Who’s connected:

Go to your command prompt and type:

    lsof |grep iTunes |grep TCP

You’ll see something like this:

    iTunes 338 name 16u IPv4 0x37fc710 0t0 TCP *:daap (LISTEN)
    iTunes 338 name 17u IPv4 0x2efb920 0t0 TCP 192.168.0.3:daap->192.168.0.8:50565 (ESTABLISHED)

The first line is just your iTunes application listening for incoming connections. The second is another machine with IP address 192.168.0.8 that is connected and browsing the music library. If nobody were connected, you’d just see that first line.

Who’s listening?

When another machines iTunes client connects to your library, it first opens up a TCP connection for browsing your music library. When the client chooses to play a file, a second TCP connection is made to transmit that file’s data. When you search for TCP connections and someone is actually downloading music, you’ll see something like this:

    iTunes 338 name 16u IPv4 0x37fc710 0t0 TCP *:daap (LISTEN)
    iTunes 338 name 17u IPv4 0x2efb920 0t0 TCP 192.168.0.3:daap->192.168.0.8:50565 (ESTABLISHED)
    iTunes 338 name 18u IPv4 0x2dae920 0t0 TCP 192.168.0.3:daap->192.168.0.8:50573 (ESTABLISHED)

Because there are two connections from 192.168.0.8 in this scenario, we know that the remote iTunes client is transferring file data, and not just browsing.

What’s being listened to?

Back at the command prompt, run another lsof and look for files that are open in your music library. This assumes that your files are stored in the default iTunes Music directory.

    lsof |grep "iTunes Music"

You should see something like this:

    iTunes 338 name 17r REG 14,2 5657237 965155
       /Users/name/Music/iTunes/iTunes Music/Compilations/Xen Cuts
       (Disc 3)/3-07 Drunk Trumpet 1.mp3

Now keep in mind, this will list every file that is opened by your iTunes application, whether it’s being transmitted over the network or you are listening to it locally. Unfortunately, I don’t know of a way to associate a particular file with a particular downloader, but it’s not too difficult to figure out unless there are several people connected. If it’s just a single user, just look for any files you aren’t currently listening to yourself.