Examining my firewall log, I found a large number of attempts to connect ty my port 6346 (gnutella-svc). 217.148.98.1 was a particular culprit recently (one without a domain name, apparently).

I have never run, or even downloaded, gnutella.

Why are they all trying to connect to me? Perhaps they used to be talking to another machine with the same IP address (i.e., he hung up, I dialed in, I got his IP address)? If so, could gnutella please take the hint when it can't connect?

Thanks

This is definitely a FAQ - frequently asked question. I think the following threads will answer:

"6346 Hits"
http://gnutellaforums.com/showthread...&threadid=3938

"How do i UNregister a server from the Gnutella network?"
http://gnutellaforums.com/showthread...&threadid=4400

Thanks for the FAQ pointers, but I'd like to get a bit more technical than the FAQs did.

As might be suggested by the FAQs, gnutella doesn't seem to get the hint when a peer disconnects. Perhaps it was created in an environment mostly consisting of static IP addresses?

On the other hand, there could be something wrong with the setup of my firewall software. Is there some sort of protocol response my machine should send back that would make gnutella realize it should probably give up? It looks like I'm probably sending back "destination unreachable" messages, but do I need to allow incoming "echo" packets as well?

P.S. Is there a better place to ask such a technical question?

Thanks

Yes, it seems some Gnutella clients (only older ones?) likes to "hammer" IPs for even longer time. If this is occurs only seldom in your packetfilter logfile, just ignore it! This is because of the distributed nature of Gnutella: It happens that Gnutella clients tries to reach a peer after it has gone offline (perhaps it will come back or is only temporarily away due to physical network problems). Together with dynamic IPs it happens that someone sees an incoming Gnutella connect attempt (port 6346/6347 usually) without ever running a gnutella client. Ignore it, it's just a knock at the wrong door. Someone had your IP before and did run a Gnutella client.

Unfortunatly it seems some bad/old clients try hammering old peers for a longer time, I think you can call this misbehaviour flooding (but it's not eaten up bandwith, it's just anoying). However this is an issue for further improvements, perhaps some Gnutella clients could evalute TCP/IP error codes better. I'm not sure if this topic was discussed before, perhaps more people have to complain about it loud enough. :-)

PS: I told something similar in another thread the last days (see below), but I reposted here to avoid sending you allover this forum. *g* http://www.gnutellaforums.com/showth...&threadid=6894

Thanks again, Moak.

A suggestion that just occurred to me is this. Perhaps in your session initiation protocol each peer could communicate to the other whether it's using a dynamic IP address to connect to the Internet. That way, when the connection is lost, the remaining peer could stop trying, since it's likely that the original peer will have a different IP address next time.

Again, it seems like this is a protocol designed for static IP addresses. I hope it doesn't expect domain names to remain static as well! In the modern world, where universal ad-hoc connectivity is becoming the norm, perhaps some changes should be made.

By the way, I was getting a _lot_ of connect attempts, not just a few. There were also many attempts to connect to port 137 (NETBIOS?).

Thanks for all the help

Hi, you're welcome!

To answer your questions (as far as I could):
Gnutella protocol is full IP based (IPv4 yet), not hostname based. I don't think that Gnutella is designed for static networks, actually itself has a very dynamic structure! Disapearing hosts and too simple programmed retry attempts are causing this annoyance IMHO. There is allready a new BYE-descriptor in development, which hopefully decreases the unwanted connects. But I think further investigations and a rety with more AI (intelligence) would be appreciated. If you want to talk with other Gnutella client developers, subscribe to the_GDF mailinglist - or just use the Development Forum here. The GDF is linked in the sticky thread in the Development Forum, klick here.

Netbios is AFAIK typical for script kiddies trying to find a (MS Windows) vulnerabity on your PC. Better use a packetfilter or better firewall concept when being online.

Greets, Moak