Finding Gnutella packets is quite easy, because, even though they are inflated, they all begin with the same TCP headers, so they can be spotted quite easily, since all deflated message will begin the same:

Handshaking - Gnutella Specification

What my current question is: Does Phex have enough control over TCP to just the RST bit, if it is sent in excess.

__________________

-> put this banner into your own signature! <-
--
Erst im Spiel lebt der Mensch.
Nur ludantaj homoj vivas.
GnuFU.net - Gnutella For Users
Draketo.de - Shortstories, Poems, Music and strange Ideas.