First connect to a GWebCache (see http://www.zero-g.net/gwebcache for the specs on that). At this point, you should have obtained approx. 10 hosts to try.

When you try these 10 hosts, look for "X-Try" headers in the v0.6 handsdhake, as they contain additional hosts you may want to try.

When you have established a connection, send one Gnutella Ping message with a TTL of 7 (only one per connection/session!!!). You will receive a number of Gnutella Pong messages in return, which contain the IP address of yet more hosts you can try. At that point, just passivly monitor the Pongs that are passed to other hosts through you.

As a side note: I recommend reading up on the Ping/Pong cache schemes at http://groups.yahoo.com/group/the_gdf

-- Mike