German researchers have noticed an alarming development in the BitTorrent ecosystem. Since last week, the number of users on the BitTorrent DHT has doubled in size. The exact reason for the increase hasn't been confirmed, but all signs point to a bug in a recent uTorrent release.

Day in and day out dozens of millions of people use BitTorrent to share files online. Most of these transfers are coordinated by public trackers such as OpenBitTorrent, but torrents also work without trackers thanks to Mainline DHT.

The BitTorrent Mainline DHT creates a network of users through which people can find peers sharing the same file. This makes the BitTorrent ecosystem more stable, especially since public trackers tend to go offline every now and then.

Since it was first introduced nearly a decade ago the BitTorrent DHT has been growing steadily. However, this changed last week when researchers from Karlsruhe Institute of Technology noticed a dramatic increase in peers.

“Since 2010, the DHT size has been relatively stable. It grew from 6 million to around 10 million, but that’s it,” says Konrad Jünemann, researcher of the Decentralized Systems and Network Services research group.

“This suddenly changed last week we saw a sudden increase in participating peers. I double checked our measurement engine, but everything seems to be fine, so the DHT was indeed growing,” he adds.

As it turns out, the number of peers in the DHT had more than doubled in a few days. The graph below shows this surge in peers as observed by the German research group.

Initially the researchers were clueless about the sudden increase. There were a few possible explanations, such as malware distributors using the network, or changes in a popular BitTorrent client for example. After contacting several developers, they learned that the latter was the most plausible option.

Arvid Norberg, one of the developers of BitTorrent’s uTorrent client, explained that a recent change in client may have resulted in a bug which resulted in “flapping” node IDs.

“We have some indications that this is caused by an issue in our node-ID function. We have had a mechanism to tie the node ID to one’s external IP address. We’ve had this feature for a while but made some tweaks to it recently,” Norberg wrote on a mailing list.

If this is indeed the case, then it could cause serious performance issues for the DHT, as people would get IP-addresses that are no longer online. Currently, however, there is no evidence that this is indeed the case.

TorrentFreak asked BitTorrent Inc. for more details early this week, but this far our inquiries remained unanswered. The same is true for a bug report from a user in the support forums.

Perhaps the mystery will be solved in the days to come.

Update May 24: BitTorrent’s Arvid Norberg sent the following statement via the BT mailing list.

“We found two recent bugs causing uTorrent to reset and restart its DHT randomly. Their release coincides with your observation of the appearance of the DHT size growing. The cause was using uninitialized IP addresses when receiving messages that did not include the external IP field.”

“We have started to release a hotfix for this today, and expect to ramp it up this coming week.”