View Single Post
  #2 (permalink)  
Old October 26th, 2001
Moak's Avatar
Moak Moak is offline
Guest
 
Join Date: September 7th, 2001
Location: Europe
Posts: 816
Moak is flying high
Default

Sorry, I have no XP here. Can you make a diff about which ports are used when Xolox does not run, so we can see which ports Xolox uses, which XP itself? Also you might want to read some basics about the gnutella network, here.

Basically gnutella clients (or better called gnutella 'servants', Xolox is one of them) listens on port 6346 TCP. It is possible to make the most gnutella clients listen on a different port, but the default port and most times used is 6346 (Xolox does). Gnutella will not use UDP at all.

Then you will see typically between 1-6 TCP connections from your computer (random highport) to another IP on port 6346. This is your connection to the gnutella network, and these connection will keep established as long as you stay connected to the gnutella network (you are part of the gnutella network)! Sometimes a host drops and your client will automatically try to connect to another, to keep up connection to gnutella network.
It might happen that you see a lot of old disconnected TCP connection in your netstat output (make sure you understand what the different TCP states mean). This because at startup your client will try to connect many many hosts (from the hostslist.txt or queried hosts caches)... to build a fast connection to the gnutella network.

Additionally you have one TCP connection for every file or partial you download. You remember, gnutella file transfar is P2P (direct peer to peer). Those connections are eigther from your IP (random highport) to another IP on port 6346 - or if requested an 'Push' (other host is behind firewall) you see a connection from another IP (random highport) to your IP on port 6346. Similar for file you upload.

Hope this gives a short overview. It might be tricky to interpret the netstat output, because gnutella is _not_ bound to port 6346 only, okay 99% of all clients do. It might happen that some clients run on another port (a feature to stand against e.g. RIAA attacks).
Make sure you understand network basics, TCP handshaking and gnutella protocoll.

Any further geek questions? Moak

Last edited by Moak; October 26th, 2001 at 06:32 AM.