Today i found this strange thing where KTorrent was uploading to two peers with different speeds, but this two peer had the same ip address.

Weird

We have a check for identical peers so I guess the only way this could happen is that a peer has a 2 different peerIDs with the same IP. That would mean that he's either using 2 clients at the same time or he tweaked his client somehow (seeing that it's an unknown client it could be).

It would be interesting to see some more info like port, peerID and user agent strings...

I see the same on one of my seeds, or rather I have even more. On a seed with 88peers i have 2 IP with 4peers and 1 with 3peers, and several with 2.

I don't know to much about that stuff, but couldn't it be as simple as different clients behind a proxy? Although it's weird they download the same files and use identical clients.

Yeah, it's weird that 'Availability' percentage is the same too, so I think it's obvious that it's the same client. Questions is: how? I don't think the same peerID could slip through...

Maybe they are spoofing clients to have a chance to leech more? I haven't seen this behavior so far.

I was thinking of using ethereal for looking at the peerid and port, but the problem is that i don't get that program at all.

The site said there were 4 peers in swarm:
- bittorrent 3.4.2
- utorrent 1.5.0.0
- bitorrent 4.4.1
- azureus 2.x.x.x
But off course there's user-agent spoofing, so that's useless.

Looks like someone is cheating huh?
Do you think i should inform the admin of this tracker?

Don't inform tracker admins until we are sure this is not KT related

As for the ethereal, start it and then select Capture->Interfaces... option from menu. You'll find several interfaces listed so select the appropriate one. That would probably be something like ppp0(ppp1, ppp2 etc...) or eth0 (ethernet) or something else (you may find out which one by looking at IP that corresponds to your interface). By clicking on 'Capture' your traffic will be logged. Make sure you connect to those peers as fast as you can or log file can become pretty big
As soon as you connect to them you may stop logging and export log file as txt. You may then either attach it here (grep for IP address of those suspicious peers and copy packet data) or send complete log file to my email.

Happy capturing

Looks like somebody running two clients at the same time to boost their share ratio,, not that difficult, they just have to use different ports.

Okey, next time i will capture that ****.