Cheating fundamental question.

[Jarun]

After reading around the net, this forum, and examining a few of the anti-cheating scripts I am left wondering something I hope you guys can clear up. I am referencing private trackers (the .bz family to be exact)

To me, the most logical cheat detection would be if a client was reporting upload on a torrent where no other clients are reporting downloading or your client reporting uploading beyond a threshold above or below the combined activity of your peers.... but from my experience this doesn't seem to be the case. Unless I missed something (which I may have) the anti cheat scripts I have looked at don't even examine the activity of other peers on a torrent in that way. They just look for you to make blatantly stupid mistakes.

For instance, I can get on a torrent with many seeds and leechers (who are inactive because they only wanted some of the files of the torrent). So, I know there is pretty much no activity on the torrent unless someone connects for real. I set ratio master to leech with at a relatively low download speed. I would think since none of the other peers are reporting upload that I would be red flagged.

Once I appear to have downloaded all or most of the torrent I start to appear to upload at an even slower speed that I had been downloading. I would think this would again red flag me as none of the other peers are reporting download or as much download as I am reporting upload.

But, it would appear that this is not how most detection methods work? Is this because it would be too CPU intensive on the server to cross reference reported activity on the same torrent?

[bjs]

1. It depends on what you mean by 'slow'.
2. How can you be sure that 'this is not how most detection methods work'? They may not ban you immediately after just one suspicious behavior, but with more similar patterns they will do.

For a typical tracker with 200K peers on all its torrents and a 30min announce interval, the total records generated are 9.6M (200K x 2 x 24) per day. It is quite manageable with a modern database system if you want to.

[Jarun]

1. "slow" is <180kB. Averaging under 50kB
2. I'm not sure... thats why I'm ASKINGn As I said, the anti cheating scripts I looked over didn't seem to work in the way I would expect them to... unless I missed something. Which is possible.

And if I am indeed correct... I'm asking why they don't work by what I consider the most logical way of detecting cheaters (outlined above).

[anon]

Unless I missed something (which I may have) the anti cheat scripts I have looked at don't even examine the activity of other peers on a torrent in that way. They just look for you to make blatantly stupid mistakes.

The heavy-duty scripts aren't public. But they're like people who dislike you. Watching every move you make in hopes you'll do something wrong so they can laugh at your attempt.

[bjs]

To be fair, I think most of the tracker admins are normal people - they would rather spend time taking care of their 99% 'good' users, instead of catching the 1% 'cheaters'. I believe this is the main reason why you can 'cheat' safely most of the time.

But it would be an insult to their intelligence if you are too greedy and cheat in a rather obvious way.

[SealLion]

..... too greedy .......

Well said.

[Jarun]

Still not quite addressing what I'm trying to ask.

In my previouse posts I have pointed out the most logical way (to me) of detecting cheating is when You upload or download on a torrent at rates that conflict with the other peers are reporting. And as I said from my own experience and examination of the few anti-cheat scripts I have examined... they don't seem to pay attention to the activity of the swarm as a whole, but rather if you report something that is unrealistic or an error in your client setup.

For instance, if you report uploading 15 gigs in one update you will get banned... not because the other peers of the torrent did not report uploading 15 gigs and therefore you are reporting something that is inconsistent with the rest of the swarm... but because uploaing 15 gigs is just unrealistic.

Now, I know there are some anti cheat scripts out there that will reference your activity in contrast to the reports of other peers... but what I am asking is that it seems most do not. I'm trying to get confirmation on this from other people's experiences and knowledge.

[anon]

In my previouse posts I have pointed out the most logical way (to me) of detecting cheating is when You upload or download on a torrent at rates that conflict with the other peers are reporting. And as I said from my own experience and examination of the few anti-cheat scripts I have examined... they don't seem to pay attention to the activity of the swarm as a whole

I believe my answer was clear enough. The sites that are high up the cheating difficulty list can and do check for inconsistencies.

[bjs]

Further to anon's point, there are too many variables in the equation so nobody can be 100% sure if you are cheating. Let me use the two examples you gave:

1. You report uploading 15 gigs in one update. If you have a 100M seedbox, you can do much more than 15G on popular torrents in one announce.

2. You fake uploading at a slow rate of 180kB. I (really) downloaded from you at this speed. But I had a network problem/computer crash etc before an announce, and I did not re-start my client for a long time. This would results you reported uploading and I did not report downloading.

In both cases, you are not cheating!

Therefore it is not so straightforward to detect cheating. As I said before, most of the admins don't bother to spend time on it. This is the reason you can get away from it most of time.

[Jarun]

Thanks... I knew there had to be some other parts of the equation. I suppose it might be more of a red flag if you consistently report uploading when no one else is reporting download.