Defending against DDoS attacks that involve announcing fake torrents

[josecelano]

Relates to: torrust/torrust-demo#12

We have discussed this before in meetings, but it's not documented in GitHub.

Attackers can announce any random infohash using a single IP. There are no limits.

That can increase memory consumption and database records if persistence is enabled for torrents stats.

I will add the proposal I remember.

cc @da2ce7

[josecelano]

Proposal 1: Use a client to check that the peer has the torrent

This can consume even more resources because you need a BitTorrent client integrated with the tracker and at least try to download a piece from the peer. However, it would also be easy for the attacker to seed the torrent.