Yes, it seems some Gnutella clients (only older ones?) likes to "hammer" IPs for even longer time. If this is occurs only seldom in your packetfilter logfile, just ignore it! This is because of the distributed nature of Gnutella: It happens that Gnutella clients tries to reach a peer after it has gone offline (perhaps it will come back or is only temporarily away due to physical network problems). Together with dynamic IPs it happens that someone sees an incoming Gnutella connect attempt (port 6346/6347 usually) without ever running a gnutella client. Ignore it, it's just a knock at the wrong door. Someone had your IP before and did run a Gnutella client.

Unfortunatly it seems some bad/old clients try hammering old peers for a longer time, I think you can call this misbehaviour flooding (but it's not eaten up bandwith, it's just anoying). However this is an issue for further improvements, perhaps some Gnutella clients could evalute TCP/IP error codes better. I'm not sure if this topic was discussed before, perhaps more people have to complain about it loud enough. :-)

PS: I told something similar in another thread the last days (see below), but I reposted here to avoid sending you allover this forum. *g* http://www.gnutellaforums.com/showth...&threadid=6894