The history of BeeThink IP Blocker

In the early 2006, a computer virus was discovered in our computer by an anti-spyware tool when we purchased books online. The anti-spyware reports showed that the virus was a kind of spyware which focused on stealing users' private information, including bank card ID. We installed Wireshark and then found there were much suspectable network packets passed through. Obviously, it is a "known" one, but what about the "unknown" computer virus.

We once believed it was a good idea to monitor network traffic which passed through our computer to detect spyware activities. Users just sit before a computer and do not access the Internet. If there is much network traffic, the computer may be infected by spyware. The idea carried on and the first version of BeeThink SpyDetector was released. Finally, the feedback of users showed that BeeThink SpyDetector was not a success product. It needs users to have much network knowledge and most users like easy-to-use products. 

After two years, BeeThink SpyDetector changed into another simple product named BeeThink IP Blocker. The first public version of BeeThink IP Blocker was released in 2009 and the primitive goal is to help users to ban IP addresses by simple clicking. The second version is fully compatible with Windows 2000, XP, 2003, 2008, Vista, Windows 7, in 32-bit and 64-bit. 

There is another famous IP blocking tool Peerguardian, which is based on a filter-hook driver. In a Windows system, only one filter-hook driver can be used at a time. This means the later filter-hook driver can replace Peerguardian driver with ease. In addition, not all network packets pass through filter-hook driver for the reason of that it filters network packet at a high level. Unlike Peerguardian, BeeThink IP Blocker is based on NDIS intermediate driver, through which each network packet passes. A Windows system allows multiple NDIS intermediate driver installed in it and this is a technique which many commercial firewalls use. 

During the next year, BeeThink added more features to BeeThink IP Blocker, such as running as a Windows service. This feature make BeeThink IP Blocker ideal for use on a server or whenever you need long-running functionality that does not interfere with other users who are working on the same computer. Meanwhile, Users can get highest performance with lowest CPU usage by enabling BeeThink IP Blocker service without running BeeThink IP Blocker application.

Moreover, BeeThink IP Blocker has network protocol based firewall rules, which is useful for advanced users such as website masters. In order to let users view network packets information easily, BeeThink IP Blocker organizes network traffic by IP address and a built-in whois tool is included. For webiste masters, BeeThink IP Blocker supports Apache's .htaccess file to ban country IP addresses. In the recent version, BeeThink IP Blocker adds supports for IP list automatic updating, exception rules and log files.

In the future, BeeThink IP Blocker will focus more on network security.

Faster IP address search

This article shows two search methods that different versions of BeeThink IP Blocker adopt. The two methods are sequential search and binary search. The performance of the later one is more superior than the former.

In order to search a certain IP address in the whole IP list, BeeThink IP Blocker organizes the IP list in sequential order. Once BeeThink IP Blocker application stars, it reads IP list and checks it if all IP addresses are ordered. If not, BeeThink IP blocker application makes it in sequential order and then send it to the kernel IP filter driver. When a network packet passes through the IP filter driver, it will be matched to the whole IP list to see whether it will be blocked or not.

In the first version of BeeThink IP Blocker, each network packet just be matched from the first IP addresses of the whole IP list to the last one. This search method is called linear search or sequential search, with which each IP address of the whole IP list is checked. Linear search is easy to implemented but it spends much time especially when the IP address number of the IP list is more than 200,000. 

The second version of BeeThink IP Blocker changed the search algorithm to a faster one - binary search. The idea is simple: compare the target IP address to the middle item in the IP list. If the target IP address is the same as the middle item, the target IP address is matched. If it is before the middle item, repeat this procedure on the items before the middle. If it is after the middle item, repeat on the items after the middle. In the end, the target IP address will be found out whether it is included in the whole IP list or not. From such a way, BeeThink IP Blocker gets high performance.