Sorry, I meant see first posting in this thread for full specification of data sent. Posting, not e-mail! :

Some servents block out mp3 and some other words. Otherwise, everyone would search for mp3 and we'd have thousands of query hits flying back and forth, flooding the network. I suggest trying some other words, ones that give some responses when you search for them on your other gnutella servents. I get responses when I search for mp3, but I know I'm not getting the responses I would if newer servents weren't blocking queries like that.

Here is how I send queries -

0-15: GUID 16 numbers [same as ping GUID]
16: 0x80
17: ttl 7
18: hops 0
19: querylength+3
20-22: all 0's
23-24: all 0's
25 through querylength+25 : query
26+querylength: 0

I had trouble initially. I develop on Unix (Linux). What I did was install gnut, a working Gnutella servent and then tcpdump so I could see how it was sending queries properly. Then I ran tcpdump on my program and saw where I had gone wrong and fixed it.

There's a Windows version of tcpdump called windump, although I haven't used it. Tcpdump (and probably windump or some other packet sniffer) is quite handy in helping debug many Gnutella problems.

Unfortunately I dont think the problem is my query, since it is just like yours! I keep getting closed connection right after my query is sent!

If the connection is closed right after you sent the query request, the host you were connected to, could not read your query properly and dropped the connection because of an invalid gnutella message.

So the problem has to be your query.

Look at some source code for other clients, that should clear things up. Byte order is always a problem, and make sure you are sending out the correct bytes, you can screw up and send out the upper part of a word easily.

Ehh, guys thanks for the replies, everyone is saying my query is wrong. But I've posted (first posting in this thread) how it exactly looks. From there you can tell that I've used little-endian byte order. I dont see anything wrong!

ps. I know obviously I'm doing something wrong, since other clients are working. But do you guys see anything wrong with my query? ds.

No but obviously the other clients do (and I assume you mean more than one drops you).
Computers are much better than we are at telling if something is one byte off.
Why not post for us a actual hex dump from your connection at the TCP/IP side?
And compare that with a hex dump from some other working client.
So much fun.

Your Query might look OK in the code, but does it actually send out correctly? For example, does it send a the Query header, then a Pong, then the remainder of the Query? (because you're not controlling the outgoing flow).

What you should do, is install a number of Gnutella clients on your own system, then connect to them with your Gnutella client (make sure, each other Gnutella client uses a different port, of course). Once you've done that, send out the query and see how the other clients respond (ie., any error messages etc. BearShare provides fairly decent info on that, so does GTK-gnutella).

I've checked that the code is correct using the VC++ debugger + SoftICE, also double checked the outgoing flow with NC (netcat) and tcpdump...

Note, I'm using 0.4 and not the rich 0.6 protocol.

Why should I send a PONG after the QUERY?? I dont understand that...

thnx

No, it was just an example of what might happen if you if two functions would write to the same socket at the same time (query handler and ping handler).

Did you try installing another Gnutella client on your system though? I think it'll really be helpful in debugging - certainly has been for me. Try the Gnutella client that use the "BYE" message, such as GTK-Gnutella or Shareaza (the new one).