I need to single out the files that shares with gnutella protocol from the network traffic
Where should i look? tcp session? udp? gnutella?

Hi acmatuk,

Didn’t you already ask that in the_gdf?

The answer still applies: The shared files aren’t transferred over the Gnutella network but over standard http 1.1 downloads with additional headers (X-Alt and X-NAlt) which allow source exchange. Browse host can be used to check one sharer at a time. Some also use RUDP for downloads („TCP over UDP“), but I don’t know much about that.

__________________

-> put this banner into your own signature! <-
--
Erst im Spiel lebt der Mensch.
Nur ludantaj homoj vivas.
GnuFU.net - Gnutella For Users
Draketo.de - Shortstories, Poems, Music and strange Ideas.

In traffic i can find the http header, for example:
urn:sha1:L2YOQAWC3EHJR3MAN2LFJ3ZGFD37YG4J HTTP/1.1
Host:
User-Agent: BearShare 5.1.0b25
Range: bytes=0-117
X-Gnutella-Content-URN: urn:sha1:L2YOQAWC3EHJR3MAN2LFJ3ZGFD37YG4J
X-Connection-Type: Broadband
FP-1a: 128,WЯhІЪ/!ь—VCЂгОµZ›VZу”ЋC$~kћЪX„Яx!¬
FP-Auth-Challenge: R4K7I3Z3YCMFFWNCIRFBDGUDG6PYMSBK
Content-Disposition: inline; filename="readme.txt"
X-Features: browse/1.0, queue/0.1, fwalt/0.1, fwt/0.1
X-Queue: 0.1

but i can't find file after it? may be it is encoded, or archived?