How does an administrator understands when a Torrent client is used?

Question

Usually, in places like a University residence there are some restrictions when it comes to internet: people can access the internet but cannot use programs like Torrent or p2p clients and sometimes VoIP phones.. My question is:

Technically, how does the system understands that I'm using DC++, uTorrent, VoipBuster or whatever ?!

(And if someone knows by the way: Is it possible to overide this restriction by using programs like Tor or Privoxy?!)

Thank you in advance!

Thanks for your answer, Colinc. But can someone make it more clear for a less advanced user?

Answer 1

Well, let me take Colinc's answer a bit further for you.
On the internet all traffic is passed using TCP/IP formats. Think of IP as a phone number. You call another computer (you call its IP) that computer responds to you (using your IP). That connects the two machines. Add to that a particular "extension" number inside your computer. (These are called ports.)

Lets say you want to receive email, email inbound to your computer normally uses port 110. So an email connection to you uses your IP and port 110 to communicate. When you send mail it uses port 25 to send out to your email server. So each and every item sent to you uses a particular port. Some of these can be changed some can not.

There are 65.K+ (65000+) of these port numbers available in any computer. Only a handfull are used for "NORMAL" internet traffic. Http or an internet page uses port 80, https uses 443, ftp uses port 21, ssh uses port 22 mail uses port 25 and 110 etc etc.

Your torrents use a particular PORT and it won't be one that is used for other traffic or it won't work, so all an Admin has to do is block those ports at the main router! The "extensions" are then not available to you and the traffic simply won't pass between the computers. VOIP is the same, it uses a port as well as the IP to communicate, If you kill the port you kill the traffic. This is the only way an admin has to limit the amount of traffic used by the system. If it isn't limited the entire system fails to work for those other users that need traffic also. The total traffic is called bandwidth and it is limited by the lines connecting the school to the internet. So if they allowed everyone all possible ports, then no one would be able to use the internet, due to all the traffic generated on a limited line!

These are reasonable limits placed to keep everyone who needs access getting access to those items the SCHOOL thinks they need for "normal" internet use.

If you need other ports get your own internet line! Don't mess the schools system up by overloading the available circuits with traffic that YOU WANT but don't NEED to get the education. Otherwise the school has to keep adding lines and the cost will reflect on everyones tuition.

This is overly simplified but I think it does describe what you asked.
Merry Chirstmas and God Bless

Answer 2

There's special software on their routers that allows traffic profiling.
It takes into considiration different parameters, including contents of the data you're sending. They're actually wiretapping the connection and look if the packet format matches the forbidden software. The technique is used also in some contries (like Middle East) that do not want that voice calls would go unchecked and through uncontrolled paths.

Against that different approaches are used, like encrypting traffic. Torrent protocols and some voip solutions (like Skype) are using encryption methods to get over this barrier imposed by system administrators and not-quite-democratic governments.

Answer 3

The server ports for these programs are normally blocked. Also their logging system sees any attempt to use them, including the reply header pointing to the internal address and MAC address of the machine trying.