I got service pack 3 so i guess i'm safe.

Pings and pongs got the right payload lengths, and queries seem to have reasoneable ones. The extra data is probaly parts of descriptors i'm missing. I don't have to worry about losing my spot cause 80% of the time each .getdata command starts at the beginning of a descriptor.

Thanks for the help hydro.

this one's cool too
http://www.pla-netx.com/linebackn/evil/index.html