.zeek.org/t/torrent-detection-bro/4849/2 "2017-05-30T17:12:49Z")

</div>

Hi,

> Will I be able to detect torrent download using bro, i could see some  
> torrent analyzers,is there any load statement should i include in local.bro  
> or how to detect?

The Bittorrent analyzer in Bro has not been touched in years and I assume  
that it is not functional (it certainly has not been tested by anyone in a  
long time).

If you are interested in trying to enable it, you will have to write all  
scripts yourself. As you probably are aware for most protocol analyzers we  
have scripts in base/ that create the logfiles that are written to disk.  
These scripts were never created for the Bittorrent analyzer - you would  
have to write them from scratch (and as I mentioned I have doubts if it  
still works).

So - short version - there is no quick and easy way to enable it  
currently.

Johanna

---

<div class="post-metadata">

**Author:** ![Vlad\_Grigorescu3](https://avatars.discourse-cdn.com/v4/letter/v/dec6dc/32.png) [@Vlad\_Grigorescu3](https://community.zeek.org/u/Vlad_Grigorescu3)\
**Post date:** [May 31, 2017, 3:07pm UTC](https://community.zeek.org/t/torrent-detection-bro/4849/3 "2017-05-31T15:07:55Z")

</div>

I looked at this a while back, and didn't pursue it because the protocol  
itself really doesn't have a lot of useful information. There are no  
filenames or really any useful metadata in the protocol (that's all  
contained in the .torrent file which is downloaded via a different  
channel).

There might be something for DHT, but that would require parsing  
a completely different protocol.

&nbsp;&nbsp;--Vlad

Johanna Amann \<[johanna@icir.org](mailto:johanna@icir.org)\> writes:

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/torrent-detection-bro/4849/4 "2022-05-06T15:44:57Z")

</div>