Connection traffic is usually compressed. Add the following to your phexCorePrefs.properties file:

Connection.AcceptDeflateConnection = false

__________________

Well..that did work. Could you elaborate a little on what that did to make incoming data plain text at the NIC?

Also...in the Search Monitor,...is the "routed from" ip address the actual host conducting the seacrh, or just the last hop it took? I dont see any additional IP addresses in the data.

Gnutella network traffic can be deflated using zlib, this is negotiated during the handshake. With this option you turn this feature off.
SourceForge.net Repository - [phex] View of /phex/trunk/docs/Gnutella/proposals/GNET compression.txt

It only shows the IP of the last hop. The IP of the host conducting the search is not part of the standard query protocol.

__________________

I was under the impression that each time a search term query took a hop, it would say something like "who has this search...tell 192.168.1.1 (original host)"

If the searching host ip address isnt sent along with the data, how does the host with the matching files three hops away know who is asking?