Glasnost: Detecting BitTorrent Traffic Blocking
At a high-level, our test sets up a series of
BitTorrent flows between an end user's host and our Glasnost test
servers. We collect the packet trace for each flow on the server side,
and we closely monitor both end points for any error conditions that
might cause a flow to be aborted. If a flow is aborted by a
control (RST) packet that was not sent by either
of the end points, we report the flow as being blocked by some ISP
along its path.
More specifically, we report a BitTorrent connection as blocked only when:
Note: At this point of time, our reporting of BitTorrent
blocking is conservative i.e., there are scenarios when a BitTorrent
connection is blocked but we do not report it because it does not meet
our rather stringent checks. For example, we exclude BitTorrent
connections that might have been blocked after a few data bytes have
been transferred. Similarly, we exclude blocked connections for which
we cannot parse the IOException string thrown by the client JVM (the
exception varies between JVMs, and especially between different
We are actively working to improve our methodology and we expect to
uncover more cases of blocking over time.
- Both end points report that the connection is reset and neither
of them actively closed the connection: This suggests that the RST
packets are generated by some middlebox in the network and not the end
hosts. On the server side, we check for received RST packets in the
packet logs we collect and that we have not sent any RST packet. On
the client side, we detect connection reset when the client JVM aborts
the flow raising a "Connection reset by peer" or "An
existing connection was forcibly closed by the remote host"
- None of the multiple control TCP connections (with random bits
in the payload) established immediately before or after the aborted
BitTorrent transfer are interrupted: This suggests that BitTorrent
transfers are being specifically targeted for termination.
- The BitTorrent connection is reset after the exchange of
"bitfield" messages and before any data messages have been
transferred: Bitfield messages in the BitTorrent protocol indicate
an intent to initiate data transfers. That the connections are aborted
immediately after protocol specific messages offers further evidence
that BitTorrent traffic is being actively profiled and
If you have any problems or questions, do not hesitate to contact us.
If you have questions or feedback, you can contact us via e-mail: