diff -Nuar src/core/nodes.c src/core/nodes.c
--- src/core/nodes.c	2009-09-07 12:24:57.000000000 -0400
+++ src/core/nodes.c	2009-09-07 12:29:28.000000000 -0400
@@ -5118,12 +5118,6 @@
 			wcopy(&n->addr, sizeof n->addr), GUINT_TO_POINTER(1));
 	}
 
-	/*
-	 * X-Try and X-Try-Ultrapeers -- normally only sent on 503, but some
-	 * servents always send such lines during the connection process.
-	 */
-
-	extract_header_pongs(head, n);
 
 	/*
 	 * Check that everything is OK so far for an outgoing connection: if
@@ -5134,6 +5128,23 @@
 		return;				/* node_remove() has freed s->getline */
 
 	/*
+	 * Decline handshakes from closed P2P networks politely.
+	 */
+	
+	field = header_get(head,"X-Auth-Challenge");
+	if (field) {
+
+		static const char msg[] = N_("Not a network member.");
+		node_send_error(n, 403, "%s", msg);
+		node_remove(n, "%s", _(msg));
+
+		if (GNET_PROPERTY(node_debug)) g_warning("rejecting authentication challenge from %s", node_addr(n));
+		return;
+	}
+
+
+
+	/*
 	 * Vendor-specific banning.
 	 *
 	 * This happens at step #2 of the handshaking process for incoming
@@ -5150,6 +5161,15 @@
 			return;
 		}
 	}
+	/*
+	 * X-Try and X-Try-Ultrapeers -- normally only sent on 503, but some
+	 * servents always send such lines during the connection process.
+	 *
+	 * We longer collect header pongs from banned vendors or closed
+	 * networks such as Foxy.
+	 */
+
+	extract_header_pongs(head, n);
 
 	/*
 	 * Enforce our connection count here.