Modern implementations of control messages (ping, pong etc.)

Hi there,
I'm trying to understand how modern gnutella clients send and recieve control messages (i.e. ping, pong, query, queryhit, push, bye and vendor specific).  Older clients send them over tcp on port 6346, but most modern clients (e.g. Limewire, Frostwire etc.) no longer do this because it's incredibly easy to block with a firewall.  Additionally, some send control messages over UDP.

I've looked on the Limewire wiki, and I've tried reading a spec for GUESS that I found, but I cant find an exact spec.

My questions are these:
1.  How do modern gnutella clients agree on which port to use as the destination port?  It can't just be the Listen-IP filed of a GNUTELLA CONNECT because I have pcap files of transfers where this data does not appear.

2.  Is there a spec document with the format of the most common vendor specific messages (i.e. bytes 0-15 are the servent ID, byte 16 is the length etc.)?

3.  Both of the above questions for UDP control messages.

Thanks,
Rik