Re: Modern implementations of control messages (ping, pong etc.)

Quoting rik_saunderson <[email protected]> from ml.gnutella.dev-forum:
:Hi there,
:I'm trying to understand how modern gnutella clients send and recieve control
:messages (i.e. ping, pong, query, queryhit, push, bye and vendor specific). 
:Older clients send them over tcp on port 6346, but most modern clients (e.g.
:Limewire, Frostwire etc.) no longer do this because it's incredibly easy to block
:with a firewall.  Additionally, some send control messages over UDP.
:
:I've looked on the Limewire wiki, and I've tried reading a spec for GUESS that I
:found, but I cant find an exact spec.
:
:My questions are these:
:1.  How do modern gnutella clients agree on which port to use as the destination
:port?  It can't just be the Listen-IP filed of a GNUTELLA CONNECT because I have
:pcap files of transfers where this data does not appear.

Yes, it is the value of Listen-IP or Node headers.

Not all servents will send it out though, as it is not mandatory to initiate
a connection (since you know the remote IP and port).

:2.  Is there a spec document with the format of the most common vendor specific
:messages (i.e. bytes 0-15 are the servent ID, byte 16 is the length etc.)?

Each vendor message will specify the meaning of its payload.

For instance, here is the definition of the "GTKG/7v2" message:

    Name: UDP Connect Back
    Vendor: GTKG
    ID: 7   
    Version: 2
    TTL: 1
    Payload:
        unsigned short: port number (little-endian)

You see, it clearly mentions that the payload is a single little-endian 2-byte
word.

:3.  Both of the above questions for UDP control messages.

UDP control messages are simply Gnutella messages, there are no differences
with the ones sent over TCP.

Raphael