Shields up! will allow you to test the security of your Internet conection. If you have a firerwall, you will know if it is correctyl configured. If you don’t, you will know what risks you are taking.

I invite you to visit the rest of the web site, too. It covers security aspects linked to an Internet connection (more for personal computers than enterprise networks, though). You will even find good comparisons and selection of tools like personal firewalls. Recommended.

I noticed the market emergence of nano-computers like Android boxes or Raspberry Pi which allow to easily setup services that may have been prohibitely expensive in the past.

So, I decided to pruchase a Raspberry Pi 3 B+ (a rather cheap network little box, with low power consumption, able to stay online permanently, and easily configurable). I wanted to start by deploying the minimal network services to give me maximum agency.

Minimum feature set included:

• A DHCP server (to assign IP addresses on the local network with ability to fix some of them in a static list, for easier management)
• A DNS server providing
  • DNS request cache (to speed up the overall Internet access of my Internet users)
  • Delivery of local network names
  • Capacity to allow future DNS filtering (I don’t care much about adult-content filtering, but I’d like to stop some of the phishers, even if these two activities are technically identical)

In the future, some more services may come handy (nothing of this has been studied here):

• An NTP server (for time)
• A WINS Windows names server

Comparison

As a matter of fact, I noticed that two serveurs seemed able to simultanesouly provide DHCP and DNS: Unbound and dsnmasq.

Unbound highlights:

• Lightweight server
• DNSSEC support
• rather security-oriented
• No DNS authoritative server (but able to handle a local domain)

dnsmasq highlights:

• Lightweight server
• DNSSEC support
• DHCP and DNS are integrated in the same server
• May use /etc/hosts to feed DNS
• No DNS recursive server (only forward to an authoritative/recursive like 8.8.8.8 or 9.9.9.9 or your ISP DNS server)
• No DNS authoritative server (but able to handle a local domain)

I chose dnsmasq, mainly because of the DNS + DHCP integration.

Some surprising discoveries

Première information vite découverte : les serveurs NAS Synology sont tout à fait incompatibles avec le filtrage de DNS de CleanBrowsing. Celui-ci compte synology.me (service nécessaire pour le DDNS de Synology) dans les domaines à risque. De nombreux services du NAS cessent immédiatement de fonctionner.

Je n’ai pas vérifié mais il est probable que de nombreux autres services DDNS (Dynamic DNS) soient black-listés pour les mêmes raisons : devant le nombre de petits serveurs Synology (ou autres) mal configurés, ces DDNS renvoient sans doute vers une forte proportion de domaines qui ont été pris en otage par les hackers.

Il faut donc pouvoir gérer cela plus finement si vous avez vous-même votre propre NAS Synology (et sans doute d’autres marques).

Observations

After a few months of dnsmasq use on Rapsberry Pi, it is time to comment and share my experience.

First, this worked really well. Even if I had one case of locked down DHCP server (no warning, no error, but killed). I tried finding why, but it was far easier to reboot the server box (On-Off switch) to restore the service. Of course, a few minutes of digging into logs did bring me some worried looks from another network user…

The DNS filter setup to remove access to some risky domains work perfectly well. But, I have to admit that nothing seems to have triggered that (except my tests). Since this is not the only security barrier on my network, this may be OK. For the record, here is the filter creation script I use:

#!/bin/sh
#Dated 2020-11-10 1.0 Addition of --quiet to wget (to reduce clutter to /var/mail/pi)
#                     *** STABLE RELEASE ***

cd /var/lib/work

#Get anti-phishing filter lists from Internet
wget -q -O ./isc-low.txt 'https://isc.sans.edu/feeds/suspiciousdomains_Low.txt'
wget -q -O ./isc-med.txt 'https://isc.sans.edu/feeds/suspiciousdomains_Medium.txt'
wget -q -O ./isc-hig.txt 'https://isc.sans.edu/feeds/suspiciousdomains_High.txt'
wget -q -O ./yoyo.dnsmasq.txt 'https://pgl.yoyo.org/adservers/serverlist.php?hostformat=dnsmasq&hostformat=nohtml&showintro=0&mimetype=plaintext'
#Remodel the lists into DNSmasq filters
catcherIP='192.168.1.250'
inputfile="./isc-med.txt"
tmpfile="/tmp/.adlist.$$"
tmpconffile="/tmp/.dnsmasq.conf.$$"
configfile="/etc/dnsmasq.filter.conf"
configheader="/etc/dnsmasq.filter.header"

#Start with putting our own header
    [ -f "$configheader" ] && cat $configheader >> $tmpconffile
#check if TmpFile could be init'd with header
if [ ! -s $tmpconffile ]
then
    echo "temp fil '$tmpconffile' could not be found or is empty; quitting"
    exit
fi
#Remove list headers
cat $inputfile | grep -v "^#" | grep -v "^Site$" > $tmpfile
#Buid list to DNSmasq format, and add it to the file
sed "s/(.*)/address=\/\1\/${catcherIP}/" $tmpfile >> $tmpconffile
#Move the final list to destination
sudo cp $tmpconffile $configfile

One of the advantages of this server is its speed. I may have been slightly worried (or attentive) before knowing the Raspberry Pi, but there was no reason. Maybe because of the low workload (despite an HTTP server, some distant connexions, and a few local scripts) and because of the good power developed by the CPU, everything is fine and dandy even when a dozen clients are pounding the DNS server (the iPhones are quite insistant in using the netowrk on a continuous basis)).

dnsmasq is perfectly able t manageIPv6 DHCP, and correspondingIPv6 DNS. Documentation about this is terse (if not simply lacking), but it works well and I learned quite a few things. The Raspberry Pi was so reliable that it was IPv6 proxy during some of my tests without any perceptible impact. (I was rightfully impressed).

After initially using dynamic address allocation, I moved the DHCP server into a nearly exclusively static configuration (my own choice in order to have easier local client identification). No big deal, neither in IPv4 nor in IPv6.

Conclusion: Totally positive.

In the future, I may be tempted to deploy more powerful servers for DHCP and DNS for a wider support (maybe or maybe not) and to try a network spy like SNORT or SURICATA. But this is a completely different story. And, in this case, I may be tempted to go to a really powerful solution (I have an Avenger96 under initial trial, but its software support seems to be a real mess).

A few other interesting links

• A few other solutions for a DHCP server:
  • DNSmasq installation (DHCP only)
  • Dragon: DNSmasq installation (DHCP + DNS)
  • Instructables: installation for DNSmasq (DHCP & DNS)
  • ISC-DHCP server on Debian
  • ISC-DHCP server on Ubuntu
  • Tools designed to work with ISC-DHCP
  • Fast instructions for installing DHCP, DNS, and NTP on Raspberry Pi
• Some data about installation of another DNS server:
  • BIND local-mode DNS server on Debian 9
  • BIND authoritative DNS server on Ubuntu
  • BIND “caching” or “forward-only” DNS server on Ubuntu
• DNS filters:
  • THE guide on cleaning DNS from public domain lists
• Setup of a LaSynology NAS or router:
  • Configuration of a DNS server on DSM
• Server comparisons:
  • BIND vs. dnsmasq vs PowerDNS vs Unbound
    
    
    
    

So, I wanted to use my old Chromecast 2013 (but the issue and its solution are exactly the same on a more recent model) to cast a photo slideshow on a TV set which is sitting mostly unused in the kitchen of our flat. But, this did not appear easy to do from Chrome (at least not easy to me).

I finally ended up with this solution: Use IrfanView to bring a slideshow to the PC screen (a laptop of a desktop will both be easy enough, but a Mac would do). Then, I ask my Chrome browser to cast the desktop to the TV further on the network. Nothing fancy, nothing elegant, but I was looking for too complicated or Chrome-integrated…

1. Backups
2. Synchronization between several machines (several PC and several iPhone)

CrashPlan easily provided the backup feature despite a high volume of photo files (more than 2 TB as of today), but was relatively poor interms of synchronization. So, it was time to spend some energy defining the whole need/specification and finding a true solution.

Specification

For backup, my requirements have long been defined:

1. At least three backup copies
2. At least two different technologies (e.g; not to rely only on optical drives or hard drives)
3. At least one off-site location (to be protected against theft, fire hazards, etc., think off-site, or cloud, or external/bank safe box)

For synchronization, previous use of DropBox and Evernote (on small volumes) allowed me to confirm the precise needs I had:

1. Real-time sharing of some critical files with daily updates (as for Evernote note files, or the database for my password management application, etc.)
2. Encryption of all comms (I don’t want to leak my passwords or my bank account data).

Solution

I was clearly influenced by several factors in my choice, and I will try and make these explicit (your solution may not be strictly identical to mine). So, let’s start by what I chose to deploy.

A smal file server (a Synology DS413j) at my home. It hosts 4 hard drives of 3 TB (initially, four Western Digital RED) in SHR/RAID 5 mode for a total capacity of 6 TB.

The large capacity was defintely dictated by the the need to host a large multimedia server and a large quantity of digital photos (Today, we have altogether much more than 100.000 pictures on this server).

The choice of RAID 5 was a very early one because of its optimum balance between overall dedundancy (you can loose one hard drive with no data loss) and cost (you loose less data to redundancy than in other two-disk RAID configurations). The Synology SHR technology is even better because is allows disks with different capacities (the two smaller ones define the maximum capacity. So, you’d better have one 500 GB with three 4 TB bigger ones; It would be a waste) and it accepts (like all RAIDs) to replace one failed drive with a new one (during the rebuilding of RAID/SHR, you have no more data protection but this is temporairy – and you can keep working in paralle).

Going to Synology was even more justified by a single important item rarely listed in RAID sevrer comparisons: The software offering is specially attractive at Synology. DSM (Synology OS) hosts  “packages” for many applications. The complements I installed (see below) are provided as ready-to-use instalations and can be easy to install even if you have minimal understanding of the inner workings of a server.

So, I was able to deploy a two-stage solution:

1. PC-to-Synology synchronization (three PC via Cloud Station Server)
2. Synology-to-Amazon synchronization (Amazon Cloud Drive through Cloud Sync)

Cloud Station Server and Cloud Sync are two applications from Synology which are installed in about 5-6 minutes (including download time) from the  “Packages Center” of Synology DSM.

If we start looking at the synchronization between PC (or iPhone) and Synology, merely opening the Cloud Station Server in the list below (in the management interface of my Synology DS413j DSM) leads us directly to a menu allowing to download the Windows application (or iPhone app) to install before starting synchronizations between PC and Synology cloud server.

A few clicks and it’s done. Nothing could be simpler. a few minutes and synchronization is starting. It runs in background (it does not hinder normal PC activity) and you will only notice the new change to the file icons showing that it is already synched ot the cloud (see examples below) or that it is still waiting for synchronization (blue tag).

At this point, PC are synchronized, via the Synology server. You can consider that this is a backup since I chose to keep all most recent 32 versions of each file modifications and to not let Synology wipe deleted files (they are stored in the server dust-bin). So, this is a Time Machine feature on top of a backup.

Important notice: The synchronisation between PC and Synology cloud server is very fast and does not eat up resource even on a small/old PC (contrary to some backup programs I would not dare name, like Cobian Backup). this is re-assuring: The end-users can forget about the backup running in the background, stopping if the PC goes to sleep and starting again when it wakes up. This whole process has nearly no impact on the PC behaviour.

Similarly, the iPhone and iPad can use synchronization (of some files, I don’t want them overwhelmed) when on the move.

The second feature replicates these data to another location (here, I chose to synchronize with Amazon Cloud Drive aka ACD because its cost is only 70€/an which appears very reasonable and can be reduced if you have Amazon Prime and a lot of photos). I understood that transfer speed would be limited by my RAID server (the DS413j is quite old and has a very cheap ARM CPU, but it defintely did not break the bank) rather than my bandwidth (I have optical fiber broadban) or by Amazon (all users observe that Amazon is going fast).

Synology Cloud Sync provides this in a matter of a few clicks. Just provide your Amazon login and password. Synology will do it all for you. Synchronization will start in a minute at most (I tried it with Google Drive too. this is as simple and as fast – bandwidth is quite high, which is a good thing; I thought about trying c hubic from OVH, but Internet comments and face-to-face talks with past users seem to point to a product without the needed performance and reliability you want here).

Observations

A few remarks I may have to add after some real-life use:

• The DS413j has a very small CPU from ARM. the CPU workload stays very high (~100%) during all the synchronization phase.
• The first synchronization is lenghty (several days or several weeks depending on the data volume). I recommend to build the data set progressively (not to bunch all your data on the first day).
• Next synchros will generally be much faster (nearly instantaneous).
• Recently modified files tend to be synchronized first.
• I used Cloud Sync to link my server to Amazon, but there is also a solution to synchronize from Synology to Synology: Cloud Station Share Sync. I did not try it but it could be worht exploring if you already have to geographical locations (A second home? A company with two offices?) and two Synology servers. It seems to be as simple as synchronizing with Amazon Cloud Drive.

• In order to elevate the RAID server reliability, you’d better choose hard drives designed for 24/7 use. I would point to Western Digital RED (specailly designed for RAID servers) or Hitachi UltraStar (24/7 version of the DeskStar drives). Also, if you can avoid having all 4 or 5 identical drives, it will reduce the risk of seeing them all failing nearly simultaneously. See BackBlaze statistics on hard drives reliability.
• You may ask where are my “three backup copies”. I actually have the following:
  • The original files on a master PC
  • A manually-copied copy on a separate hard drive (at least one, sometimes two or three of them on spare drives)
  • A synchronzied copy on the Synology server
  • A synchronized copy on Amazon Cloud Drive
• While the Synology DS413j is no longer listed, you can stil purchase the DS416j ou DS418j.
• On the Synology NAS server, I ensured that the synchronized directory is not visible to Windows: A ransomware can’t see it, it would have to hack through the Synology software. this is protecting me against those ransomwares which try to encrypt netork drives too. (Anyway, I can still control my data through the web interface of DSM).
• If a ransomware tries to encrpyt my files (they may then be synchronized in encrypted form), I made sure that versioning is enabled on Synology (This way, I could travel back in time and avoid “paying the ransom”).

Now, Roumazeilles.net helps you and can be transparently accessed through both addresses:

https://www.Roumazeilles.net/

http://www.Roumazeilles.net/

For most people, this will change nothing. For those who prefer to keep some of their browsing (a little more) discreet, it may help.

Useful reading: HTTPS Everywhere | Electronic Frontier Foundation

If you really want to go into more gory technical details, I can mention that this move was made possible (easy) by my web hosting provider (OVH) who provides a free SSL certificate that I only needed to enable in my administration interface.

I’ve got a Fiber connexion to the Internet (at Numéricable, one of the main ISP in France) which is forcing a dynamic IP address on me (no fixed IP address, even with a premium; They’ve settled in the XXth century). This would not be very serious except that I host a RAID server from Synology (a DS413j DiskStation with 4 hard drives in RAID-5 redundant mode) which provides several services I would like to share with the Internet (while I’m travelling with my iPhone or my laptop, I’d like to get access to my files through FTP, or my email server).

So, I decided to set things right in order to appropriately locate the Synology DiskStation in a sub-domain of my own (e.g. mail.roumazeilles.net).

The solution I opted for:

Dynamic IP addess:

Since my IP address is dynamic, there’s no way I can progress until I solved this single issue. I chose to use the DDNS service DDNS from Synology. Since I use DSM 5.0 (the most recent software version from Synology), I can reach the appropriate option through the control panel and the “External access” menu. I just added a DDNS, selecting Synology as a service supplier, and I recorded the name I wanted (let’s say ds). From this point, despite the IP address changes, my DiskStation is always accessible at ds.synology.me.

DNS subdomain:

After that, I need to point mail.roumazeilles.net onto ds.synology.me. This is slightly more complex because my roumazeilles.net domain nam is reserved atz Gandi and it is pointed toward a server hosted by OVH. It’s the hosted server (rented from OVH) which includes all the information relating to roumazeilles.net. So, I went to my server control panel and, in its DNS configuration, I modified (in your case, you may need to add) a CNAME record.

mail 10800 IN CNAME ds.synology.me. (Don’t forget the final dot/period in your CNAME entry, or it won’t work!)
Since I am lucky, my control panel at OVH includes an easy way to get the correct syntax (it’s safer): I tell it the mail subdomain is described by a CNAME record pointing to ds.synology.me (a bit terse, but not difficult).

Then, I only had to wait for the DNS information to “propagate” (from a few minutes to a few hours, sometimes up to 24-48 hours). And a little check using ping mail.roumazeilles.net confirmed that it answered from my Numéricable IP address.

The Kermit Project is canceled, effective 1 July 2011.

I think that I actually started using Kermit on a Vax 11/780 computer from Digital Equipment Corporation to exchange data between various microprocessor-based small systems.

This was top-notch high-end computer science… then.

In the beginning was Google which installed its servers in China in 2006. The “do no evil” company accepted the conditions of the government of the PRC and included heavy filtering and censoring of its search results (looking for Tienanmen will produce wildly different results in and out of China). But in January 2009, Google discovered that some hackers obtained some detailed information out of its own servers at this was targeting both American companies and Chinese political opponents or partisans of free speech in China. Subsequently, Google announced its intention of both lifting the censorship and leaving China.

What is still very unclear:

• Is Google really serious about these two options?
• Is the main reason for its ire, the political chase or the technological spying? (the US government including Hilary Clinton pushed hard with Google)

What is clear:

• The breach of information seems limited (only email subject lines have been breached, not contents).
• The hackers were affiliated to Chinese official bodies and did not only target Google.
• The hackers used some social engineering and security issues present in Internet Explorer and Adobe PDF, which were probably known but not closed by Microsoft and Adobe.

So, when such information appears in wide open channels of the world press, what happens? Most experts started commenting on the security loopholes in Internet Explorer 6 (and about Adobe PDF reader, too). Many people observed that Internet Explorer 6 is rather old and it is unfortunate that so many people still use it despite the known fact that it is a security liability when browsing the Internet. With such a rush, some very official people also asked for replacement of Internet Explorer (mainly v6) to be replaced with more modern browsers. Even representatives of the German, French and Australian governments asked their countries to replace Internet Explorer with something else.

The competition has seen this as a godsend since it created a rush for the other available browsers. For example (see the graph on the side), Firefox saw a brutal explosion of its downloads in Germany (nearly 300,000 Germans have downloaded Firefox in four days): about three times more than usual. It has been true in other countries even if it was not measured as precisely, and it has been observed by the other browsers Opera, Safari, Chrome (currently profiting from heavy advertising in some European countries like France).

This was definitely a good thing since it was bringing better browsers to many computers. It could have stayed there but there were several reaction and parallel events happening at the same time. The first one was that Firefox was preparing a major upgrade to the successful browser (in many parts of the world Firefox is now used by more Internet users than Internet Explorer). Named v3.6, this new version is bigger than what could have been expected from its small number increase (from 3.5 to 3.6 should have been a minor upgrade). This major event accelerated the rush, with people looking for features like:

• Built-in skins, to make it more personalized
• Faster, more stable
• More security conscious with the addition of user-level messages about risks, including reminders about what plug-ins are outdated and must be upgraded.
• Visual tab previews, which show you the tabs when you press Ctrl-Tab
• Aptitude to browse without leaving too many footsteps and traces in your PC (good for clean browsing like when you visit Adult sites)

This version is also appreciated by developers who will find a bunch of little improvements (like CSS gradients).

This is not only a great story to read. This is a great browser and you should consider downloading Firefox 3.6 now!

If you are not completely convinced, you should also consider downloading the newest Opera browser. Opera v10.10 has been available for a few months now and it also offering these advantages, plus some neat features like:

• Opera Unite: to easily share information between Opera users and browsers, without using a web site or a share folder on some social network.
• Opera Turbo: to adapt Opera to very slow Internet connections.
• Speed dial: to get a faster access to some web sites you choose (bookmarks on steroids).
• Mouse moves for faster commands.
• Opera link: to share bookmarks, speed dial configurations between several machines where you use Opera.

Opera is clearly my preferred browsing solution (even if I need to test my web sites on everything I can find, Opera is the central hub of my Internet browsing). Go and download Opera v10.10 now.

And, if you are not sure yet, I can also offer the small and fast browser from Google: Chrome. Since it all started around Google and China, it was worth mentioning, of course.

All this has been going so fast that Microsoft needed to do something. Of course, they have a newer version of Internet Explorer (IE8 is included in Windows 7 and can be downloaded freely. But this was not enough, too many people were starting to complain that Microsoft may wait about a month before updating IE6 in the normal update cycle. Even worse, some experts started telling the world that Microsoft actually was aware of this flaw in IE6 for many months. In such conditions, not doing anything usually turns out to produce a public relations nightmare and prepares for bad wind.

So, Microsoft rushed an out-of-band update to IE6 and Windows Update is now offering the correction to all Windows users still using IE6 (of course, you still have to use Windows Update and it is well known that too many people do not have this configured or do not accept the proposed updates – this is wrong and one the reasons so many PCs are infected with Trojan horses, virus and adwares). Now, if you did not move to a later Windows version and if you did not take advantage of the much better IE7 or IE8, it’s time to upgrade your old hag.

We can expect to see a few more updates to this story in the future, but there is a lesson to be learned (by Google, and most Internet users):

Always keep your browser up-to-date and refrain from clicking on any link in a mail message you did not expect.

Additionally, there is a lesson for Microsoft:

Sorry! but even the older software has to be kept alive when you are or have been the near-monopoly on this technology. This comes with responsibilities.

Version 1.7 of Cygnus is now available that supports Windows 7 (but drops support for Windows 95, 98 & Me).

As if this was not enough, this version also has the capability to configure IPv6 (if you are already attracted by this solution) or supports multiple installations.

Cygnus v1.7-1.1 new release.

There are few things that you can do to significantly improve the speed of your Internet connection. Of course, you can switch to another Internet Service Provider, but it’s a mess. On the opposite, it is easy to have an sub-optimal connection because of the response time of the DNS server of your Internet Provider. This server offers a translation service a domain name (for example, www.roumazeilles.net) into its equivalent numeric IP address (the only one that the web browser really understands and needs).

But all DNS servers are not born equal and if those offered by your Internet Service Provider (ISP) have an advantage (they are nearer to your own computer), they are not always the fastest ones. NameBench gives you the opportunity to easily and automatically check what DNS server is the most efficient (and to compare it with your own current DNS configuration).

In my own personal case, I just reduced DNS times by 50% (no less!) while I thought I had a rather good configuration. As a matter of fact, Neuf Telecom servers are faster that those from Free…

This works on Windows, MacOS as well as GNU/Linux.

By the way, for those of you who may be wondering, Yes! I included the all new Google DNS as one of the tested options and it was far slower than most of the other freely available possibilities.

It’s worth noticing it if you are using Opera. I had a difficult-to-solve issue recently.

While playing with the idea of starting to use IPv6 on my main PC, I tested the waters by validating this option in the network configuration of my Windows XP. Unfortunately, Opera is already fully ready for IPv6 but my router box is not. So, the first effect it had is that Opera decided to enforce the use of IPv6 for all web sites that mentioned IPv6 capacity in their DNS (not many of them, but Google and Free.fr my ISP are already in the list). The immediate effect was that Opera tried to connect to them in IPv6 but failed (because the rest of my home configuration is not 100% IPv6). For 99% of all web sites, there was no difference…

It took me several days (and some Googling – using Safari and Chrome) to understand that this is a known issue and to remove the (still) useless IPv6 Windows configuration.

I’ll have to upgrade my router and try again.

Actually, your browser knows a lot about you. Some scientists believe that from your browsing habits they can recognize fairly precisely if you’re a man or a woman.

Using your browser URL history to estimate gender

Be patient, it may be long.

According to it, I am a man…

I thought about this when I saw that in the US, CableVision was offering 100Mbps at 99$ per month (and AT&T offers 18Mbps for 80$ per month).

Competition is king for driving broadband (ADSL or cable) prices down.

As with many a BitTorrent client, µTorrent or uTorrent tends to have a relatively complex configuration. Many options, some of them utterly cryptic, a lot of them with a possible impact on performance. After months of tweaking, I think that I have obtained a configuration that is clearly optimized to download several giga-byte-sized packages (videos/movies, Linux distributions, full databases, etc.) on a fast ADSL connection (20Mbit/s, here).

So I was suggested to share it with all the ones who want to try and get quickly a BitTorrent connection working as fast as possible.

All the options

I don’t need to explain the choice of language (µTorrent has one great advantage of having such a large choice for localization).

I did not install IPv6 support (my ISP does not support it), but it is a very critical item to check because -as soon as it becomes readily available- it will bring a significant layer of compression and obfuscation to avoid your ISP throttling down your P2P traffic (as some US and Canada ISPs currently do; Shame on them!).

I don’t care receiving the beta upgrades (I’m all for the stability of software) and I favor browsing as anonymously as reasonably possible.

Since I am working at home, there is no need for the anti-boss key.

Download: I prefer to immediately pre-allocate file size (rather than seeing the software program stop later because it has been eating up all disk space), and I don’t want to the PC to shut itslef down while downloading. While it is generally good to reduce electricity consumption, stopping in mid-transfer is not good for the efficiency of the whole process.

We have to admit that display options are mostly a matter of taste. You can see mine, but feel free to choose others to your liking. These should not affect performance except if you decide to not start the downloads automatically (you still can start them manually, though).

If you download a lot of BitTorrent files, it may be worth organizing your downloads. I put everything in a common directory (C:\Download from Internet\ as you can see) and avoid moving them around (even when finished). However, I prefer to store the torrents themselves in a separate sub-directory (C:\Download from Internet\Torrents) for an easier management.

In order to make things easy, torrents that are downloaded in the download directory (C:\Download from Internet\) are first detected, then started, then moved into their own sub-directory (C:\Download from Internet\Torrents). This means that even if µTorrent is not started, I can download torrent files in the normal download directory, as anything else, but as soon as uTorrent starts, it will recognize the request.

One added little advantage is that if I put any torrent file in this directory (even from a remote machine) P2P download will start automatically. It is easy to setup a script in your email program to drop torrent files from email and thus to have your PC remotely starting downloads. Even from your iPhone, for example. This becomes Remote BitTorrent for iPhone.

The connexion port is allocated randomly in order to avoid issues with your ISP. Just make sure that this port is open in the firewall of your router. For your own computer, using UPnP and NAT-PMP to ensure that you optimize going through your local network and router.

Do not allow changing port at each startup. It would really mess with your router and other firewalls.

If possible, do not use any proxy (it would eat a significant performance and P2P-over-Proxy may not be acceptable by your ISP – read your contract).

This page is certainly the most important one (performance-wise). You may want to allow the automatic speed throttling, but I found that it was good to set it up manually. First, limit the upload to 80-90% of your upload stream capacity (check with your ISP). The little margin allows to have some capacity to do something else (like browsing Roumazeilles.net).

I admit that I limit a little more when I have no download to do, but this is not important here.

The number of connections should be high. Since I have 2GB (and now 4GB) of central memory on WinXP, there is no strict reason to limit myself, other than the fact that going over 1000 connections means that the computer spends more time handling connections than downloading. The ratio of 5:1 or 6:1 between connections and clients helps favor very efficient peers (those bringing most of the download rate).

On the other hand, I don’t want to spend all my bandwidth serving too many P2P clients. 6 is OK. If a couple of them are slow, it’s still possible to speed up on 4. That way, my computer sends data as fast as possible but does not negotiate a lot with others (essentially, it’s “let’s queue them rather than serving them all”).

DHT: You want DHT! This is one great way to find more clients, to keep them if the server is down, to grow the swarm for maximum speed.

Local search may be usable if there are other local users on your LAN (are you in a company? in a University?). It’s not critical for my own home LAN, though.

As far as possible, I want to encrypt my communications. It does not add a lot of invisibility, but it reduces the chances of seeing my ISP filter my traffic.

Here don’t let uTorrent add too many torrents at the same time. Downloading 3, 4, 5, 6 torrents is OK. This tends to max up the connection if they are active, but don’t set it up for more. I prefer to have my torrents arriving one after the other day after day, rather than all after a week of download.

Default values for sharing are OK, I guess.

I do not use planification. Let’s go fast. That’s all.
I do not use the WebUI.
The only Advanced features worth messing are:

Basic parameters for the cache are just that: Basic.

But the advanced parameters could be a little more important.

Growing the read cache size automatically could be an issue if you are near the disk space limit. So, I prefer not to allow this feature (which is only useful in extreme conditions, anyway).

While the Windows write cache seems useless or not efficient, the Windows read cache is important for some disk drives (especially if you are using external USB disk drives).

Main advantage: When my PC stops working perfectly, I can easily recognize what changed. Usually, I (like everybody else) say that I did not touch anaything before it stopped working. Bit when I check, I can find wat I did.

It also works for the configuration of a Local Area Network… even in a company. But beware of not writing down passwords that would then be left in an open paper book…

This is why, while the Internet Engineering Task Force (IETF) was preparing a night without IPv4 to reach the largest possible public, Google launched a version of its search engine reserved to IPv6: ipv6.google.com (If you are like almost everybody, you will not see anything at the end of the link).

Now, we all have to switch as soon as possible.

• noc.uncu.edu.ar
• gopher.broggio.com.ar
• www-proxy.tecan.co.at
• proxy.co.rmit.edu.au
• bdcssc.dchs.tas.gov.au
• proxy.cybertelecom.com.br
• plattys.com.br
• proxy.cslouis-hemon.qc.ca
• ecarh29c.nortel.ca
• pcsoft.szptt.net.cn
• proxy.iprolink.ch
• isoe.isoe.ch
• caiquen.concep.reuna.cl
• proxy.multiphone.net.co
• webcache.ms.mff.cuni.cz
• proxy.logix.cz
• proxye1-atm.maine.rr.com
• proxy.magusnet.com
• proxy2.lsil.com
• infosun-fd.rus.uni-stuttgart.de
• www-cache.mppmu.mpg.de
• proxy.internord.dk
• transend3.CS.Berkeley.EDU
• Brahma.CC.PurdueNC.Edu
• linux.softec.es
• carpanta.lsi.upc.es
• proxy.inet.fi
• www-cache.tpu.fi
• indigo2.arhitekt.hr
• jumper.itb.hu
• proxy1.lyit.ie
• krr.irst.itc.it
• falco.procom.it
• kpcu.kumamoto-pct.ac.jp
• kaigan.civil.tohoku.ac.jp
• cvs2.kyunghee.ac.kr
• magicall2.dacom.co.kr
• proxy.ang.af.mil
• onion-router.nrl.navy.mil
• proxy1.jaring.my
• tenaga.tnb.com.my
• cacheflow1.deltacom.net
• proxy.coqui.net
• ns.siteways.nl
• homepages.harbinger.nl
• bob.rcac.org
• proxy.pomfretschool.org
• moyca.emc.com.ph
• sunsite.icm.edu.pl
• ultra.cto.us.edu.pl
• leonardo.isec.pt
• ns1.infonet.com.py
• proxy.qatar.net.qa
• hanna.lysator.liu.se
• proxy2.turnet.net.tr
• c1.h202052106.is.net.tw
• easthost.eastnet.net.tw
• softy.poptel.org.uk
• aladdin.esu10.k12.ne.us
• webserver.slco.lib.ut.us
• proxyfs1.und.ac.za
• cache.global.co.za
• proxy.cybergate.co.zw
• proxy.africaonline.co.zw

Good luck trying them all.

I looked into the P2P networks heavily protected by a strong encryption and supposed to guarantee the anonymity of their uses (often named darknets). this claim seems to be well defended, but the available contents are limited and strongly influenced by the fight for liberties (and sometimes against the most paranoid conspirations) and very marginal behaviours (pedophily is really more present there than in the more common Internet you and me use everyday).

But I was also directed toward the Usenet newsgroups. It is clear that a large number of users are living a free life far from the preening eyes of most external observers. As a matter of fact, if you download from your ISP’s news server, the data flow is only visible by yor ISP and yourself. Nothing goes into the open Internet. Of course, some ISP decided to limit access to some of the newsgroups, but choice is still quite large and your tranquility is much more preserved than on a P2P network (and less than on a fully anonymous darknet).

What tools do you need to browse the newsgroups? A little more technical attention than on the simplest P2P networks, for sure. But the tools are relatively easy to find:

• A Usenet reader able to correctly read the posts containing attached file. You have to remember that more of these files are actually cut in parts, attached one by one to different posts and encoded using standard but very specific protocols. The most convincing free tool -for me- was Grabit for Windows that seems able to decode nearly anything, grabbing parts from different messages and sticking them together in files or directories. Most important, it understands how to work with *.NZB files that describe all the parts, all their locations, etc. for one attached file set.
• A software tool able to work with *.PAR2 files that allow to run around the transmission errors (with the help of one sophisticated encoding, they can compensate for missing data or corrupted data, etc.) Here, I prefered QuickPar for Windows, one more free tool.

Note: Normally, Grabit doe sit all, but QuickPar for Windows still comes handy in case of failure.

The most impressive part of my tests has been download performance. 13 Mbit/s, I did not see this for a long time. The more because it was sustained for days (it goes down a little because of minor trafic jams at my ISP in the evening).

But you have to notice that if you look for a specific data content, newsgroups are not helping you. The way they are organized is favoring a lot the exploitation of very young content. If newsgroup search engines exist (Grabit has one that is partially submitted to subscriptions), the Usenet system will only host young data or data recently published.

With subjects like:

• Why a Wireless Bridge?
• How a Wireless Bridge Works
• Setting Up the Wireless Bridge (a Buffalo airstation)

• GSM mobile phones will be accepted in planes by Britain’s Civil Aviation Authority. But prices may be hard on your wallet, of course. [1]
• American Airlines to start WiFi broadband service in planes as soon as 2008. Same risk on prices… [2]

Surprising? Not really. We know for a long that there is no technical problem, just nobody was willing to try (in the airline companies and the public authorities).