Home Page, Help Page, Customer Support, Download HOSTS.INI file

    +----------------------------------------------------------------+
    | NAT32 VERSION 2.2 BUILD 22216                   19. July, 2014 |
    +----------------------------------------------------------------+
    |                                                                |
    |  NAT32 Version 2 IP Router for Microsoft Windows XP, 7 and 8.  |
    |                                                                |
    |               (C) 2014 NAT Software, Australia                 |
    |                                                                |
    +----------------------------------------------------------------+

    NAT32 Version 2 is a Windows application that provides Internet
    Connection Sharing and Routing for multiple LAN, WLAN, WWAN and
    Bluetooth connections.

    Although NAT32 Version 2 was specifically designed for the
    Windows 7 Starter Edition, it runs on all current 32-bit and
    64-bit platforms, including XP and all Server editions.

    NAT32 Version 2 uses the WinpkFilter driver from:

                http://www.ntkernel.com

    NAT32 Version 2 is available as an unsigned evaluation version and
    as a signed, registered version.

    +----------------------------------------------------------------+
    |                                                                |
    | NOTE: The unsigned version is distributed for evaluation       |
    |       purposes only and is unsupported.                        |
    |                                                                |
    | Email support is available for the registered version only.    |
    |                                                                |
    +----------------------------------------------------------------+

    What's New in each release (by days of the month)
    -------------------------------------------------

    July, 2014  ***** [CURRENT BUILD  22216] *****
                ***** [CURRENT DRIVER 3.2.2] *****

         1  Fixed the tracert problem for private machines to the
            Internet via a NAT32 VPN connection. The fix involved
            changes to RASIN() around line #487.

            Fixed an issue in tcpc.c in all the TCP Clear functions.

            Fixed an issue in netwritew() near line #302.

         3  BUGFIX: GetRasLinkTable fixed for XP and Server 2003

            BUGFIX: Start.c no longer sleeps after closing a window.

            BUGFIX: Listadapters() fixed for XP and Server 2003

            Minor change: Default domain is now 0.

         5  BUGFIX: Function rasin() line #508 modified to allow
                    pings to the RAS Server IP to work.

            Minor change: function tcpinp() no longer sends a RST
            for lost connections (line #53).

            Minor change: function tcpreset() now clears the ep_map
            and ep_unmap flags (line #31).

            Minor change: functions x_ras() and x_wancfg() now always
            update ras_server_status by calling GetRasServerStatus().

         6  BUGFIX: The DHCPD was working incorrectly for Class A
            IP addresses. This has been corrected in DHCPD() at
            line #145 and #203. Additional corrections to allow
            user-specified masks made in winute() line #8191.
            Similar corrections applied in init_dif().

            IMPORTANT CHANGE: Some systems (e.g. Windows XP) require
            the DHCPD to specify a DNS DOMAIN. We therefore now
            default to the DNS DOMAIN "local".

         7  NEW CODE: Several changes made to the RAS code to allow
                      devices that do not request a DNS address via
                      a DHCP INFORM to function correctly. See file
                      ras.htm for details.

         8  DNS mapping now applied for DNS requests directed to the
            DNS server address of any configured interface. This is
            implemented via function is_dns_address() called in
            ipgetp() at line #378.

         9  Minor changes only.

        10  Various changes in the TCP code to prevent zombie TCBs.

        11  Shell command tcpx modified to allow closing of connections
            in the LAST_ACK state.

        14  Function tcptimer() modified. Various tcpc() functions
            modified.

        15  BUGFIX: The wdnsrd worker thread was cycling DNS requests.
                    This thread runs only in Winsock Mode.

        17  BUGFIX: a few minor issues corrected.

        18  BUGFIX: TCP connections to NAT32's stack are now being
                    closed correctly.

                    The tcpc command (and its variants) now work
                    correctly.

            BUGFIX: DHCPD now defaults to supplying the interface's
                    IP address as the DNS address.

        19  New WinPktFilter Driver Version 3.2.2 required.
            This version of the driver now correctly supports
            simultaneous outgoing RAS connections and one or more
            incoming connections. NOTE that only Windows Server
            platforms allow more than one Incoming Connection
            at a time.

    ****    MAJOR CHANGE: WinPkFilter Driver Version 3.2.1 is now
    ****                  required. This version fixes the problem
    ****                  of outgoing VPN connections failing when
    ****                  an incoming VPN connection is disconnected.

    June, 2014  ***** [CURRENT BUILD  22215] *****
                ***** [CURRENT DRIVER 3.1.3] *****

         1  Function IPGETP() modified to pass unmapped UDP and TCP
            traffic to NAT32 if a listener for that traffic exists.

            RAS commands enhanced:

                raspbk   [phonebook | * [entry]]

                rasentry [phonebook | * [entry]]

            The Dial-Up networking menu items and dialogs now support
            the default phonebook and one user-specified phonebook.
            Full details can be found in file htm/dialer.htm

         8  Various changes in RAS functions contained in wpf.c.

            One remaining RAS problem was traced to an error in the
            WinPkFilter. The author will be posting a fix "soon".

        22  UDP port 137 broadcast packets are sent to the MSTCP after
            passing a copy to UDP_IN.

            Admin is now turned off during a configuration run.

            Service.c now uses sprintf_s() rather than swprintf().

            Service settings dialog box now disables the OK button
            if NAT32 is running in User Mode.

        23  The DHCPD default domain name is now 'local' (RFC 6762).

            BUGFIX: Problems fixed for interfaces running in
                    'non-shared' mode i.e. NAT32 has its own
                    unique IP on that interface.

            NOTE: The recommended configuration for all interfaces
                  is the 'shared' mode. This is also the default.

        26  Minor changes in DHCPD, SETS and VARS.

        27  Change in honeypot() line #674 for http://honeypot.box
            Change in honeypot() line #419 for exception

            Change in x_dnsd() line #76 for DNSRD signon message.

            File htm\dstat.htm modified.

    May, 2014  ***** [CURRENT BUILD  22215] *****
               ***** [CURRENT DRIVER 3.1.3] *****

         8  Redirection problem for built-in commands fixed.

        15  Message Port mechanism extensively modified and tested.

            Several Windows File Sharing issues fixed.

            Fixed Windows ping 1.2.3.4 problem.

        18  NEW FEATURE: Mechanism for bypassing the honeypot added.
            It works by setting up a VPN connection to the NAT32
            machine. All DNS requests arriving over that VPN link
            bypass the NAT32 DNS Resolver. Note that the Windows
            Desktop RemoteAccess Service allows only one such
            VPN connection at a time. The Windows Server RRAS
            Service allows up to 1000 VPN connections.

        20  The DHCPD can now also listen at the RAS Server IFN.
            This allows DHCP INFORM requests to be honoured.

        26  Several changes madse to allow Windows File Sharing
            to work over local VPN connections.

            TO DO: The only way for NAT32 to force a local VPN
            connection to close is via a netsh command to the
            RAS Server:

                    netsh ras set client xxx disconnect

            Problem is, this command requires privilege. This
            feature will be added to NAT32's admin.exe app in
            the near future. Also, the NATSTAT program will be
            upgraded to allow this too.

        28  DNS Type 41 recognition added.

    April, 2014  ***** [CURRENT BUILD  22214] *****
                 ***** [CURRENT DRIVER 3.1.3] *****

         3  BUGFIX: Modified the checkb.tcl script. Details are in
                    file backup.htm.

            NEW FEATURE: Admin Throttle can now be specified for input
                         or output traffic via the command:.

                            admint [input | output]

         4  BUGFIX: Environment variables 'main' and 'aux' were not
                    being set during a configuration run.

            BUGFIX: Environment variable 'router2' was not being set
                    in all cases.

            New script 'checkg.tcl' added. See backup.htm for full
            details.

         6  BUGFIX: Monitor Save function now works correctly.

         7  All references to nat32.dyndns.org removed. NAT32 no
            longer supports DYNDNS.

        10  HTTPD extended to return additional MIME Types including:

            text/plain, application/zip and application/octet-stream

            BUGFIX: Function p32sendf() modified to NOT wait on a
                    terminated thread.

        12  Command setgs expanded. The speed algorithm now works
            correctly and selects a gateway at random if both have
            the same speed.

            Gateway selection consistency is now implemented via
            the next-hop entry in a connections port mapping entry.
            This requires that all TCP and UDP traffic uses the
            port mapping table, including MSTCP <-> Adapter traffic.
            Also, pmatb entries added at startup now have a valid
            next-hop field.

        15  Minor changes to the Console command history code.

            New internal packet header field added: ep_delay.
            The ep_tick field now always contains the clock tick
            at which a packet was received or sent. The ep_delay
            field now holds the delay in msec before a packet is
            to be sent. This value is needed for Admin and Filter
            purposes.

            Major changes made to the General Purpose Queue
            functions to facilitate the implementation of delays.

        17  Major changes made to where delays are added. Input
            delays are now applied in ip_in(); output delays are
            applied in netwriteq().

        18  Several web pages updated.

        19  BUGFIX: Windows MTU values now updated correctly.

            Monitor now signals msem on exit. Function start()
            waits on msem on exit or restart.

            Monitor was calling SetBkMode() for the edit
            control. This WIN32 function has numerous undocumented
            side effects and should be used with caution.

            Command history code rewritten. A circular buffer of
            64 commands has now been implemented.

            New command: cmds [dev [reset]]
            Can be used to display or reset the command history
            for a specified window device.

        20  Function inetin() modified around line #497 to NOT
            block traffic to another destination on the same
            network. This could have implications for Virtual
            Machines running on the NAT32 host.

        23  Minor command history bugfix (winio() #2581).
            Console windows now display command history buffer
            index.
            The cmds reset command now fills the history buffer
            with #x strings (for testing).

        24  If a route with a low, non-zero metric is found, ignore
            gateway selection and forward packets via that route.

        26  Function wpfwrite() modified to drop packets written
            to the inactive RAS Server adapter. During the inactive
            state, its MAC address is 0.

        27  NEW SCRIPTS: checkr.tcl determines the external Internet
                         IP and stores it in the 'router' variable.

                         checkip.tcl determines the external Internet
                         IP of a given name and stores it in the
                         'router' variable.

        28  Several minor changes to the TCP code:

                DISABLE/RESTORE in tcpacked() removed (unnecessary).
                Function tcbdealloc() now clears the TCB.
                TCPTIMER now has a granularity of 100 msec.
                TCPTIMER now updates lastrun when resumed from suspend.

            Icons for Desktop shortcuts modified.

            Honeypot Javascript response modified to include script tags.

        29  Several web page updates.

        30  Maximum size of the Port Mapping Table is now 4096.
            Default size of the Port Mapping Table is now  512.

            WORK IN PROGRESS: UPNP pass-through support.

    March, 2014  ***** [CURRENT BUILD  22213] *****
                 ***** [CURRENT DRIVER 3.1.3] *****

        24  BUGFIX: Various modifications made in HTTPD and SOCKS5D.
                    Function tcpclose() modified.
                    Function add_aux() modified to timeout inactive
                    TCP connections from external sources. Note that
                    this change does NOT effect connections TO external
                    servers.

        26  Minor bugs fixed.

            Admin feature modified to block ALL traffic for disabled
            machines.

            Admin now handles localhost traffic correctly.

        27  Minor bugs fixed.

        31  As we don't mind getting packets that could have been sent
            directly to their destination, IPPROC was modified to not
            send ICMP redirects.

    March, 2014  ***** [CURRENT BUILD  22212] *****
                 ***** [CURRENT DRIVER 3.1.3] *****

         1  BUGFIX: In web view, the combo-box was being cleared on
                    resize.

            BUGFIX: Function myrasdial() was not allocating enough
                    memory for the RASENTRY structure in all cases.

            The NAT32 taskbar icon color is now set as follows:

            Error:                      red
            Default:                    yellow
            RAS Server has clients:     green
            RAS Client connections:     light-blue

         2  MAJOR CHANGE: Because tunlr.net has been removed from the
            Internet, the DNS Proxy mechanism no longer has any use in
            NAT32 and has been removed.

            A new mechanism for achieving the same result has been
            implemented:

            1. Set up a VPN connection to a server of your choice in
               the country of your choice.

            2. Make that connection the Auxiliary Internet interface.

            3. Add names of sites that are to be accessed via that
               connection to the DNSRD "special" list.

            3. Whenever a computer accesses a domain in that list,
               its traffic will be sent via the Auxiliary interface,
               irrespective of all other selection algorithms.

            MAJOR CHANGE: File startup.txt has been extensively
                          modified. In particular, user.txt is now
                          executed just before startup.txt completes.

         6  NEW FEATURE: The RAS functions now support the default
                         phonebooks plus an additional phonebook as
                         specified with the setpbkf command.

                         Entries in all phonebooks are displayed in
                         the various dial and hangup dialogs.

                         An additional phonebook is typically used
                         for VPN connections e.g 12VPN.

        10  NEW FEATURE: Script files now support the following
                         shell specifiers:

                         #!xsh      Process with the NAT32 Shell

                         #!xwin     Process with the Windows Shell

                         #!tcl      Process with the NAT32 TCL Shell

        12  BUGFIX: VPN connection details are now updated correctly.

        13  NEW FEATURE: TAP-WIN32 driver again enabled in netstart.
                         BE SURE to configure the adapter under
                         Windows with a unique IP address and a
                         suitable Mask. No gateway or DNS address
                         is required.

        14  BUGFIX: Socks5d GPF bug fixed.

        17  MAJOR CHANGE: All semaphore routines modified to correct
                          a mutual exclusion problem.
                          Shutdown problems resolved.
                          Critical Sections functions modified.

        18  MAJOR CHANGE: Modifications in HTTPW:

                          Mobile browser support improved.

                          Connections are now always closed, as some
                          clients do not honour Connection: close
                          in HTTP 1.1 responses.

                          Beep() called when external requests arrive.

        20  BUGFIX: Function p32die() terminates threads and closes
                    devices owned by the thread. Function close() was
                    being called within a critical section and this
                    caused a deadlock for devices whose close function
                    blocked on a semaphore.

                    Example: The browser device waits on the web_sem
                    that is signalled in DisplayHtmlStr(). This device
                    is now (again) fully functional.

            MAJOR CHANGE: All of the p32rcv functions now honour strict
                          mutual exclusion rules.

                          The GPQ functions now use critical sections
                          rather than semaphores for mutual exclusion.

                          The p32send and p32receive functions are now
                          again used for IP packet input.

                          The NETOUT thread continues to use semaphores
                          as before.

                          ARP also uses semaphores.

        22  NEW FEATURE: Command apmap added. See apmap.htm for details.

                         Usage: apmap [delete  ]

    February, 2014  ***** [CURRENT BUILD  22211] *****
                    ***** [CURRENT DRIVER 3.1.3] *****

        20  Web Server now sleeps for 60 sec (default) if unauthorised
            access is attempted. The sleep duration is specified in
            the environment variable httpds, a count of illegal access
            attempts is recorded in httpdc.

        21  MAJOR CHANGE: IP reassembly is now done before mappings
                          are checked.

            This fixed the problem that incoming fragments from the
            Internet were not being unmapped correctly.

    February, 2014  ***** [CURRENT BUILD  22210] *****
                    ***** [CURRENT DRIVER 3.1.3] *****

         9  MAJOR CHANGE: IPPROC now uses a global semaphore (net_sem)
                          to regulate reception of packets.
                          Function IPGETP() waits on net_sem and all
                          functions that enqueue packets signal it.

        10  MAJOR CHANGE: NETOUT now uses an interface-specific semaphore
                          (ni_outsem) to regulate packet transmissions.
                          NETOUT waits on ni_outsem and all functions
                          that enqueue packets for transmission signal it.

                          These change have increased throughput.

            MAJOR CHANGE: ARP traffic is no longer processed inline.
                          Function arp_in now queues the packet for
                          ARPPROC which processes it concurrently.

                          This change improved performance.

            MINOR CHANGE: Function yield(x) now sleeps for x msec if no
                          other thread was ready at the time.

            MAJOR CHANGE: All incomimg IP fragments are now reassembled
                          before being mapped/unmapped. The resulting
                          packet is then again fragmented if it is too
                          large for the destination network.

                          This seemingly inefficient mechanism is
                          required because a NAT can't map/unmap
                          fragments, unless it does so via IP addresses
                          and IP IDs. This issue is for future study.

        11  NEW COMMAND:  arpstat [clear]

                          Prints ARP process details.

        12  MAJOR CHANGE: All bcast and mcast traffic on the NDISWANIP
                          interface (as well as RAS Client interfaces)
                          now blocked.

                          This fixed the wanarp.sys fault on XP systems.

        13  BUGFIX: Function ipputp() wasn't toggling ep_dir correctly.

        14  UDP 4500 packets are now checked for an SPI of 0, in which
            case the TTL of the port mapping is reduced to 10 sec for a
            client->server packet and then to 3 sec for server->client.

            This ensures that the port mapping is removed promptly.

            BUGFIX: The 'set' command was not printing the newly set
                    value in the case of integer values.

            BUGFIX: For incoming Internet traffic, don't check the Active
                    Port Mapping Table if a flow is already known.

                    This fixed a subtle bug for the case where a private
                    machine was connecting to the NAT32 machine via its
                    external Internet address.

        16  BUGFIX: IPPUTP now handles IP fragments correctly.

            Maximum packet size (large buffer size) increased to 65,000.

            Note that the maximum packet size that a FritzBox accepts is
            14,800 bytes. Other routers may have similar restrictions.

            WebForm default window size is now 800x600.

    February, 2014  ***** [CURRENT BUILD  22208] *****
                    ***** [CURRENT DRIVER 3.1.3] *****

         2  NEW FEATURE: Support for IPSEC-NAT-T VPNs added (RFC 4303).

            This now allows multiple VPN connections to the same server.

         8  BUGFIX: Packets consisting of reassembled fragments now have
                    the correct IP checksum.

    January, 2014   ***** [CURRENT BUILD  22208] *****
                    ***** [CURRENT DRIVER 3.1.3] *****

         2  BUGFIX: ICMP between private networks was not working.

            BUGFIX: Port 445 WPF filters modified.

            BUGFIX: Always add an ICMP mapping for local ICMP.
                    That mapping is needed so that TIMEX responses
                    can be unmapped. THis feature is required by the
                    checki command and the checki.tcl script.

            BUGFIX: Hangup command modified. The command was printing
                    an uninitialized IFN value if no connection was up.

         3  BUGFIX: Permanent port mappings were not being applied
                    correctly.

         6  NEW COMMAND:

            arrange: Neatly arranges Console and Monitor windows.
                     Clicking Clear now also arranges those windows.

         8  Command arrange: Neatly arranges Console, Trace and
                             Monitor windows.

            FritzBox scripts updated for FritzOS 6.

            Honeypot returns 410 Gone for php scripts.

            NAT32 tested with Spotflux VPN.
            See spotflux.htm for details.

        10  CHANGE: All commands requiring an ifn argument now accept
                    an integer value as well as the following strings:

                    a   Auxilliary interface
                    m   Multicast interface
                    p   Primary interface
                    s   Secondary interface
                    v   Virtual interface
                    w   Best Windows interface
                    ifn Current interface (as set by 'ip' command)

        11  CHANGE: commands setis and setgs modified.

        12  CHANGE: entire interface selection and gateway selection
                    mechanism reworked.

            Softap default SSID is now SafeNetwork, Passkey is NoGoogle

        13  Various FritzBox scripts updated for FritzOS 6.

        14  Function add_aux() modified at line #3070. Routes only
            added for external sources.

            File RSS.XML modified.

        15  New HOSTS.INI file posted.

            An indexed search will now be used to find names, given that
            an index was previously created with the command:

                htest -i

            The htest command can also be used to save a hosts.txt file
            as a hosts.ini file, and to test a name.

            Usage: htest [-s | -i] | [name]

            Note that file hosts.ini is loaded into memory when NAT32
            starts. Subsequent searches are always performed in memory,
            and if indexing is used, such searches will be very fast,
            even on modest hardware.

        18  Conversion of hosts.txt to hosts.ini is now very fast.
            Note that no hosts.ini file nor table index is generated
            in this case, although the commands:

                htest -s
                htest -i

            can be used if desired.

            As a rule, the current hosts.ini file should be downloaded
            from the NAT32.COM website, as it is updated regularly.

        21  Function inetin() now classifies incoming packets in the
            following order:

                1. Port Mapped              (pmap)

                2. Permanent Port Mapped    (ppmap)

                3. NAT32 Listener

                4. WINDOWS Listener/Established

        23  Process started via execw() no longer inherit handles.

            Reverse DNS lookup for a local address now returns the
            name 'nat32.dns'.

            Startup.txt now only starts DNSD in Winsock mode.

        24  BUGFIX: Permanent Port Mappings were being applied to
                    private traffic as well as to Internet traffic.
                    For those ports, TCP connections from private
                    machines to external servers were being mapped
                    back to the local address.

            BUGFIX: Mappings were being indicated for packets from
                    the MSTCP. Such traffic need never be mapped.

        25  BUGFIX: Commands setp, sets and seta modified to
                    correctly handle the ifn = 0 case.

            NEW FEATURE: Command 'ras' now prints all RAS
                         connection IP addresses.

        26  NEW FEATURE: The 'if' command now has a 'file' option:

            Usage: if [not | file] variable | constant [then] cmd [args]+

            This is useful for checking the existence of files.

            Example: if file hosts.ini echo "HOST.INI exists"

        27  BUGFIX: DNS pointer queries were always returning the
                    name 'nat32.dns'.

        29  BUGFIX: Incorrect version of ndisrd.sys for 32-bit
                    Windows 7 was included in the distribution.
                    Correct version of ndisrd.cat added.

        31  NEW FEATURE: Command setns now honors option 'e' as
                         described in setns.htm. Note that for
                         checking AND caching, the value 'e3'
                         should be used.

    December, 2013  ***** [NEW BUILD 22204]  *****

                    ***** [NEW DRIVER 3.1.3] *****

        11  New version of the WinPkFilter driver introduced.

            This version has several important new features:

            1. Kernel-mode packet filtering

            2. Support for 9014 byte Gigabit Ethernet frames.

            3. Windows 8.1 improvements.

            This release of NAT32 allows packet filters to be
            specified that forward all private network traffic
            to or from the MSTCP without NAT32 intervention.

            On Internet-connected networks, all traffic that is
            of no concern to NAT32 is also sent to or from the
            MSTCP without NAT32 intervention.

            These changes dramatically improve network throughput
            and local traffic is no longer subject to delays caused
            by all traffic passing through the NAT.

            ******  Please uninstall your existing driver, reboot
                    Windows, and then install the new driver.

            ******  If you do not reboot, installation of the new
                    driver will surely fail.

        12  New wpf filter command syntax:

    	    wpf  filter ifn port src | dst\n");
    	    wpf  filter [i]\n");
    	    wpf  filter erase [i]\n");
    	    wpf  filter reset\n");

            NOTES: A 'port' argument of 0 is interpreted as 'all ports'.

                   Arguments 'src' and 'dst' are literal.

            Examples:

            Make the Secondary Interface transparent for RDP traffic:

                wpf filter s 3389 src
                wpf filter s 3389 dst

            Make the Primary Interface transparent for RDP traffic:

                wpf filter p 3389 src
                wpf filter p 3389 dst

            Make the Secondary Interface TOTALLY transparent:

                wpf filter s    0 src
                wpf filter s    0 dst

            NOTE WELL: If the above filter pair is applied, you MUST
                       use a unique IP address for NAT32. You cannot
                       share the Windows IP address in this case.

        13  New TCL script 'tunlr' written to fetch current proxy name
            servers from tunlr.net and update NAT32 dnsp settings.

            Desktop shortcut for NAT32 Configuration now runs NAT32
            in Administrator mode.

        15  Wpf filter mechanism enhanced. New command syntax:

    	    wpf  filter ifn proto port:port src | dst [mstcp | drop | nat32]
    	    wpf  filter [i]
    	    wpf  filter erase [i]
    	    wpf  filter reset

            NEW: The protocol can now be specified.
                 A port range can now be specified.
                 An action can now be specified.
                 The default action is to pass the packet to the MSTCP,
                 but 'drop' can be specified to drop the packet, 'nat32'
                 can be specified to pass the packet to NAT32.

        20  Honeypot now checks a single exception string. To set that
            string, use the command: set except string
            Access to black-listed sites containing the exception string
            is via a redirect to the URL modifed to contain an IP address
            in place of the name.
            Any URL containing ...../redirect is also redirected to the
            IP URL.
            Accessing Google by IP circumvents the mandatory redirect to
            HTTPS.

        21  Honeypot now understands commands:

            http://honeypot.box/exception=google

            The above command sets the exception string to 'google'.

            http://honeypot.box/exception=

            The above command clears the exception string.

            http://honeypot.box/exception

            The above command prints the current exception string.

        22  New environment variable 'warning' added.
            This variable specifies the maximum number of Windows TCP
            connections that may exist when NAT32 starts. If that number
            is exceeded, a warning is printed. The warning value is set
            to 8 in file startup.txt (near line #218).

            NOTE: If an unusually large number of TCP connections exist
            at any time, it could indicate virus activity, particularly
            if many of the connections are to the Honeypot.

        23  Wpf filter command no longer supports the 'filter' option.

            NEW COMMAND wpff:

    	    wpff ifn proto port:port src | dst [mstcp | drop | nat32]
    	    wpff [i]
    	    wpff erase [i]
    	    wpff reset

            This new wpf filter command supports the shell 'all type ifn'
            syntax.

            Example:

                all private wpff ifn tcp 3389 src mstcp

            The above command adds filters for TCP RDP SRC traffic to
            MSTCP for all private interfaces.

            Note that if a specific private interface is not up at the
            time, no filter is added. This issue will be addressed in
            a future build. Meanwhile, the easiest solution is to restart
            NAT32 when such an interface comes up.

        26  Command modified: wpff reset
            The command now resets only the filter traffic statistics.
            The only statistic currently displayed is the number of
            packets that matched each filter. This value can be used to
            determine the effectiveness of a particular filter.

            ***** [NEW BUILD 22204]  *****

        30  Crontab modified to update the Windows Host List at reboot
            and every minute thereafter.

            HOSTD now answers NBT (port 137) queries for any name in
            the Host List.

            Various help pages updated.

        31  BUGFIX: Shell was handling Winsock Mode command check
                    incorrectly resulting in some commands not being
                    executed.

            BUGFIX: Command 'host refresh' was failing whenever function
                    EnumerateNet returned a dotted decimal address
                    rather than a name. Sockio line #992 was modified
                    to fix this problem.

            NEW FEATURE: Command 'host refresh' now also shows shares
                         that have dotted decimal names rather than
                         'proper' names.

    December, 2013   ***** [PREVIOUS BUILD 22201] *****

         2  BUGFIX: Fixed honeypot access issues.

         3  Modified the access control mechanism.
            Localhost no longer has unrestricted access to the HTTPD.
            Use the pcheck command to turn password checking on or off.

            Correct version of service.exe included in the distribution.

         5  Password checking now uses the NAT32 default password, not
            the Windows password.

            The password is stored as a hash in the Windows Registry,
            and it can be modified with the following command:

                password current new

            This operation requies Administrator rights and should only
            be carried out interactively. The new password is stored as
            a hash in the Windows Registry.

         6  MAJOR CHANGE: QF_WAIT now used in gpq. QF_NOWAIT used
                          previously.

    November, 2013   ***** [NEW BUILD 22199] *****

        16  Many major improvements.

        17  Permanent port mappings can now also be specified for
            private network interfaces. This allows mapping of e.g.
            private URLs to a Web Server located elsewhere.

        18  The default Honeypot IP address has been changed from
            10.10.10.10 to 1.2.3.x (a temporay address block
            registered by Google Coporation). It is an ideal Honeypot
            address as traffic to that address is used by some Google
            tracking mechanisms.

            Users who want Google to track their every move should
            modify the address with the following command:

                ipdmap 10.10.10.10

        20  TCP Keepalive code modified.

                BUGFIX: ACK and SEQ values had been swapped in call
                        to send_ack().

                BUGFIX: SEQ had been decrementd incorrectly.

                The following modifications were made:

                1. If a probe is sent and no response arrives,
                   another probe is sent one second later.

                2. Thereafter, if no traffic is seen within
                   60 seconds, the PMAP entry is deleted.

            The ppmap command now shows the probe flag P.

            BUGFIX: The diagnostic script was not being executed.

        21  BUGFIX: added missing .gif file.

        23  Telnet Server and Client improvements.

            UDP Echo and TCP Echo client and server improvements.

            Note: the above services are useful for testing
                  reachability.

        30  BUGFIX: SNMP client.

            Functions pnetin() and inetin() modified.

    August, 2013   ***** [NEW BUILD 22197] *****

        17  Various bug-fixes not related to Packet Classifier made:

            dns_utils.c: exact match for "fritz.box" checked. This fixed
                         the problem with lookups such as wpad.fritz.box.

            name2ip.c:   Same fix as above.

            dhcpd.c:     The limit variable was being set to 0 when an
                         interface went down and was not being initialised
                         when a dhcpd reset command was executed.

            winio.c:     Power broadcast handler was calling fileexcr,
                         which caused a hang when a sleeping machine was
                         resumed.

            On Windows 8, no Microsoft Virtual WiFi adapter ever appears.
            It exists however, but has a "*" in its Descriptor which stops
            NAT32 from showing the adapter. This issue is for further study.

    July, 2013   ***** [NEW BUILD 22196] *****

         1  NEW FEATURE: machines on disjoint private networks can now
            communicate freely through NAT32.

         2  BUGFIX: Netbios broadcast propagation was sometimes altering
                    the UDP checksum, even though the packet wasn't
                    subsequently forwarded.

            BUGFIX: Netbios broadcasts were being propagated on the
                    first non-Internet interface only. PPP and unused
                    interfaces were not being excluded in the check,
                    resulting in a possible propagation attempt over
                    an unconnected (unused) interface.

            NEW FEATURE: Netbios Broadcasts are now propagated on ALL
                         private networks.

         3  Starting today, extensive changes to Packet Classification
            code in INETIN, PNETIN and RASIN were made. Some changes in
            IPPROC, IPGETP and IPPUTP were necessary because of this.
            The aim was to support NetBios Name Resolution seamlessly
            across all attached networks.

    June, 2013   ***** [NEW BUILD 22195] *****

         3  BUGFIX: Problem with 'dnsrd off' fixed in dgclose line #33

            Function ipgetp now sends packets by calling netwriteq().

         4  Close(dev) removed in several UDP listeners.

            File dhcpd.ini is now included in the distribution.

            File change.txt now enables the DHCPD on the specified
            interface.

         5  Minor changes in ipgetp(). Return changed to break.

         6  Permanent port mapping now understands TFTP. To access a
            private TFTP Server from the Internet, add this mapping:

                ppmap add udp 69 x.x.x.x

            where x.x.x.x is the private IP address of a TFTP server
            listening at UDP port 69.

            NOTE: Computers normally use TFTP to boot from a server
                  on a local network. It is thus extremely unlikey
                  that this feature is needed, and it has been
                  included simply for the sake of it.

         7  Function netwriteq() line #530 now uses sendf().
            Function ip_in()     line #110 now uses sendf().

         8  File debug.js was causing false positive in Norman Malware
            Cleaner. As always, a trivial modification confuses the
            virus checker while retaining original functionality.

        11  Line #354 commented out in pnetin(). This was holding up
            packet transfers unnecessarily.

            Line #152 added in pnetin(). This was causing all traffic
            other than ARP, IP4 and IP6 to be dropped.

            Line #364 in pnetin() checks for DHCP traffic. If our
            DHCPD is active, do not send a copy to Windows.

        15  A few missing gif files added to the distribution.

            Several web pages modified.

        20  Startup.txt now sets the default home page to startpage.com.

        21  Two new commands added: setns1 and setns2 can be used to
            set NSERVER1 and NSERVER2 directly.

            Function inetin() now calls checkpmap() if check_udp_port()
            indicates that Windows is expecting the UDP packet.

            Above patch fixed this DNS redirection problem:

                If NAT32 is redirecting UDP Port 53 traffic to another
                DNS server, then local DNS requests from Windows were
                failing.

        22  BUGFIX: Sockio line #629 socket now closed if connect failed.

            MODIFICATION: DHCPD traffic now checked at line #576 of
                          inetin() to avoid unnecessary duplication of
                          packets.

            Function inetin() now calls checkpmap() if check_connection()
            indicates that Windows is expecting the TCP packet.

            This check and the similar one above for UDP is now only
            done for packets addressed to this interface.

        23  NEW FEATURE: The DHCPD can now only be enabled on an
                         interface if the following command has
                         previously been issued:

                            dhcpd ifn A

            Command 'dhcpd ifn a' disallows DHCPD on the specified interface.

            This change simplifies enabling and disabling of the DHCPD via
            script files (e.g. change.txt).

            Note that startup.txt now defaults to allowing DHCPD to be enabled
            on private interfaces without a gateway.

            In some cases, it might be desirable to enable the DHCPD on
            Internet-connected interfaces, so a 'dhcpd ifn A' command for
            that interface would be required before attempting to enable it.

        24  NEW FEATURE: Multicast DNS propagation across multiple networks.
                         This feature allows devices on one network to learn
            of the existence of services on another network. This feature is
            particularly useful for services such as AirPlay and AirPrint.

            To instruct NAT32 to copy mDNS packets seen on interface X to
            interface Y and vice-versa, use this command:

                mdns ifnx ifny

        25  Minor naming change: The ig_mnr variable is now called ig_mdns.

        26  NEW FEATURE: Functions name2ip and x_ns now handle three special
                         names inline: nas.box, fritz.box an honeypot.box.

            BUGFIX: Function ipgetp now computes the TCP header length
                    correctly. This was causing problems when active mode
                    instead of passive mode was being used for FTP.

            NEW FEATURE: The NAT32v2 registry key is no longer deleted at
                         uninstall time. This allows Admin settings to be
                         preserved across versions.

        27  NEW FEATURE: If a packet arrives from a machine on one of the
                         networks NAT32 knows about and is destined for
                         another network NAT32 knows about, then that
                         packet is now routed correctly.

            This feature allows private networks to be accessed from other
            networks that NAT32 has been configured to use.

            Note that on the sending machine, you must add a route for the
            other network to the system's routing table. That route must
            point to NAT32's IP address on the machine's network.

        28  NEW COMMAND: route copy type
            Copies Windows routes of the specified type into the NAT32
            Routing Table. Type is usually 4, but note that RRAS on
            Windows Server 2003 requires that type be 0.

            MODIFIED: commands setr, rip and ripsend modified.
            Unfortunately, RIP is poorly supported in the Windows world
            so NAT32's RIP server is not started per default.
            It can be manually started with the command: start rip

            NEW FEATURE: The DHCPD now logs release notifications.

        29  The 27.6.2013 feature required major changes in ipgetp() and
            ipputp() and currently has the following limitation:

            Traffic from a private machine to any interface NAT32 knows
            about works correctly, EXCEPT for this case:

                Traffic from a private machine to a mapped Windows port
                on the NAT32 machine does not work if addressed to the
                IP address of NAT32 on any other private network.
                This is because the Microsoft TCP/IP implementation, on
                networks that have local scope only, does not accept
                packets from IP addresses that reside on other networks.

    May, 2013   ***** [NEW BUILD] [NEW HELP FILE] *****

         1  Driver install/uninstall for all XP platforms modified.

         5  NEW FEATURE: All exec commands modified as follows:

                         Exec commands that don't wait NEVER inherit
                         any NAT32 handles. This ensures that all
                         handles really are closed on exit.

                         Exec commands that do wait ALWAYS inherit
                         all NAT32 handles. This ensures that all
                         NAT32 handles are accessible to the process.
                         NAT32 must terminate that process on exit.

                         Command killp can be used to terminate any
                         process on which NAT32 waits.

                         NAT32 checks for processes with inherited
                         handles on exit and will not terminate until
                         such processes are closed.

            UPDATE: Command 'ie' no longer supports the deprecated -e
                    argument. It now supports the -p argument, which
                    starts Internet Explorer in InPrivate mode.

         7  Functions inetin, pnetin, wtcp and portmap modified to
            transparently handle packets for ports recorded in the
            Windows TCP and UDP connection tables.

         8  DNS requests to a NAT32 private IP are now processed by
            NAT32, even if no Resolver Daemon is running.

            Netstart no longer starts a UDP echo daemon if no PPP
            interfaces are in use.

            Netstart no longer starts an Activity daemon if no PPP
            interfaces are in use.

            The above two daemons can now be started with the start
            command if needed.

            Function ipputp() modified to allow traffic to ports
            recorded in the Windows TCP and UDP connection tables.

            New function do_duplicate() called in inetin to handle
            packet duplication for broadcasts, multicasts and IGMP.

         9  Functions pnetin and inetin modified to allow RDP traffic
            between a private machine and the Internet address of the
            NAT32 machine.

        13  Gateway selection dialog enhanced.

            Command 'ifn' now supports an 'update' argument.

            Support for dynamically configured adapters improved.

            Function netstart() modified to call NifUpdate after
            the configuration has been read.

        14  Major web interface update in progress.

            Further changes in devmon and regmon to facilitate the
            insertion and removal of network adapters.

            Above changes tested by inserting and removing a 3G
            USB adapter on Windows 7.
            NOTE: Windows XP support pending.

        16  Program admin.exe no longer prompts before running an
            application.

        18  Problem with run.exe (SXS error) fixed.

            Script "sid" updated to work with Fritz!OS 5.50.

        24  Command winmap enhanced to allow just Windows listen
            ports and/or Windows established ports to be added
            to the NAT32 ppmap or pmap tables. New syntax:

                winmap tcp | tcpe | tcpl | udp

        25  BUGFIX: When Netbios propagation was on, ipgetp continued
                    processing the packet after it had been propagated.

        26  BUGFIX: Line #521  in ipgetp().
                    Line #346  in pnetin().
                    Line #1172 in map_port().
                    Line #660  in ipgetp().
                    Line #581  in pnetin().

            All of the above fixes related to the nb command. When an
            'nb on' is now issued, the names of computers on other
            private networks are made visible on all private networks.
            IP and Port mapping for the other private networks are
            turned on/off as needed. Only UDP port 137 and 138 packets
            are propagated.

        27  BUGFIX: Monitored interfaces with fixed configurations are
                    now detected and initialized correctly.
                    Changes in rttimer(), regmon(), x_dhcpd and dconf()
                    were needed.
                    NOTE: If the DHCPD is to listen on such interfaces,
                    manual enabling is required. This can be done via
                    an interface-specific script.

        30  Work on a Linux app that runs on Raspberry PI started.

            The app will implement a DNS resolver, a DHCP server and a
            Honeypot with the same feature set as contained in NAT32.

            This will allow safe, ad-free Internet access for any
            wireless device that connects to a 3G router but obtains
            its configuration from the Raspberry PI.

            A proof-of-concept configuration using a Pocket WiFi device
            and NAT32 running on a small embedded system has been tested
            and works perfectly. Test clients were an iPad, a Windows 8
            device and an Android device.

            Note that no changes whatsoever were required on the Pocket
            WiFi device, as NAT32's DHCPD responded to requests very much
            faster than did the Pocket WiFi device.

            On a Raspberry Pi, it MAY be necessary to turn off the DHCP
            Server on the Pocket WiFi, if the RPI cannot respond to
            DHCP requests before the Pocket WiFi does.

        31  NEW FEATURE: The DHCPD now understands a gateway argument:

                         dhcpd ifn gw x.x.x.x

                         This command allows the DHCPD to report a
                         gateway other than NAT32 itself to a DHCP
                         client. This option is useful for cases where
                         only NAT32's DNS Resolver and Honeypot are to
                         be accessed by a client.

    April, 2013   ***** [NEW BUILD] *****

         5  BUGFIX: inetin, pnetin and rasin: Port 3389 traffic was
            always being forwarded to the MSTCP, even if the IP dst
            address did not equal the Windows IP on that interface.

            IPPROC BUGFIX: rtget was sometimes being called even
            though a route had already been found (line #484).

         7  Support for DNS Proxies added.

            To proxy all names containing "bbc":

                dnsrd proxy bbc

            To set the DNS proxy server:

                set dnsp 142.54.177.158     # A tunlr.net server
            OR
                set dnsp 192.95.16.109      # A tunlr.net server

            The above server will transparently proxy BBC iPlayer
            content (as well as several others).

         8  Various web pages updated to support viewing on an iPad.
            All pages will be updated in the coming weeks.

         9  DNS Resolver extended to use the HOSTS file from:

                http://winhelp2002.mvps.org/hosts.htm

            Note that the HOSTS file need not be copied to its
            Windows location because NAT32 generates a compressed
            copy of it in memory at startup. Lookups are thus very
            fast, the worst case lookup time being under 1 msec on
            an Intel dual-core machine.

        10  Command htest added. Use this command to test the lookup
            time for a given name. If the name is not in the HOSTS
            Table, the worst-case elapsed time will be printed.

            Several new web pages added.

        11  BUGFIX: Function check_hosts was finding partial matches.
            Problem resolved by always searching for " string "
            rather than "string".

            Several web pages updated.

        12  More web pages updated.

        13  New HOSTS file now in use.

        14  Function check_hosts() bugfix was lost; now restored.

            Honeypot now resets each connection after a close.

            Honeypot worker now handles gif, jpg and png correctly.

            Honeypot worker threads now limited only by the maximum
            number of NAT32 TCP slave devices (connections).

            ***** New HOSTS.INI File available *****

        15  Honeypot worker no longer does file reads. All files are
            now read when the honeypot thread starts. If any file
            has been modified, the honeypot must be restarted.

        16  BUGFIX: HTTPW was calling dns_resolve without a valid
            proxy argument.

        17  Several web pages updated.

        18  Shell modified: commands can now be marked as executable
            from remote or not.

        19  BUGFIX: winh now works reliably over a TCP connection.
                    Problem was the iread thread not terminating.
                    It is now no longer started for commands arriving
                    via TCP.

        20  New command: cmd name [1|0]
            This command sets the 'remote execution' attribute of a
            specified command to true or fales.

            Console window is now 900px wide after an install.

        21  Several Help Pages updated.

        22  Nav pages modified for better browser compatibility.

        23  Nav pages modified for even better browser compatibility.

            New page: browser.htm displays the UserAgent and Screen
            Dimensions.

        24  Scrolling problem for pages viewed with IE10 fixed.

        25  Function ipsend modified at line #75.

        26  BUGFIX: New WinPkFilter VLAN tag was not being set in
                    function wpfwrite. This was causing locally
                    generated outgoing packets to be not recognized
                    by the receiver.

            BUGFIX: If a local DHCP server is in use, disabling the NAT32
                    DHCPD for that interface was not passing incoming
                    requests to the MSTCP. Function check_local_ports()
                    was modified near line #93 to correct this problem.

        27  BUGFIX: HTTPW was not timing out connections that were being
                    kept alive for whatever reason.

            Sockio function sReadLine1T now accepts a timeout argument
            in msec.

        28  NEW FEATURE: IP debugging is now controlled via the ipdbg
                         variable OR the ipdbgaddr variable.

            BUGFIX: Function ipgetp modified aroundline #312 to support
                    traceroute from the MSTCPcorrectly.

            BUGFIX: Function icmp modified around line #139 to fix the
                    ICMP Time Exceeded issue for pings from private
                    machines.

            BUGFIX: Function check_icmp in portmap.c modified around
                    line #1759. It now returns TRUE for ICMP Time
                    exceeded packets from the network.

            Traceroute now works correctly from all machines.

        29  Function dns_check modified at line #107 in dns_utils.c so
            that all reverse lookups are now passed to the current DNS
            server for resolution.

            Debugging now available in IPGETP, IPPUTP, INETIN, PNETIN,
            and RASIN.

            NOTE: IP debugging is only available in debug builds.

        30  Deletion of NDISRD key was failing because subkeys existed.
            The SHDelete function is now used to avoid such problems.

            Modification to fileexecr() in p32.c at Line #860 to avoid
            the problem of waiting on the prs->done_sem semaphore that
            sometimes won't be signalled.

    March, 2013   ***** NEW WINPKFILTER REQUIRED *****

         3  Hostd and whostd modified.

            Networking code modified to use new Ethernet constants.

            Form window size changed.

            All netin threads now minimise calls to getbuf by reusing
            packets they themselves dispose of.

            TCP Device:

                Function tcpx no longer called in honeyb.

                Tcpkick no longer called for single-byte reads.

                Tcpfin2.c modified around line #28 to enter TCPS_TIMEWAIT.
                This fixed the problem of lost acks leaving connections
                in that state indefinitely.

            UDP Device:

                Fixed the problem of dgram and udp threads not exiting
                when read returned SYSERR.

            When NAT32 runs as a service, it now sleeps for 20 seconds
            after startup to give other services time to start.

         4  Modified the buffer reuse mechanism.

            Modified the mstcp_check_ functions.

         5  FritzBox trace now working again.

         6  FritzRepeater trace now working again.

         7  UPNP client support now works on XP, 7 and 8, but note that
            on multi-homed hosts, only the Windows "best" interface is
            used for SSDP multicasts. This is a Windows "feature".

         8  BUGFIX: Fixed the problem of responses to outgoing UDP
                    broadcasts not being forwarded correctly.
                    Main change was at line #1353 in portmap.c.

         9  Buffer pool sizes adjusted.

            UDP max size now limited to one Ethernet packet.

            DHCPD debug output was showing cookie in wrong byte order.

            DHCPD dparser modified to include Options 1, 3 and 6 in the
            DHCP Offer.

        10  Bugfixes in setf command.

            New feature: When a TCP filter is enforced, the connection
            is now reset. The culprit app then gives up promptly.

            New feature: Typing any command name followed by a '?'
            results in its Help Page being displayed within a browser
            window.

            NOTE: The Shell now interprets the '?' character as a
            special token. Therefore, any string containing that
            character must be enclosed in "...".

        11  Modified the '?' feature as follows:

            Instead of treating '?' as a shell token, the first
            argument of all commands is checked for '?' and, if
            found, the relevant help page is displayed in the
            browser.

        12  WinPkFilter updated.

        14  Driver command and setup.msi modified to support the new
            WinPkFilter driver.

        16  The driver install command now installs the Intermediate Driver
            on 32-bit AND 64-bit Windows XP. Uninstall on those platforms
            removes both the Hooking Driver and the Intermediate Driver.
            The Lightweight Packet Filter is installed on 32/64-bit Vista,
            7 and 8.

        17  New command: driverx [install | uninstall | help]
            Installs the Hook Mode Driver on XP systems (use only for
            pre-SP3 Windows XP systems).

        18  NAT32 command line options enhanced. It is now possible to
            start NAT32 without any form of visual interface:

                nat32.exe nifs ABCD

            where 'nifs' stands for the number of network interfaces,
            A = no Admin, B = no embedded browser, C = no console, and
            D = no debug output monitor.

            Note that the only way to interact with NAT32 in the above
            case is via a Web Browser or by using the utility programs
            rcmd and remote (both included in the distribution).

        19  NAT32 autonomous mode introduced.
              + new variable ni_win is set to pwi->ip in NifUpdate
              + quick dialog shows the Internet IP if no private
                interface is available.

            Ultimately, the autonomous mode will allow NAT32 to use
            its own private IP on Internet interfaces with private IPs
            behind residential gateways. It will then not be necessary
            to reconfigure the interface of the machine to use a fixed
            IP.

        20  Help files updated, new How To topics added.

        21  BUGFIX: Dial-Up Networking:

                    Function myrasdial was failing for connections that
                    don't have an entry in the Phonebook file. Fixed by
                    specifying NULL in RAS functions that require an
                    optional Phonebook file name.

                    Dial dialog box issues fixed.

        22  Shell now recognizes '?', '/?' and 'help' as a help request,
            if specified in the first argument of any command listed in
            the command table or the extended command table. The syntax
            has no effect for URLs or scripts.

        28  Honeypot modified as follows:

                HONEYPOT now handles HTTP  traffic only.
                HONEYPOT_SL  handles HTTPS traffic only.

            The above changes were necessary because of global variable
            issues.

            NOTE: startup.txt has been changed.

        31  Honeypot now handles blocked https iframes correctly.
            Problem was the history link that was present even though
            the download had been blocked.

    February, 2013

         1  HTTPD max_workers now defaults to 2.

            HONEYPOT max worker threads defaults to 16 (down from 32).

            Both use a semaphore to control the number of workers.

            Startup.txt now uses the default HTTPD workers.

            Several wintrace bugs fixed. Save now again works.

            IPPROC modified to fix a TCP reset bug.

            Honeypot now calls tcpx to clear connections fast.

         2  Filter mechanism modified. See setf.htm for details.

         3  Trace mechanism now has a new operator: '@'. It can
            be used to block all traffic once a specified string
            is found in the trace output.

            It is used as follows:

            1. Open the trace window and enter @xxxxxx where
               xxxxxx is the case-sensitive sequence you are
               looking for.

            2. Now enable tracing for the adapter(s) of your
               choice and traffic will be blocked as soon as
               the string is found.

            The mechanism is useful for updating your Windows Phone,
            and is more accurate than methods that use the
            'disconnect trick'.
            In fact, if you know which string to search for, the
            mechanism will block traffic at precisely the correct
            point in time.

            For a hint on what that string is, send me a support
            request.

         4  Minor web page updates.

         7  DHCP requests were going to NAT32 and Windows. This
            breaks DHCPD if a Windows DHCP Server is running.
            Modified line #295 in pnetin to NOT unconditionally send
            all UDP broadcasts to both Windows and NAT32.

         8  HTTPD and HTTPW modified to use the htDir variable for
            path names.

         9  HTTPW modified to set correct content type for CSS.

        11  WPF modification: Only IP traffic counted in wpfread
            and wpfwrite.

        14  HTTPD modified to return header when forwarding redirects.

            Honeypot modified for greater WebKit compatibility.

        17  NAT32 proxy now supports SSL.

            Several web pages updated, including swr.htm and swry.htm.

        22  Function getwin modified to not use WINDISABLE/WINRESTORE.
            The use of the critical section was superfluous and caused
            lockups when a new window was created from an existing
            window.

            A few Wintrace bugs fixed.

            Telnet client fixed so that it works with Windows Telnet
            Server:
                x_telnet.c: TERMINAL changed to "tty".
                            tkbdrd modified.
                telnet/do_echo.c:  modified.
                winio:  line #1072 modified.

        23  TCP Device: tcpgetdata line #50 now calls tcpkick on every
                        call to read.

            This fixed the problem of window updates not being sent
            often enough. Tested with telnet client.

        25  MAJOR CHANGE: mstcp_check_in changed to mstcp_check_dst.

            New command: pingx net count
            Pings 'count' hosts from net to net+count.

            BUGFIX: various functions that call recvtim() modified to
                    handle SYSERR correctly.

    January, 2013   ***** NEW BUILD *****

         1  The Tcl shell is now available via telnet.
            Tcl command files can be executed via remote and rcmd.

            The monitor dialog box now understands shell commands.
            Exceptions: commands that create subshells.
            This is useful for debugging.

         2  The telnetd can now be used to interact with a running
            NAT32 App or Service. The windows Telnet client works
            correctly, the putty client does not as it requests
            parameter negotiation. This feature will be supported
            in a later release.

         3  The winh command now works correctly via Telnet from
            another process. This is useful for checking the status
            of the NAT32 host. Note that only Console Mode commands
            should be used, because commands that run concurrently
            in a window on the host have no notion of Standard I/O.

         4  Numerous corrections made to make NAT32 more robust in
            Terminal Server environments. In particular, networking
            must never block if any GDI changes might take place
            during that block. This would lead to a freezing of the
            Session.

         8  Minor changes.

            To run NAT32 without a Console window, simply delete the
            screen.ini file.

        10  Bugfix: Error in function getpwin() fixed. This will have
                    caused unpredictable behaviour in the embedded
                    web browser.

            NAT32 can now be started with these options:

            Usage: nat32 [i|c [e][n][x]]
                    i = number of interfaces
                    c = configure
                    e = embed browser
                    n = no user.txt script
                    x = no Console
                    No arguments = configure

            If started with option x, no Console is created. Instead,
            a monitor window is opened.

            If started in an RDP Session, no browser is embedded.

        11  Bugfixes: Function UpdateWincfg now sets idx correctly.
                      Function RegMon now calls UpdateWincfg for
                      DHCP-configured interfaces.

        12  Bugfixes: Function RegMon now handles all adapter changes
                      correctly.

                      The DNS Resolver now no longer warns about
                      Internet connectivity problems.

        13  A few web page changes.

            DNS Resolver now again warns if NAT32 isn't using what
            Windows reports as the "best" interface.

            HTTPW now limits the complexity of incoming GET requests
            to 16 tokens. Some web crawlers send very long GET
            requests, perhaps deliberately?

        16  ARP critical sections in arp_in and arpqsend modified.
            Port map age function now never sends within the Port Mapping
            critical section.

        17  Fixed a winh termination issue.

        18  Function tcp_in modified (line #29).

            Setup.exe now supports Repair/Remove.

        21  Check for driver installed added in registry.c

            IsDriverInstalled modified for Vista and higher.

        22  Handling of unsolicited UDP traffic modified as follows:

            If best match mapping is on (setbm command), then forward
            unknown UDP packets if a TCP mapping from the same IP source
            address exists. Send the UDP packets to the target of the
            TCP mapping without port mapping.

            The above change means that NAT32 best-match mapping will
            allow all unsolicited UDP traffic as long as that traffic
            is from a machine for which a TCP mapping exists. When that
            mapping is deleted, UDP traffic from that machine will no
            longer be accepted. Of course, other explicit mappings will
            override this behaviour.

        24  Admin.exe modified and copied to setup.exe. The following
            Windows Installer operations are supported:

            setup install   [args]  # Install NAT32
            setup uninstall [args]  # Uninstall NAT32
            setup update    [args]  # Update NAT32

            where args are msiexec.exe options.

        25  Bugfix: Host Transfer Mode has been modified.
                    When off, unsolicited traffic to the the host is
                    no longer blocked.

        26  Several web page updates.

        29  Configuration function ifn_ini written to replace wnconf.
            The function parses ifnx.ini without using the NetDlgProc.
            This eliminates screen flicker during startup.

        30  Winio: message handler modified line #5300

            Command: tcpc help text added.

        31  File user.txt will now no longer execute if the current
            user is "User". This seems to be a default on Windows 8
            systems.

            The setup.exe (alias admin.exe) program now defaults to
            'update'. Admin.exe continues to work as before.

    December, 2012

         2  IPGETP: no port mappings added for private traffic.

            PORTMAP: unmap_port modified to work with shared private
                     IP addresses when Admin is on.

            WPFCLOSE: pwpf->isenabled set to 0 when device is closed.
                      This fixed a NAT32 restart problem.

            NIFUPDATE: pni->ni_idx now set correctly on restart.

         3  Resume from sleep problem fixed.

            PNETIN: modified code around line #432 to fix local private
                    traffic problem.

         4  PNETIN: further modifications around line #432 to allow
                    private traffic to NAT32 listeners.

            Correct version of service.exe included in distribution.

            NETSTOP: modified to handle configured network interfaces
                     that are not in use.

            HTTPD: modified to send Connection: close in Response Header.

         5  START: call to fileexecdk replaced by ShellExecute. This fixed
                   a problem with NAT32 service interaction.

            Various HTM files now contain: "saved from url=(0014)about:internet"
            This allows scripting when IE displays local files.

            Several functions such as qprintf and iprintf have been removed
            for better service comaptibility.

            Bug in the kprintf functions fixed.

         6  All unterminated (i.e. no NL char) kprintf calls fixed.

        11  Command 'ps' no longer a builtin so pipe to more again works.
            Command 'more' now handles CR/LF correctly.

        13  New constant MAPERR returned if certain port mapping check functions
            found no mapping.

            PNETIN: modified to handle pings correctly.

        17  New feature added to the NAT32 Honeypot:

                Grey-list: All HTTPS traffic blocked, HTTP traffic via the safe
                           HTTPGET command.

            NAT32 configuration changed:

                MEMREQ  2 MB
                Ntcp    48
                Nsem    384
                TCBSBS  2048
                TCBRBS  2048
                MAXBEES 32

        19  Function rasin.c modified around line #237. UPNP SSDP multicasts were
            being duplicated, leading to a STOP ERROR in wanarp.sys in all versions
            of Windows XP.

        21  Entire Dial-Up Networking code reworked. This fixed connection set up
            and hangup issues.

        22  IP input and output queues now hold up to 1024 entries each.
            Command ipstat now also displays the number of IP Discards.

            Note: even under heavy load, it is extremely unlikely that NAT32 will
                  ever discard an incoming IP packet.

        28  Shell x_tcl command modified.

        30  Telnet client modified.

    November, 2012

         3  Minor changes to netstop command
            Minor web page changes.

        10  AirPrint support: Netgear Genie users should issue command:

                winmap tcp

            once Genie has started.

            Alternatively, add the following permanent port mappings:

            ppmap add udp 5353 0.0.0.0
            ppmap add tcp 631  0.0.0.0
            ppmap add tcp 9100 0.0.0.0

            The NAT32 update command now works correctly.

            Command gwstat modified to display auxiliary gateway traffic.

            Command setrs deprecated. Use setgs instead.

            TCL script dcheck.tcl added. The script will check for a
            DHCP server on a specified interface and disable our
            DHCPD if an external server responds.

        12  Command 'all' extended. It now recognizes an additional
            type: private_gw. That type is used to detect private LANs
            that have a gateway. One should generally disable NAT32's
            DHCPD on such networks. File startup.txt does this as follows:

                all private_gw dhcpd ifn off

            The app script extended to include an AirPrint setup script.

            Two new commands added:

                setaux ifn
                setmain ifn

            They select the auxiliary gateway or the main gateway on Internet
            interfaces that connect to multiple gateway.

            The quick dialog box now also allows the above switching to
            be carried out.

            The DNS Settings dialog Test functions now work again.

            New and updated web pages for several commands.

        13  New environment variables:
                fbip        # IP address of a FritzBox
                rcmdip      # IP address of a remote NAT32 Box
                rcmdport    # Port of a remote NAT32 Box

            Transparent forwarding of 169.254.x.x traffic to and from
            the MSTCP.

            New command added: rcmd

                Usage: rcmd cmd [server [port [password]]]

            Bugfixes in remote command:

                Usage: remote [server [port [password]]]

            Function ip_in modified to place DNS traffic and HTTP traffic
            at the head of the ipinq.

        14  Interface selection and Source Routing features improved.

        19  Interface configuration dialog improved.

        27  Support for seamless operation of existing connections added.
            NOTE that the sethtx command MUST NOT be executed until the
            winmap commands have run.

        29  Test code removed.

        30  WPF driver devices are now started within the network input
            threads that use them. Previously, the devices were started
            much too early.

            NAT32 can now be configured, started and stopped via RDP from
            another machine.

            NAT32 now preserves all existing TCP connections on startup
            and on exit.

    October, 2012

         3  Network tracing rewritten so that the network input and
            output threads never block.

            The wtrace command was enhanced so that a low-level TCP/UDP
            port filter can be specified. Such a filter should be used
            if the user is interacting with the NAT32 computer via a
            Remote Desktop and the interface to which the Remote Desktop
            is connected is being traced.

            Usage: wtrace [open | close | on | off | allow | block | clear
                          | save | mark | [filter port] | e|E | d|D]

         5  National Language issue fixed: File nat32.ini now no longer
            contains national language adapter and connection names.

            A Unicode version is in preparation.

         8  Termination was sometimes hanging. Fixed by bypassing critical
            sections when all user threads have terminated.

         9  A performance anomally resolved: When Windows on the NAT32
            machine communicates with another machine on the same
            network (e.g. during a file transfer), throughput drops
            during packet bursts because NAT32 passes each received packet
            up to the MSTCP without delay. This confuses TCP throughput
            optimisation mechanisms and the transfer rate drops.
            One solution is to ensure that Ethernet adapters are always
            running in full-duplex mode.

        13  SetThreadName function added to allow debuggers to display
            NAT32 thread names.

        14  New command: Display transfer rates in bps
            Usage: bps ifn [i | o | t]

            The web shell page now displays transfer rates each second
            for ifn 1 and ifn 2 as a progress bar.

        15  Websh now displays Gateway traffic totals.

        16  Various web pages updated.

        18  HTTPD and HTTPW buffer problem fixed.

        19  Windows UPNP SSDP was not working. This was fixed by allowing
            loose UDP mappings. The problem was that SSDP requests go out
            to the multicast address and port 1900, but responses come
            back from an arbitrary source port (i.e. not 1900).
            In addition, for outgoing SSDP packets, a port mapping entry
            must be added so that the response is allowed in.

        26  Major kernel changes.

            Platform8 variable added. Build 22013 now runs on Windows 8.

        27  New command: netstop ifn|all|net
            The 'net' argument terminates all networking threads.

        29  New command: dhcp ifn [r|t]
            The 't' argument sends a DHCP Discover on the specified
            interface and prints the IP address of the first server
            to respond.

    September, 2012

         8  Experimental version, generates debug output.

        19  VPN connections from private machines to a VPN Server on
            the NAT32 machine now again work.

        20  VPN connections from the NAT32 machine and from private
            machines to a VPN Server on the Internet now work for
            both NDIS and RAS adapters.

        21  All of the xinu.bugs modifications applied to the TCP stack.

        22  Semaphore delete modifications made.

        23  Problem with ni_dirty not being set in some cases fixed.

            Problem in resume from standby fixed. If RAS Server
            connections existed at standby time, the server status was
            not being updated on resume because devmon_enabled was
            still 0 at the time the hWanEvent occurred. The fix consists
            of running "ras update" in the resume handler.

        24  Resume from standby (sleep) handling modified.

            Function inetin() modified to duplicate UDP broadcasts.
            This was needed to make DHCP Discover work.

        27  If an adapter fails on resume from sleep, function wpfwrite
            now prints an error code.

            Command wpfx now reinitialises all adapters and sets ni_use
            and wincfg[x].valid correctly.

            Cron no longer fails if a crontab is not available.

            Cron is now started just before startup.txt completes.

        28  Functions copy_tcp_connections() and copy_udp_connections()
            now check for existing entries to avoid duplication.

            Netstart no longer calls the above functions.

            New command: Copy Windows Netstat Entries

                  Usage: winmap tcp | udp

            This command is used to copy Windows network status (netstat)
            entries to NAT32's pmap and ppmap tables.

            Commands winmap tcp
            and      winmap udp
            added to the end of startup.txt.

        29  New command: Set Transparent Mode
                  Usage: settm [ifn | all [on | off]]

            This command effectively decouples NAT32 from the NDIS Driver
            Layer thus allowing Windows to communicate transparently.

            NAT32 initially runs in transparent mode until the CRON
            daemon issues command: settm all off
            Thereafter, NAT32 begins its address translation and port
            mapping duties.

    August, 2012

         2  New command: setnsx [ifn | w]
            Sets the variables NS1 and NS2 for the specified interface.
            If w is specified, the Windows Primary interface is used.

            New command: setwp
            Sets the variables WIN_PRIMARY and WIN_PRIMARY_IP to the
            interface matching the Windows Best Interface. If NAT32
            has not been configured to use that interface, then the
            variables are set to NI_PRIMARY.

            Note that the WIN_PRIMARY interface is used by the name2ip
            function to resolve DNS names.

         3  IPproc modified so that DNS queries are always sent via
            the interface over which the DNS Server info was obtained.

         6  Detection of RAS interfaces modified.

        10  Multiple RAS Client connections now correctly handled.

        11  Bug in function getdnsifn fixed. The function was sometimes
            returning an interface that was down.

            MAC addresses for PPP write now set correctly.

            All incoming PPP traffic is seen on the NDISWANIP interface.
            New function record_payload now computes the actual ifn
            for which a packet is received and increments the payload
            counter.

            New command: dhcpd ifn test
            This command will test all IP addresses currently in the
            DHCPD table for a given interface. If an address has no
            NAT32 ARP entry, or if it does not respond to an ARP
            request, its DHCPD entry will be deleted.

        12  If file startup.txt doesn't exist, NAT32 now runs OEM.txt
            if it exists, where OEM stands for the OEM string of the
            customer. If file console.ini doesn't exist, NAT32 starts
            without an embedded browser and hides all windows.
            To hide the NAT32 icon, include a "hide noicon" command
            in OEM.txt.

        13  Command: dhcpd ifn test
            deletes all entries if the specified interface is down.

            NAT32 private, fixed IP interfaces now retain their IP
            addresses even if the Windows IP changes. The "use" and
            "valid" variables do change however.

            NOTE: If such an interface is reconfigured under Windows,
                  BE SURE to also reconfigure NAT32.

        15  Bug in lexan fixed: If a comment is included at the end
            of a command line, and if no new line character is present,
            the shell buzzed in shgetc.

        16  Bug in stats for PPP clients fixed.

        18  Bug in more command fixed.

            IP_IN now uses sendf() rather than send() to notify IPGETP
            of packet arrival.

        19  Call to tcpwait removed from tcplisten.

        20  Telnet daemon now works correctly.

            Minor bugfix: wpfwrite: Eth source address corrected

        25  TCP timer granularity changed fromm 100 to 1000. TCP timers
            now work correctly.

            Various TCP diagnostic functions modified, including tcpc()
            and tcptq().

            Functions pnetin() and ipproc() modified to support IP
            sharing on private interfaces.

            "Change ignored" problem fixed for RAS clients. The hrasconn
            check in check_wincfg commented out for ip_change = 1.

        31  Honeypot HTTPS support extended: Client Hello now parsed to
            extract Server Name. A TLS1_AD_ACCESS_DENIED alert is sent.
            Note that IE9 never-the-less includes such blocked sites in
            its History list. Chrome does not.

    July, 2012

         6  Major changes in the support for Mobile Broadband devices.
            Such devices may appear in the system as WWAN devices,
            not RAS devices. This means that the familiar RAS Dialing
            mechanisms will not work and that special dialers
            (Connection Managers) are needed.

            Error in the DNS Mapping mechanism fixed. This fixes the
            problem of no extended DNS features for DNS servers that
            are not on the network of the Internet connection.

            Error in rasin.c fixed. DNS resolution via Winsock was
            not working for Dial-up connections.

            DNS detection added for PPP interfaces.
            Various bug fixes in DNS detection code for PPP interfaces.

        10  For dynamic or dhcp interfaces, don't flag a change if the
            IP address differs from the one in the ifnx.ini file.

        15  Changes to DNS resolution: function name2ip now always uses
            available servers on the Primary interface.

            Command wc no longer works if stdin is the Console. Use wc
            only with piped input.

        18  HTTPS filter implemented. When on, all HTTPS requests are
            queried unless they are allowed in block.ini.

            Function netwritea now calls wpf_reinit if the wpf pointer
            is ever 0. Function wpf_reinit sets the hChangeEvent and
            then waits for devmon_sem.

        19  Winute modified to handle fixed IP RAS Server and Dial-Up
            Networking connections correctly.

        23  Build 2208 generated

            Major bug fixed in ipgetp: Pings to NAT32's private IP were
            not being handled correctly (ipgetp line # 269).

            Major bug fixed in rttimer: flag was unintialized.

        27  New code for handling Windows LLMNR and UPNP traffic.

            Command setrcv modified:

            Usage: setrcv ifn [on | off | bcast | lmcast | mcast | prom]

            Command setprom modified:

            Usage: setprom ifn [on | off]

            Note: Receiver modes are set in the underlying NDIS driver
            and can therefore only be set if Windows allows it. This
            means, for example, that the promiscuous mode can only be
            set for Ethernet adapters.

            Note: The modes 'stick' because they are changed within the
            adapter's NDIS driver. In particular, if NAT32 disables an
            adapter, its stays disabled on exit.

        28  Dial-Up connection problems fixed.

            Warning printed if an invalid Primary interface (Main
            Internet Connection) has been specified.

            Diagnostic script modified.

            UPNP handling modified. Remaining problems:

                1. The NAT32 upnpc command uses Winsock for I/O.
                   Windows uses its current Internet interface for
                   the UPNP traffic.

                2. NAT32 therefore only discovers UPNP devices on that
                   interface.

            The above problems will be fixed in a future build.

        30  Warning about invalid Primary interfaces removed.

            MIB_IPADDRROW wType problem on XP circumvented.

    June, 2012

         2  Minor bugs fixed.

         8  Command added: ttl [ifn] [n]

            If n != 0, set the IP ttl for all outging packets to n.

        10  Hint: To fix "NETWRITEA: IFN[n] illegal wpf pointer" errors,
            issue a wpfx command. This re-inits the WinPkFilter bindings.

            A few Honeypot modifications made. Problem is that older
            broswers send just Accept: */*. This causes problems when
            URLs without a file type are used. The default is to send
            a GIF image.

        13  A few new HTM files added, e.g. totd.htm

        27  Honeypot default type changed to 3 (Gif)

            WebForm refresh mechanism changed.

        30  NAT32 configuration code enhanced. It will now correctly
            detect the IP settings of USB Mobile Broadband adapters via
            the IPHLPAPI.

    May, 2012

         2  Ping command modified to check code and type of responses.

         3  Structure packing issues fixed.

            Function netwriter fixed to set RAS MAC addresses correctly.

         4  More structure packing issues fixed.

         5  DHCPD traffic arriving at a NAT32 private interface now
            always goes to NAT32 and not MSTCP, if DHCPD is enabled
            on that interface. This also fixed a bug in the Virtual
            WiFi adapter support.

            Broadcast and multicast duplication is now done only if
            all other more specific tests have failed.

         6  Sleep handling changed. On entering sleep, regmon and
            devmon are disabled and mstcp_state is saved and then
            cleared. On resume, regmon and devmon are enabled and
            mstcp_state is restored.
            Each interface is marked as dirty.

            Function ipsend modified. This fixed several problems
            when communicating with local addresses (via ICMP, UDP
            and TCP).

         7  Function isOnLocalNet in private.c modified.

         9  CFOS support update begun (still incomplete).

        14  WinPkFilter reinit problem fixed.

        16  Command js enhanced.

        18  Minor Ajax changes.

        21  Minor changes.

        22  Experimental: Admin now blocks HTTPS if command:
            adminh on
            is issued.

        23  Several Winsock mode problems fixed.

        26  Dwrite.dll and detoured.dll removed from distribution.

        29  DNS Mapping modified.

            Command sethtx modified so that Status Bar is updated
            correctly.

    April, 2012

         4  Several minor bugs fixed.

            Folder command added. Can be used to open Windows special
            folders.

         5  Bug in private network input process (pnetin) fixed.
            Broadcasts are now passed to the MSTCP and to NAT32.
            This fixed the Windows Network visibility issue for
            private LANs.

        15  Fixed the GPF when adapters were disabled.

            Several dprintf calls without closing \n fixed.

            Statically linked, no VC libraries need be installed.

        22  Configuration code now uses IPHLPAPI exclusively.
            All direct access to the MSMIB has now been removed.

        24  Configuration code modified to support 0.0.0.0 settings
            for both DHCP and Fixed IP Internet interfaces.

        29  Major bug fixes in RAS Client/Server code.

        30  New build released.

    March, 2012

         4  Major new feature: RAS Server support added.

            New command: wancfg
            Prints the current RAS_LINK table.

            Support for Dial-Up Networking clients will soon be ready.

         8  NAT32 Version 2.2 Build 2201 Released.

            Major new feature: support for the Remote Access Service
            and Dial-Up Networking is now included.

        11  Kprintf in GetRasLinks removed.

            Sleep behaviour modified: network is made transparent on
            entering sleep and restored on resume.

        14  Build 2202 released.

            Minor bug fixes, new rras web page.

        17  Console now supports input line editing.
            Winread is now line-oriented.
            Wingetc is now character-oriented.

        18  Command history implementation improved.

            Shell memory sizes reduced.
            Please report if this causes problems.

        20  Dhcpd command now supports argument p for Primary.
            The dhcpd can now be started on Internet-connected
            interfaces. WARNING: use only behind routers and BE SURE
            to disable the router's DHCP service. The following ppmap
            command is needed: ppmap add udp 67 *

        28  Console driver code rewritten. Line editing features now
            mimic those of the Windows Console.

            Sleep and Hibernate functionality modified. A NAT32
            restart is no longer done. Resumes correctly on
            Windows 7 systems.

        29  SNMP support fixed.

            Command history now mimics that of the Windows Console.

        30  Fixed a few console issues. Command line now limited to
            256 characters (like the Windows console).

        31  Fixed a few minor Console driver problems, including the
            command history problem.

    February, 2012

         4  Several bug fixes.
            Several web pages updated.

         5  Critical sections now use a spinlock of 10

         9  Minor bug fixes.

        10  Help pages updated.

        13  Netstart now calls a new version of copy_connections that
            copies established TCP connections to the port mapping
            table and listening TCP connections to the permanent port
            mapping table.

            This allows Windows listeners to be reached even if Host
            Transfer Mode is left on.

        14  Connect.txt and disconnect.txt changed. View them to see
            the changes.

            Commands setp and sets modified to allow a 0 ifn argument.
            A 0 denotes either the first Internet ifn or the first
            private ifn.

            Cursor problem in embedded web browser fixed.

            SWR3 TCL scripts modified.

        15  UDP listen ports (for the primary interface) are now also
            transferred as permanent port mappings to NAT32 on startup.

        16  Netwrite modified to work with 3G adapters of media type 9

        24  Major changes to network configuration and reconfiguration
            algorithms.

            NAT32 now defaults to private IP Addresses like x.x.x.254

            Command 'if' extended to check for constants and an
            optional 'not' argument.

            Usage: if [not] variable | constant [then] cmd [args]+

        26  Additional major changes to network configuration and
            reconfiguration code.
            Direct MIB lookups are being replaced by IPHLPAPI calls.

            Major bug in "if" command fixed, hence a new build number.

        27  Major PPP bug fixed.
            Major GRE bug fixed.

            Support for other VPN protocols added, but still need
            to be fully tested.

        28  Bug in the record route mechanism fixed:
            Routes must not be recorded for traffic from a private
            machine to any address on a connected network i.e. for
            directly delivered packets.

    January, 2012

         2  Several bug fixes.
            Several web pages updated.

         3  Netstop code modified.

         4  The Host Transfer Mode can now be turned off.

            NOTE: you would normally not want to do this.
                  The feature was added for test purposes.

         6  Fixed flicker issues in Quick dialog.

            Fixed urlctrl issues.

         7  Dwrite DLL now included in the distribution for those
            running IE9. The DLL fixes the ClearType problem.

        10  BHO Project started.

        11  Ctrl-C issues fixed.

        16  Command setns modified. A name server can now be specified
            by name or IP. The special names "opendns" and "google" equate
            to 208.67.222.222 and 8.8.8.8 respectively.

            On hibernate, only the Host Transfer Mode is turned off.
            This allows other apps to use the network should they need
            to do so during their WM_POWERBROADCAST handling.

        19  On hibernate, all network adapters are stopped. This now occurs
            quickly and reliably.

            Honeypot code enhanced.

            Init command added. Usage: init dev flag
            This command is for advanced users only.

            New Skype tips: How to prevent updates

        20  New command: copy [wdev|wname]
            The screen buffer for the specified window is copied to the
            clipboard and file screen.txt.

        24  Several minor changes in Honeypot and HTTPW

    December, 2011

         6  Several bug fixes.

         7  Test: no netstop on SUSPEND

        17  Many changes, including:

            + Fixed interface selection issues
            + New command: setbase ifn
              The specified interface overrides the interface
              selected by the Interface Selection Algorithm.
            + Regmon and devmon changes.
            + Port mapping timeouts lengthened to cope with
              flaky 3G connections. Note that 3G connections
              typically have a long time lag between an outgoing
              SYN and the returned SYN/ACK. Delays of 1 sec or
              more are not unusual.

        20  Detection of Dial-Up Networking configuration changes
            modified.

        22  Minor bug fixes.

        24  The restart command now supports reconfiguration, starting
            with fewer interfaces, or just a plain restart. Its arguments
            are the same as the NAT32.EXE arguments.

        31  Admin problems fixed:
            + Input traffic not counted correctly
            + Per gateway authorisation no longer performed, although
              the gateway for which the login is required is still shown.

            On restart, a file access error for crash.txt was occurring.
            This has hopefully been fixed, but at least the kprintf
            message now no longer appears.

    November, 2011

         1  Many small bug fixes.

         5  MAJOR CHANGE: A restart command has now been added.
            It terminates NAT32 but does not return to the OS.
            Instead, NAT32 runs again (in the same OS process).

            A NAT32 restart is now performed when the machine
            resumes from a low-power state.

        14  Various restart-related issues fixed.

        15  A few more restart-related issues fixed.

        20  Yet more restart-related issues fixed.
            GPF Dialog box now supports a restart option.

        22  Function rtclr now clears the entire routing table.
            This should stop the freebuf error.

            Function winclose now signals pw->wsem so that we don't
            block when closing a window that was just being written to.

            Function preceive now exits cleanly if the prot semaphore is
            signaled per shell command. This lets us force threads waiting
            on a port semaphore to exit.

        26  Function getpwin now no longer uses PDISABLE, PRESTORE as they
            weren't required anyway. The getpwin function was being called
            from UI_TranslateUrl, which MAY have caused the "uninitialised
            critical section" error.

            If an uninitialised critical section is entered (which should
            never happen) we now just initialise it there and then.
            Of course, an error will still be flagged if the CS is
            subsequently initialised elsewhere.

            The telnetd and rlogind now both work correctly.

            TCP tcbdealloc function modified so that listening ports can
            be reused after a close.

            Shell command signalp added. It allows a semaphore that is
            specified by the name of its owner to be signaled.

        27  New command: netstop ifn | all

            New command: stop name | tid
            Command stop will signal a thread's semaphore and thus cause
            it to exit cleanly. If the thread has no semaphore, then kill
            is called instead. See also: signalp

            Problem in rtuse() fixed.

            The exit command can now be used inside scripts.

            Numerous other small changes.

        29  Restart technique changed:

            1.  On PBT_APMSUSPEND, we do a 'netstop all' and return.
            2.  On PBT_APMRESUMESUSPEND, we set the restart variable to 1.
            3.  Our NULL threaad (kernel/start) will awaken within 1 sec,
                notice the restart and then call Sleep(1000).
            4.  Thereafter, the actual restart sequence begins.
            5.  Note that exit.txt is run within a shell, just like for a
                regular exit.

        30  Bug in Skype handler fixed.
            A session environment variable introduced. It is effectively
            the number of restarts + 1, and is displayed in the fourth
            part of the Console status bar.

    October, 2011

         1  SkypeTool features enhanced.

         3  Major bugfix: incoming unknown UDP packets on an Internet
            interface were being broadcast on the Secondary interface
            instead of being forwarded to the MSTCP.

         4  Major bugfix: incoming UDP broadcast packets were being
            forwarded back to the MSTCP, even though we had already
            done that in inetin. This was causing the netwritew error.

         5  FTP problem fixed. For PORT commands, the added pmap entry
            was being deleted erroneously.

            New command: wpfx
            Signals the Device Monitor thread to reinitialize all
            WPF devices.

         6  Various message now redirected to Monitor device.
            UPNP script now started in startup.txt.

         7  Router solicitation and advert no longer done.
            No response to solicitations now given.

            Function new_check_in modified so that Unknown UDP (TCP)
            debug output is not generated for mappings to 0.0.0.0.

            MonChar modified to wait on the output semaphore.

         8  Several small modifications to DNS Redirector and
            debug monitoring.

        10  Minor web page updates

        17  Function winio now checks POWERBROADCAST messages and
            ignores those for windows other than the Console.

            Function inetin changed so that all traffic from the MSTCP
            goes to NAT32.

        18  Android-specific code removed.

        19  Command 'ifn' fixed.

            Ping command first tries Winsock DNS then NAT32 DNS.

        20  Command pmapc now clears all entries if 'all' or 0
            is specified as an argument.

            Function gweth sets all gateway MAC addresses to 0.

        21  Trace format error fixed.
            Trace window modified.
            Function wpfwrite now sets hChangeEvent if a write fails.

        22  Commands suspend and resume modified.
            Power broadcast now suspends all running threads.
            On resume, those threads are resumed.

            Resume from sleep now works correctly on all platforms.

        24  Unfortunately, problems still occur on Vista.
            New approach: On receiving the WM_POWERBROADCAST, only
            the stored gateway Ethernet addresses are cleared.
            When the machine resumes, only the (now stale) pmtab
            entries are cleared.

    September, 2011

         2  Various web pages updated.
            Fixed the Active Content issue.

         5  Conceptual error in UDP apps fixed.
            Problem was that bpool buffers were not being used in
            xgram apps.

         7  Bug in NB Propagation fixed.

        12  Admin program extended to support ipnat manipulation.
            Command ipnat modified:
            Usage: ipnat [start | stop | disable | enable] [force]

        14  Netbios script added. Runs in startup.txt so that the NAT32
            machine appears in the Network Neighborhood.

        20  ICMP Time Exceeded packets no longer add an ICMP mapping.

            NAT32 App now prompts for confirmation before terminating
            if confirm is true and active TCP connections exist.

        22  Winroute command modified so that environment variables
            pip, pgw and sip are honoured. BE SURE to run the ip
            command before using those variables.

            The UPNP Client will now discover devices on XP systems
            once the correct 239.255.255.250 route has been added
            to the Windows Routing Table.

        26  Skype support enhanced. The Skype tool will now ring a
            FritzBox phone when a call comes in. See skype.htm for
            details.

        27  Major bugfix: NAT32 was preventing DHCP renewals on
            Internet-connected interfaces. Fixed by not mapping
            packets with an IP source address of 0.0.0.0.

        28  FritzBox ring script now rings the phone and displays
            the name associated with the **7xx shortcut.

        29  MAJOR CHANGE: Windows DHCP renewal for Internet interfaces
            now works correctly. Files inetin and arp_in were modified.

        30  Windows DHCP renewal for Internet interfaces now also
            works correctly when a machine awakens from sleep.
            XP and Vista do not release the IP address before
            sleeping, whereas Windows 7 does.

    August, 2011

         8  Honeypot now closes incoming connections correctly.

    July, 2011

         8  Mask check during configuration now done only for private
            interfaces.

            Netwrite functions now check that ni_num is not 0.
            This was causing a GPF in netwritew when called from
            certain functions in function slowtimer, but only for
            certain configurations.

    June, 2011

         4  All unhandled packet types now dispatched to Windows,
            except IPv6 if noip6 is true.

            Multicast support no longer enabled in startup.txt.
            Command 'mcinit p' commented out.

         8  Several buffer size issues fixed.

    May, 2011 *** NEW WINPKFILTER DRIVER Version 3.0.8 ***

         1  New WinPkFilter 3.0.8 released.
            Driver is signed. See driver.htm for installation details.

            Function udpsend now forces checksums on for all traffic.

         4  TCP change: Line #21 in tcpgetspace() commented out. This
            was causing TCP to wait for an ACK after each call to
            tcpwrite(). The wait was moved down to line #33.

         7  Function new_check_in modified so that a ppmap entry for
            ip_dmap (usually 10.10.10.10) maps to the current IP
            address of the interface.

            Command ppmap now interprets a mapping to * to mean the
            current IP of the interface on which the packet arrived.

         8  Several web pages updated.

        10  Source routing mechanism modified:

                If a source-specific route for a particular
                interface is specified, all Internet traffic for
                the specified machine(s) will be routed via the
                routes interface.
                Function CheckSourceRoutes was modified to
                support this, as was ipproc around line #342.

        11  DNS resolution of nat32.box and nat32.win modified.

        12  Source code shown for shell commands without Help page.

        14  Shell command tcl modified to use mutual exclusion
            around Tcl_CreateInterp and Tcl_DeleteInterp. This
            was needed because both functions manipulate the
            environment.

        16  Several new web pages.

        21  A few web page modifications.

        22  Focus issue fixed: When a web page refreshed, Console
            caret was being hidden.

    April, 2011

         1  Default HTTPD port changed to 8032 (but see: startup.txt
            for the actual port used).

         2  FritzBox support extended.
            Note: 7270 trace works correctly
                  7390 trace not yet working

         3  Shell command 'close' now loops until SYSERR is returned.
            This allows the Console window to be closed completely in
            order to hide it (e.g. when NAT32 runs as a Service).

            New functionality in data.js:

                var x = doLoadVar(url);

            Be sure to use URLs like: shell?cmd=xml+cmd+arg
            The function is synchronous and returns command output.

         4  Memory allocation problem fixed.

         8  Windows are now closed by the thread that created them.
            As a result, browser windows are now closed correctly.

        10  Bugfix: Console placement was not being saved.

            Console now indicates number of entries in DNS cache.

        11  Honeypot problem solved: TCP connection close now via
            function tcpc

            DNS caching has been turned off in name2ip and ip2name.

        12  Stop command now stops an interface and terminates its
            threads.

        30  UDPB command added.

    March, 2011

            Several minor bug fixes.

        13  F12 function added to embedded browser.

        15  Termination problems on XP platforms fixed.

    February, 2011

            Several bug fixes.

         2  Fragmentation handling bug fixed.
                Line #39  ipfjoin.c
                Line #11  icsetdat.c
                Line #216 pnetin.c

         7  Function inetin now checks for packet lengths > 1500.
            Fragments are now reassembled and fragmented on the new
            interface if needed.

            Function ipfsend now takes a dir argument.

         9  RasEnumEntries modified to return ALL USERS connections.

        11  Bug in rtget fixed. This was causing VPN connections to
            fail. Rtget now checks mask length AND metric when
            multiple matching routes are available.

        12  Function tfcoalesce modified.

            Only rtget (not rtgetxx) checks mask length.

        14  Modification to pnetin to make local traffic to NAT32
            work.

        16  Several web pages updated.

        24  Bug in httpget fixed: name2ip used for lookup in order
            to bypass honeypot.

            Honeyb no longer displays output on Console.

        27  Bug fixes in x_upnpc:

                Removed descXML[descXMLsize] = 0
                Buffer for lanaddr and ipaddr increased in size.
                Internet Gateway Device now correctly detected.

            Pep indicates packet mapping and unmapping in unused4.

            Multicast support modified.

        28  Rip support updated.
            VPN support updated.

    January, 2011

            Several bug fixes.

        20  Softap command: SetICSEnable(0) no longer called.

        25  UDP broadcasts now handled correctly (DHCP now works)

        26  All context menu items now work correctly.

        28  All features in test.htm now work correctly.

        31  New option for wdns command:

                Usage: wdns [open|close|flush]

            Flush the Windows DNS Cache.

    December, 2010

            Major new features:

                NAT32 can now handle traffic for multiple Internet
                gateways on any given interface. See the 'setrs'
                command for details.

                NAT32 can now handle traffic for all machines on a
                private network located behind up to two DSL Routers.
                All private machines must use the IP address of the
                NAT32 machine as their gateway and DNS address.
                Note that such private networks are considered to be
                "Internet" networks because NAT32 can reach the
                Internet via the gateway(s) on such networks.

            Changes, enhancements and minor bug-fixes:

                VPN connection support improved.

                Input Packet Classifier functions extended.

                NAT32 now reads the Windows TCP Connection Table on
                startup and places matching entries into its port
                mapping table. This allows such a connections to be
                treated as if NAT32 owns them  so I've called this
                "connection hijacking".

                NAT32 now reads the Windows Routing Table on startup
                and when RAS Connections are established, it places
                matching entries into its routing table so that existing
                Dial-Up Connections continue to function.

                Thread Local Storage now used to give each thread
                direct access to its proctab entry.

    November, 2010

        Numerous changes, enhancements and minor bug-fixes:

            Service hardening support added.

                Web interface supports exit and dismissal of warnings

            Still to come:

                RAS Server support

                Multiple RAS Clients support.

        22  Evaluation version posted.

    October, 2010

        15  Numerous changes in netin and netout.

        16  Minor bug-fixes.

    September, 2010

         1  Several web pages updated.

         2  Admin.exe now understands:

            admin winrt
            admin winrt off

            This extension allows Windows Routing to be turned
            off from within NAT32 running in User Mode.

            The NAT32 winrt command now works in User Mode via the
            admin.exe program.

            NAT32 softap command now checks for Windows IP Routing.
            If it is on, softap does not start and an error message
            is printed.

         6  Bug in x_mon write fixed (break if monitor window not open).

        12  SoftAP support modified: NAT32 now keeps alive all Virtual
            WiFi connections.

        13  SoftAP support modified: NAT32 now reacts to DNS requests
            to 192.168.173.1 that Windows sometimes uses.

            New environment variable 'magic' defaults to 192.168.173.1.
            It specifies an IP address that NAT32's DNS responder always
            reacts to.

        23  Help mechanism improved.
            Web pages adjusted for IE9

            DNS support extended.

        26  Problem with IP packet sizes fixed. Defines required
            brackets.

    August, 2010

         1  Bug in data.js was leading to to memory depletion.
            The req object must be set to null so that Javascript
            releases its memory.

        11  IP Destination Address Mapping mechanism added.
            Local traffic to 10.10.10.10 is accepted by NAT32's
            TCP/IP stack. This is used to reach the local Honeypot
            from the MSTCP stack (which normally involves no NDIS
            calls).

        12  Bug in DGWRITE fixed (pep->ep_ifn was being copied from
            a xinugram when in fact a datagram had been passed in).

            Bug in DHCPD fixed (The UDP device had been set as
            STDERR. If dhcpd.tcl does not exist, a file not found
            error message was being written to that device.

        13  NAT32 now supports variable IP Destination Mapping.
            This feature allows NAT32 to respond to a "magic" address
            that defaults to 10.10.10.10.

            New command: ipdmap [ip]
            Used to set the IP Destination Mapping address.

            The mechanism is used to address NAT32's TCP/IP stack
            in a configuration-independent way. The only proviso
            is that the chosen address must not be in use on any
            currently configured network.

        18  Several bug fixes, including mutex for traffic counters.

        20  Interface Selection now working correctly on systems
            with no private interfaces.

        22  Minor adjustments.

        24  Redirection code modified. Admin authorization now
            writes only a single response packet irrespective
            of how long the original response was.

        25  New command: eth2ip eth_addr
            Converts the specified eth_addr string (xx-xx-xx-xx-xx-xx)
            to an IP address string by first looking up the Windows ARP
            table and then the NAT32 ARP Table.

            The ACTIVE thread now sends a Virtual WiFi keepalive to
            192.168.64.2 to prevent the device leaving the Hosted
            Network (SoftAP). This mechanism will be extended later
            to encompass all connected devices, not just 192.168.64.2.

        29  Several minor bug fixes.

    July, 2010

         1  Bugs in IE6 cause function resize() in nav.js to loop
            endlessly.

         3  Various modifications in nav.htm, nav.css, nav.js

         6  Tcl Glob support fixed.

            Host Transfer Mode now works with the Microsoft Loopback
            Adapter.

         7  Minor bug fixes.

         9  Register command modified to take no arguments.

            Update command added (alias for register).

            Driver install command for 32-bit XP platforms fixed.

        10  Skype command updated.

        11  Phone command updated.

        16  Quick dialog's dbuf increased in size.

            File diag.txt modified to use winh instead of win.

        20  An extended Host Transfer Mode added:

                sethtx ifn [on | off | block | allow]

            This mode requires no private interfaces. It allows
            machines with two or more Internet interfaces to
            actually use those interfaces for simultaneous
            Internet access.

    June, 2010

         1  Various UI issues resolved.

         2  Admin bug fixed: 64-bit times were being used on 32-bit
            platforms.

            Monitor window now shows dprintf output, including decho
            output.

            Bug in monitor output fixed: MonChar no longer uses an
            output semaphore as it was unnecessary anyway (because
            SendMessage was being used).

         3  Bug in check_map fixed. The checki command now works.

            Driver installation instructions and command modifiesd.

            For private DHCP-configured interfaces, NAT32 now suggests
            a new IP address and prompts before the DHCPD is enabled.

         4  Function check_map enhanced. ICMP checks widened.

            Interface selection now defaults to algorithm 4
            (use Primary). Handling for ifn_selection algorithm
            4 nodified in IPPROC.

            If a default route for a PPP interface is added,
            ni_gateway for that interface is also set.

         5  Setis command now sets the Record Route option for all
            interface selection algorithms (except 0 of course).

         6  Service.exe now included in the distribution.

         7  Various bugs in the setht and related commands fixed.
            The added Windows ARP entry is now left in the ARP
            table as removing it on exit proved to have unwanted
            side effects.

         8  The NAT32 service now works correctly. Note that under
            Vista and higher, the only way to interact with the
            NAT32 Service is via its built-in web server.

         9  Setup.exe and Nat32.exe are now signed.
            Kprintf writes to nat32.log if running in a service.
            various other minor changes.

        10  All exe files in the distribution are now signed.

        11  New command added for setting DNSDOMAIN.

            Usage: setd [domain]

            Variable DNSDOMAIN is used if no interface-specific
            domain is known. It defaults to localhost.

            New command added for setting an interface-specific
            domain name.

            Usage: setdi [ifn [domain]]

            This is the value used by the DHCPD on the specified
            interface. It defaults to to the value in DNSDOMAIN.

            Note that DNS extras should be turned on.
            See help setns for details.

        12  Fixed various problems in netin.

        13  Fixed WINUTE to allow selection of bad adapters.

        14  Fixed a string length problem (tlen2) in GetAdapterName.
            Another correction related to the above problem made.

        19  Win command expanded:

            winh cmd.exe        // run cmd.exe within NAT32
            wins notepad.exe    // run notepad.exe, show window

            All other variants minimize the child window.

        21  Name2ip bug fixed.

        22  When NAT32 starts, it now prompts the user if it is
            already running. The user can choose to continue in
            either the original invocation or the new invocation.

            Admin.exe program added to distribution.
            Starts an application in privileged mode.
            Usage: admin progam [args]+

            Command: driver install now optionally restarts NAT32
            in Admin mode.

        23  Several minor bug fixes.

        24  Command execa added. Used for elevated execution of a
            specified program.

        25  Several minor problems fixed.

        26  Minor changes only.

        27  The WinPkFilter files are now included as a zip file
            within the installer.

        29  New command: winerror dec | hex
            Displays error text for a given Windows Error Code.

            New command: raserror dec | hex
            Displays error text for a given RAS Error Code.

        30  New WinPkFilter installer included.

            Installation instructions enhanced.

    May, 2010 BUILD 2010

         7  Device change support for the WinPkFilter
            driver added.

        12  Dial-Up Server support disabled in this build.

        15  Windows Installer added.

        18  Several bug fixes.

            Uninstall command added.

        19  Several help pages updated.
            DNS Test now works. Note that all of NAT32's outgoing
            traffic is now mapped.

        22  Bug in netstart fixed. Unused adapters in nat32.ini
            were causing a reconfiguration required message.

        22  Uninstall shortcut added to Programs menu

        23  Dir command fixed.

            Shell now handles files like xyz.htm by executing:
            webf xyz.htm

        24  All old ffblk code removed from x_flash, pop3w and
            x_regsz. File dir.h removed from NAT32 project.

        27  Problem in netcfgx command fixed.

        28  ARP problem fixed.
            FTP Passive Mode handling bug fixed.

        29  Kernel.h modified to #define write.
            Not needed in web.c though.
            File autoreply.txt is used for chat autoreply
            default text. Out of office is otherwise the
            default.

        30  Winute modified to list bad adapters.
            Function isBadAdapter returns 1 if wpf->isenabled
            is 0.
            Listing the bad adapters lets us bind to adapters
            that are absent at the time but that may become
            available later.
            The number of bad adapters can be quite large on
            some machines. Checkbox Show All can be used to
            hide/show them.

            Web Stop now no longer prompts for stop type.

        31  PPP writes were using wrong src and dst addresses.

            Rttimer was not running connect.txt, disconnect.txt
            or change.txt.

            DNS Detection was not taking place. This is now done
            in netin rather than in netin1.

            Bug in UDP Checksum check in udp_in fixed.

    March, 2010 BUILD 2001  *** Initial Beta Release ***

        20  Dial-up suppport updateded.

        22  Minor fixes.

        23  SoftAP command added. Usage: softap [on|off]

            New variables added:
            ssid    Virtual WiFi SSID    (max 64 bytes)
            passkey Virtual WiFi PASSKEY (max 64 bytes)
            v       Virtual WiFi interface number
            vips    Virtual WiFi IP address string

            Before issuing a softap on command, the ssid
            and passkey must be set.

            Power Broadcast message turns softap mode
            on or off as appropriate.

            OnExit turns softapp off.

       24   Both NAT32 and the WinpkFilter driver are
            now test-signed.

[BACK]