Gnutella protocol

Last update: 30 March 2000
gene@wego.com

Notes

Everything is in network byte order unless otherwise noted. Byte order of the GUID is not important.
Keep in mind that every message you send can be replied by multiple hosts. Hence, Ping is used to discover hosts, as the Pong (Ping reply) contains host information.

Header

bytes summary description

0-15 Message identifier This is a Windows GUID. I'm not really sure how globally-unique this has to be. It is used to determine if a particular message has already been seen.

16 Payload descriptor (function identifier)

Value Function

0x00 Ping

0x01 Pong (Ping reply)

0x40 Push request

0x80 Query

0x81 Query hits (Query reply)

0x8c Chat

17 TTL Time to live. Each time a message is forwarded its TTL is decremented by one. If a message is received with TTL of zero (0), it should not be forwarded.

18 Hops Number of times this message has been forwarded.

19-22 Payload length The length of the ensuing payload.

Payload: ping (function 0x00)

No payload

Payload: pong (query reply) (function 0x01)

bytes summary description

0-1 Port IPv4 port number.

2-5 IP address IPv4 address.
Note: Apparently in host byte order.

6-9 Number of files Number of files the host is sharing.

10-13 Number of bytes Number of bytes the host is sharing.

Payload: query (function 0x80)

bytes summary description

0-1 Minimum speed The minimum speed, in kilobytes/sec, of hosts which should reply to this request.

2+ Search criteria Search keywords or other criteria. NULL terminated.

Payload: query hits (query reply) (function 0x81)

bytes summary description

0 Number of hits (N) The number of hits in this set. See "Result set" below.

1-2 Port IPv4 port number.

3-6 IP address IPv4 address.

7-10 Speed Speed, in kilobytes/sec, of the responding host.

11+ Result set There are N of these (see "Number of hits" above).

bytes summary description

0-3 Index Index number of file.

4-7 Size Size of file in bytes.

8+ File name Name of file. Terminated by double-NULL.

Payload: chat (function 0x8c)

bytes summary description

0-1 Pad Don't know what these are actually for.

2+ Text The chat text. NULL terminated.