1. if my computer get a query message, how can I know where it comes from? is this possible? it doesn't show in the query definition in the protocol.
2. How can I know the file names the other peers are sharing? The pong message only gives how many files are sharing, but not the names.

Thanks a lot

You don't know where it comes from, you only know which ultrapeer transmitted you the query, - and that's where to send the queryReply.

How about the second Q? how to know that?

All queries have unique GUIDs so you can associate queryHits with the corresponding queries. In addition all clients keep routing-tables mapping the GUIDs to the connections that sent the messages.

What I mean is all the files a particular peer are sharing. I can know the # of files it is sharing from the pong, but not the names. How can I know that?

You can either connect via http and request a list of shared files or you can send a query for a keyword.

How to do this, do you have any referene? any code?

It is also possible that the query comes from its leaf? then how to distinguish if it is from a ultra or a leaf?

It's all documented in the files section at http://www.yahoogroups.com/groups/the_gdf and at rfc-gnutella.sf.net

you can't, except if you would mark the GUID. Some vendors put certain information into the GUID but it's not documented.