QueryHit message

The QueryHit message, with a payload type of 0x81, is sent in response to a Query message when its search criteria matches one or more files shared by the servent. The fields of a QueryHit message are shown in table tbl:gnutellaqueryhit. All fields are in network byte order (big endian).

Table 3.5: Gnutella QueryHit message fields

Bytes	Description
0	Number of hits (elements in result set)
1-2	Port number of responding host
3-6	IP address of responding host
7-10	Speed of responding host, kb/s
11-	Result set

Each element in the result set of a QueryHit message has the fields shown in table tbl:gnutellaresultset. It has quite an odd structure with fixed length fields at the beginning and end, with variable length fields in the middle.

Table 3.6: Gnutella QueryHit result set fields

Bytes	Description
0-3	File index (unique)
4-7	File size in bytes
8-	File name, null terminated
11#11-	Extension blocks (HUGE, GGEP, plain)
12#12-	Recommended EQHD block
13#13-	Private vendor specific data
Last 16	Responding servent identifier

The extension blocks, EQHD block and private vendor specific fields are part to the Gnutella 0.6 draft. The EQHD block contains some vendor information structured in the fields shown in table tbl:gnutellaqueryhiteqhdblock. For additional details see [Gnu02].

Table 3.7: Gnutella QueryHit EQHD block

Bytes	Description
0-3	Vendor code (four case insensitive characters)
4	Open data size
5-	Open data. Flags describing servent capabilities