Incoming searches in traffic capture?
 

Im capturing Gnutella network traffic sent to my laptop using Wireshark Network Analyzer (Seemed like a fun thing to do on a Friday night while drinking a beer):super:

I can see the incoming searches in the "Search Monitor" in plain text, however when I try to locate those packets in the network analyzer, I cant identify them. I think they are UDP?

I know the Gnutella syn packet headers are in plain text. How can I identify the incoming search packets? Is there a way that they are human readable?

Dave

Connection traffic is usually compressed. Add the following to your phexCorePrefs.properties file:

Connection.AcceptDeflateConnection = false

Well..that did work. Could you elaborate a little on what that did to make incoming data plain text at the NIC?:confused:

Also...in the Search Monitor,...is the "routed from" ip address the actual host conducting the seacrh, or just the last hop it took? I dont see any additional IP addresses in the data.

Gnutella network traffic can be deflated using zlib, this is negotiated during the handshake. With this option you turn this feature off.
SourceForge.net Repository - [phex] View of /phex/trunk/docs/Gnutella/proposals/GNET compression.txt

It only shows the IP of the last hop. The IP of the host conducting the search is not part of the standard query protocol.

I was under the impression that each time a search term query took a hop, it would say something like "who has this search...tell 192.168.1.1 (original host)"

If the searching host ip address isnt sent along with the data, how does the host with the matching files three hops away know who is asking?

The results gets sent back along the chain.

That's why it suffices to get the connection to your Ultrapeers through your firewalls to be able to search. Sadly it doesn't work as well for downloads (passing them along the chain would kill the network - instead a non-firewalled third party is used to route the downloads (Push Proxy).

This is different for OOB results (out of band) as far as I know.