Heuristic detection of leech attacks
Posted: Sat Sep 15, 2018 11:57 am
From time to time, I notice that someone will download a torrent, and then, that same person, or set of IPs (usually two or more coming from the same country or same subnet at the same time) after completing a download, will come back hours later and start the download from scratch all over again. I have tried banning IPs of the most obvious offenders, but it would be great if qbittorrent could detect this type of disruptive attack or at least flag possible attacks.
For example, if two IPs initiate download within a few seconds of eachother, or two IPs with nearly identical addresses, or an IP which has already downloaded to completion (or near completion) comes back later to try to download the same data, the program could automatically block that user, or at least warn the operator of potential attack.
Many of us are generous seeders, but we don't have unlimited bandwidth to work with. I have already gone into options and set the protocol to "anti-leech" and I think that helps to direct bandwidth to those who are actually sharing, but I find that I have to keep a close eye on things regardless...
For example, if two IPs initiate download within a few seconds of eachother, or two IPs with nearly identical addresses, or an IP which has already downloaded to completion (or near completion) comes back later to try to download the same data, the program could automatically block that user, or at least warn the operator of potential attack.
Many of us are generous seeders, but we don't have unlimited bandwidth to work with. I have already gone into options and set the protocol to "anti-leech" and I think that helps to direct bandwidth to those who are actually sharing, but I find that I have to keep a close eye on things regardless...