Hello,

I am writing a program I want to use to detect queries using the libraries from Wireshark (a network protocol analyzer). The problem is not the program, but the Limewire I want to detect queries from.

I have Limewire 4.18.3, which after a few hours of being up is connected as an Ultrapeer. I make a search through the user interface and get some results. I use at the same time Wireshark (for testing purposes) to capture the packets sent to my computer so that I can trace the query sent by Limewire and the queryhits sent by the other peers/leafs. Most of the packets flow through TCP connections, I assume the same connections established with my peers/leafs. Some queryhits arrive through UDP.

The problem is that I can't recognize any of the messages (query and queryhits), because they look like encrypted (in the TCP case). None of the messages I capture follow the Gnutella specification. They just have garbage (to me, but not to Limewire). The only way to recognize something (at least parts of it, in which case the packet follow the Gnutella specification) is when the queryhit arrives through UDP. I don't have a clue why this is happening because Gnutella is open and I should see all the fields of the protocol in the packet trace and easily recognize a queryhit. The same case for a query.

Do any of you have a clue why this is happening? I have done this with Bearshare and the same happens. Is there something I am missing here? I know queryhits might flow through the TCP connections, but encrypted??

thanks all!
Mike