Let's say you have a fast host with 500 connections. All this host does is spamming the network with spoofed query results for any incoming query. Or maybe it arbitrarily changes the IP numbers and GUIDs of all messages passing through it. - Those messages will be spread by the other clients throughout the network and lots of traffic will be caused making gnutella unusable.

It could be even worse, if a node floods gnutella with queries. It could give every query a different GUID & IP address and disconnect / reconnect very frequently, claiming it was just a normal LimeWire node.

I supposed you were talking about a typical DOS attack .
You're right but you're talking about malicious written clients .
That's not a typical DOS attack .

If you drop the term "DOS" , everone assumes youre talking about CPU , memory and connection overloads .

Well, DOS just means denial of service. There are quite a lot of denial of service attacks (e.g. against computers with personal firewalls, by simulating a DOS attack from the hosts DNS, which causes the firewall to block the DNS) that doesn't work by causing overloads of CPU, memory or connections...

Yes , there are lots of kinds of DOS attacks .
But I said it wasn't a typical DOS attack .
Under typical I mean , fill a connection with random data coming from random IP's (IP spoofing)

Then 2 things can happen :
- His machine crashes either by memory shortage or CPU overload .
- His connection overloads and he's forced of the net .