Peerblock an alternative to Peerguardian

[Blitzen]

PeerBlock lets you control who your computer "talks to" on the Internet.  By selecting appropriate lists of "known bad" computers, you can block communication with advertising or spyware oriented servers, computers monitoring your p2p activities, computers which have been "hacked", even entire countries!  They can't get in to your computer, and your computer won't try to send them anything either.

And best of all, it's free!

Download at www.peerblock.com

Userguide is here http://www.peerblock.com/userguide


One of it`s draw backs is that it uses as default the blocklist from Bluetack for blocking anti p2p which has suffered allot of controversy. But it can be unselected and other lists used as alternatives. A well maintained anti p2p blocklist and worth considering is from http://nexus23.org/warfare/content/view/17/34/1/0/  the url to add to peerblock for the list and for it to update automatically is http://ip-filter.emulefuture.de/download.php?file=ipfilter.p2p

A vast selection of blocklists that can also be used can be found at http://iblocklist.com/

[GhostShip]

A thought just crossed my mind Blitzen, does this program have the single update per day issue that Peer Guardian has ?

Also I know you like this program but what lists are you suggesting folks use as a bad set of lists means folks will be blocking each other without knowing it, can you actually suggest some valid lists that are not full of dynamic IP's that most folks use ?

[Blitzen]

I was not aware there was an issue with peerguardian 1 day update ?  if you mean does peerblock have the option to auto update every 1 day then yes it does. From what i can make out peerblock has pretty much been re written on the basis of peerguardian i have personally had not problems with it like with peerguardian when it use to crash and slow the computer from closing down etc. But there is a forum on the site and a section for suggestions and ideas aswell as the source code www.peerblock.com

As regards blocklists i persoanlly use the ipfilterX  lists but i think it is maybe up to people to decide by reading up on the list authors information as to wether they want to use a list or not. I have just found good comments around different network forums about certain blocklists. I did try the primary threats blocklist which was at the time the only blocklist that contained the Trident Media Guard ip ranges that was reported about on torrent freak recently, but i found the primary threats list blocked msn lol but i dont know maybe thats a good thing ?
Anyway there is a section of lists here http://iblocklist.com/lists.php   with info about the authors and so forth.

As regards checking lists for dynamic ips are you trying to keep me busy for the next few years ? lol

[Blitzen]

Sorry for the double post but for some read the modify option is not available

Anyway here is a quote from peerblock FAQ

PeerBlock is actually based on the same code used to create PeerGuardian - specifically, the "PG2 RC1 Test3" Vista beta version.  That code had a LOT of bugs in it, and hadn't been updated for about two years.  So I started up this PeerBlock project to fix all those things that's been annoying me for so long.  A bunch of other people decided to pitch in and help out, some with development, some with testing, and now we're where we are today.

So compared with old PeerGuardian software, PeerBlock is much more stable, doesn't require nearly so many hacks/workarounds to get working on Vista/Win7, and is actually under active development . . . so we can (and will!) actually respond to new bug reports or feature requests.

And from the stable release notes

What's New?
Many, many changes are present in this release versus the most recent Stable Release, PeerBlock 0.9.2 (r86).  Here are the highlights, you can check out the Changes page for more details.

Signed Driver - We now have a signed driver!  If you're using a 64-bit version of Windows Vista or 7, you will no longer need to test-sign the driver, or hit F8 during boot, or anything else.  It should all just work!
iBlocklist Lists - We've updated our standard list URLs to point at iblocklist.com lists instead of the original peerguardian.sourceforge.net ones.  They are faster, and are much more reliable - no more "Error contacting URL" messages!  We will also upgrade your pre-existing lists from sourceforge.net hosted ones to iblocklist.com ones.  Also note that the "Gov" list has been removed, since its contents were merged with the "P2P" list long ago.
Installer Rewrite - Our newest Dev Team member, XhmikosR, has pretty much completely rewritten the installer from scratch.  Most importantly, it should actually work now, even during uninstall!  (Not that you'll ever want to uninstall PeerBlock, of course, but just in case...)
Updated List Manager - Reworked this window a bit, to make it easier to get back to the lists originally presented to you in the Startup Wizard.
Allowed Connections Displayed - By default, the "Show allowed connections" option will be disabled.  (This is due to performance reasons, as the tool will consume considerably more CPU if displaying of allowed connections is enabled.)  We are still logging the first 9 allowed packets though, so that you know that we're actually working!
Save Settings - We've added a "Save" button to the settings panel, so that you can be sure your settings updates have been saved.
List Verification - After downloading an updated list, we'll now make sure that the file contains at least one ip-address range before we'll overwrite your old list.  This way you will be protected against your lists being corrupted while downloading them.

[Blitzen]

Here is a little interview on zeropaid with one of the team  (KarlX)  who runs the ipfilterX blocklist that i use

http://www.zeropaid.com/news/9540/exclusive_ipfilterx__the_new_antip2p_ipblocklist_on_the_web/

[Blitzen]

Another interesting read is the following but i cannot find the date this research was done

http://www.cs.ucr.edu/~anirban/Anir-networking07.pdf

1. Consequence of ignoring blocklists: A user without any knowledge of
blocklists, will almost certainly be monitored by blocklisted IPs. We found
that all our clients exchanged data with blocklisted IPs. In fact, of all distinct
IPs contacted by any client, 12-17% were found to be listed on blocklists.
2. A little information goes a long way: We nd that avoiding just the top
5 blocklisted IPs reduces the chance of being monitored to about 1%. This
is a consequence of a skewed preference distribution: we nd that the top
5 blocklist ranges encountered during our experiments contribute to nearly
94% of all blocklist hits.

Sorry for multiple posts but the modify button is not showing ?

[Max™]

Well most of you know what im like for testing stuff, all the servers, bots, clients,
tested Peer Block and... it didnt like Pri's proxy list, kept saying was invalid and failed to initiate,
it does look identical to Peer Guardian, this makes it easy to recognise things for someone swapping over to it,
but to be honest, i prefer Peer Guardian.

[Max™]

Ok i did more testing, reset everything and stared again,
added Pri's proxy block list, it worked this time,
then it wouldn't load lists from PG2 like it said it could import settings and lists, it wouldn't see my list,
i still prefer PG2, but i will add to my site under the PG2 section as an alternative & let people make up their own mind.

[Blitzen]

If you have any problems with Peerblock Max report it on their forum they claim to deal with any issues promptly

[Pri]

The main reason for running Peer Block is that it's still under development. Peer Guardian is 'Abandon-ware' hasn't been updated in 3 years. Now usually this would be fine except that Peer Guardian requires a driver to be loaded and they do not have a driver that works on Windows 64-bit (Vista / Win 7) and also due to its low-level nature it is very temperamental when it meets an operating system it was not designed for. Windows 7 came out after Peer Guardian became dilapidated.

I personally don't have any issues with Peer Block I run it on my Windows Server 2008 R2 (which only comes in 64-bit versions) and the requirement for a signed driver on all 64-bit versions of Windows (except XP/2003) meant that I had to use Peer Block, no choice. But to be honest it runs great so I have no complaints.

There is I guess 1 small bug that is annoying every now and again. If you add/remove a blocking list from the program it won't always actually do it. The UI will refresh and say its been added or removed (whichever action you performed) but the program will continue as if you didn't do anything. So in the case of adding a new block list you may not be protected by that list until you re-start Peer Block and if your removing a list you could still be blocking it even after you've removed it. This doesn't seem to affect blocklists which are downloaded but local lists stored on your own hard disk. But I've not done much testing, I've just noticed it a few times, and it's an intermittent bug which makes it that much more frustrating.

[Blitzen]

@ Max and Pri    what blocklists do you use if i may ask ?

[GhostShip]

I can see my question has not been answered here or rather it has the blocklist this program uses can only be loaded once per day so there are a potential 23 hours of unblocked action before a new range is blocked, thankfully winmx users dont have to wait that long 

[Blitzen]

Many anti virus programs only update every 24 hours yet we rely on them to protect us, but as i said Peerblock are open to listen to feature requests simply post you want peerblock to update lists every 5 mins if thats what you want. And winmxworld only block specific threats detected on its network not any anti p2p groupip ranges that the mentioned lists do. So if some anti p2p group for example Trident media guard was active on winmx can you guarantee they will be detected right away and blocked?  In my view having anti p2p ips blocked regardless of their activity is more sensible than waiting for them to appear and i personally will continue to use peerblock with my chosen lists regardless of what network iam using. No offence to you guys here but i would rather try to cover my ass from as many angles as possible than just rely on you

As the above reserach shows (which was done in 2006 i have found out now) by not using an anti p2p blocklist then you can be guranteed to be tracked and thats based on research over 90 days.

And the reason caches here ended up on Bluetack blocklist was due to DDOS attacks on other sites and networks, thats according to Bluetack.

[Blitzen]

 I have been in contact with Mark from Peerblock and Karl from Nexus group who run ipfilterX  and hope they may add there insight into this discusion

[Blitzen]

My understanding is that anti p2p companies do not change their ip ranges often, but could use Bogon ip ranges to do their dirty work. Maybe someone could explain in more detail how these lists are complied and how they are maintained ?

any chance of fixing the modify post as it would save makin multiple posts

[Max™]

In answer to your question Blitzen,
i use a proxy blocklist as supplied on Pri's site,
also a small list i compiled that includes the blockings from the community patch,
as i host 2 rooms and only use winmx a small amount, blocking unwanted ip's in PG2 is ideal for me on XP 32-bit

[GhostShip]

Thats the real problem Blitzen for this network none of the blocklist compilers are able to state they have anyone monitoring the network and thus their lists are useless for our purposes in general.

So lets clarify this, using peer block is no different to using peer guardian, they both are incapable of updating in a sensible time frame, the key difference is peer block is simply PG code updated for Vista, whats of more concern to me as usual is that  no one seems to be able to point to a list they can put their hand on their heart and say they have confidence in the lists and we dont know how anyone compiles them in any case.

I think in a nutshell most lists are not going to be much help unless they are compiled by real folks on the network you use, I have seen many poor blocking decisions over the years and for winmx theses lists offer little or no protection due to the two tiered nature of the network, something neithe PG nor PeerBlock are able to handle, I expect the same is true of the Gnutella network also as that offers a similar target profile for attackers.  

if some anti p2p group for example Trident media guard was active on winmx can you guarantee they will be detected right away and blocked?

Yes, thats the point of having a team take care of such things, night and day folks are watching for attackers, you,ll never wait 23 + hours for anything to be blocked here, even if the team was asleep there are automated tools in use that ensure no mass attacker is missed.

If I was using another network I may use such a tool but as I dont I cant see the need to block random IPs and shadows "just in case", thats not something we have ever done

[Pri]

Something to know about the Proxy Blocklist on my site. I no longer update it. The guys who do the spamming have been using it to cross reference their proxy IP's so if its on my list they wont even try and use it to spam. I recommend instead that people use the Proxy Blocker script which includes a way to figure out if IP's are proxies or not without an IP database.

I may update the Proxy List eventually but it's unlikely as the script works so well.

[Blitzen]

@Ghostship   so you state your team looks for "attackers " so any anti p2p group who may just be sniffing around winmx would not be detected and blocked so therefor users who simply do not want any anti p2p group connecting to them would be left venerable. For example as already mentioned Trident media guard who are out trying to catch French users for sharing files, it has also been reported they are operating in other countries, is there any of their ip ranges in winmx blocklist ?  and in fairness no blocklist author states they 100% protect you but some protection is better than non, and i hope people reading this read back to previous pages and make up their own minds as at the end of the day it is the user who may face the ultimate penalty.

[Max™]

Pri,
its a shame you dont keep the PG2 blovklist updated,
the new script for metis i found was using a lot of bandwidth on the 2 metis' as i run 2 rooms, this seemed to make me feel like i was restricted and found sometimes i couldn't google/surf the net, so removing the scripts allowed me to carry on as normal,
so i have no other way than to use PG2.