diff --git a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/HTTPResponseOutputStream.java b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/HTTPResponseOutputStream.java
index abb7822ad8ba9bbc001257686d5e6359d60b2046..73dba50daf05345689ea0dfb714054138ca55c55 100644
--- a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/HTTPResponseOutputStream.java
+++ b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/HTTPResponseOutputStream.java
@@ -65,10 +65,12 @@ class HTTPResponseOutputStream extends FilterOutputStream {
         _buf1[0] = (byte)c;
         write(_buf1, 0, 1);
     }
+
     @Override
     public void write(byte buf[]) throws IOException { 
         write(buf, 0, buf.length); 
     }
+
     @Override
     public void write(byte buf[], int off, int len) throws IOException {
         if (_headerWritten) {
@@ -181,6 +183,7 @@ class HTTPResponseOutputStream extends FilterOutputStream {
                                 _gzip = true;
                             } else if ("proxy-authenticate".equals(lcKey)) {
                                 // filter this hop-by-hop header; outproxy authentication must be configured in I2PTunnelHTTPClient
+                                // see e.g. http://blog.c22.cc/2013/03/11/privoxy-proxy-authentication-credential-exposure-cve-2013-2503/
                             } else {
                                 if ("content-length".equals(lcKey)) {
                                     // save for compress decision on server side
@@ -272,7 +275,7 @@ class HTTPResponseOutputStream extends FilterOutputStream {
                 while ( (read = _in.read(buf)) != -1) {
                     if (_log.shouldLog(Log.DEBUG))
                         _log.debug("Read " + read + " and writing it to the browser/streams");
-;                   _out.write(buf, 0, read);
+                    _out.write(buf, 0, read);
                     _out.flush();
                     written += read;
                 }
diff --git a/apps/streaming/java/src/net/i2p/client/streaming/PcapWriter.java b/apps/streaming/java/src/net/i2p/client/streaming/PcapWriter.java
index a5020cccde8704200d4d9b3331bdc7d1b9baf08e..1eee76190f88920f0e3553f9b72168e25044315d 100644
--- a/apps/streaming/java/src/net/i2p/client/streaming/PcapWriter.java
+++ b/apps/streaming/java/src/net/i2p/client/streaming/PcapWriter.java
@@ -49,10 +49,10 @@ public class PcapWriter {
                                                 0, 2, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0,
                                                 0, 0, (byte) 0xff, (byte) 0xff, 0, 0, 0, 1 };
 
-    /** dummy macs and ethertype */
+    /** dummy macs, IPv4 ethertype */
     private static final byte[] MAC_HEADER = { 1, 2, 3, 4, 5, 6,
                                                1, 2, 3, 4, 5, 6,
-                                               (byte) 0x80, 0 };
+                                               (byte) 0x08, 0 };
     private static final byte[] IP_HEADER_1 = { 0x45, 0 };  // the length goes after this
     private static final byte[] IP_HEADER_2 = { 0x12, 0x34, 0x40, 0, 64, 6 };  // ID, flags, TTL and TCP
     private static final byte[] UNK_IP = { (byte) 0xff, 0, 0, 0};
diff --git a/core/java/src/net/i2p/crypto/ElGamalAESEngine.java b/core/java/src/net/i2p/crypto/ElGamalAESEngine.java
index 52254c281bc1881f2d0a30b16351a132ccda7d6a..c5fe757781e5483346b820281a346ab3a72f2f26 100644
--- a/core/java/src/net/i2p/crypto/ElGamalAESEngine.java
+++ b/core/java/src/net/i2p/crypto/ElGamalAESEngine.java
@@ -105,20 +105,19 @@ public class ElGamalAESEngine {
         boolean wasExisting = false;
         if (key != null) {
             //if (_log.shouldLog(Log.DEBUG)) _log.debug("Key is known for tag " + st);
-            long id = _context.random().nextLong();
             if (_log.shouldLog(Log.DEBUG))
-                _log.debug(id + ": Decrypting existing session encrypted with tag: " + st.toString() + ": key: " + key.toBase64() + ": " + data.length + " bytes " /* + Base64.encode(data, 0, 64) */ );
+                _log.debug("Decrypting existing session encrypted with tag: " + st.toString() + ": key: " + key.toBase64() + ": " + data.length + " bytes " /* + Base64.encode(data, 0, 64) */ );
             
             decrypted = decryptExistingSession(data, key, targetPrivateKey, foundTags, usedKey, foundKey);
             if (decrypted != null) {
                 _context.statManager().updateFrequency("crypto.elGamalAES.decryptExistingSession");
                 if ( (!foundTags.isEmpty()) && (_log.shouldLog(Log.DEBUG)) )
-                    _log.debug(id + ": ElG/AES decrypt success with " + st + ": found tags: " + foundTags);
+                    _log.debug("ElG/AES decrypt success with " + st + ": found tags: " + foundTags);
                 wasExisting = true;
             } else {
                 _context.statManager().updateFrequency("crypto.elGamalAES.decryptFailed");
                 if (_log.shouldLog(Log.WARN)) {
-                    _log.warn(id + ": ElG decrypt fail: known tag [" + st + "], failed decrypt");
+                    _log.warn("ElG decrypt fail: known tag [" + st + "], failed decrypt");
                 }
             }
         } else {
@@ -568,6 +567,7 @@ public class ElGamalAESEngine {
      *  - random bytes, padding the total size to greater than paddedSize with a mod 16 = 0
      * </pre>
      *
+     * @param target unused, this is AES encrypt only using the session key and tag
      * @param tagsForDelivery session tags to be associated with the key or null;
      *                        200 max enforced at receiver
      */
diff --git a/installer/c/i2pExe/I2P.rc b/installer/c/i2pExe/I2P.rc
index 325d4894318c93b472c5711cc52469f876879cf3..6c0bfa839fba102b9a4faf765da58027dd3dc79e 100644
--- a/installer/c/i2pExe/I2P.rc
+++ b/installer/c/i2pExe/I2P.rc
@@ -94,7 +94,7 @@ END
 
 // Icon with lowest ID value placed first to ensure application icon
 // remains consistent on all systems.
-IDI_ICON1               ICON                    "start.ico"
+IDI_ICON1               ICON                    "../../resources/start.ico"
 #endif    // English (U.S.) resources
 /////////////////////////////////////////////////////////////////////////////
 
diff --git a/installer/resources/proxy/dnfh-header.ht b/installer/resources/proxy/dnfh-header.ht
index 126c93f252e701cb288bedaa12f5dbaf6cfe23b0..936fde51464a93a45628f85e226cdffea3cf62a1 100644
--- a/installer/resources/proxy/dnfh-header.ht
+++ b/installer/resources/proxy/dnfh-header.ht
@@ -19,10 +19,10 @@ Proxy-Connection: close
 <h3>Warning: Eepsite Not Found in Addressbook</h3>
 <p>
 The eepsite was not found in your router's addressbook.
-Check the link or find a BASE64 address.
-If you have the BASE64 address,  paste it into your userhosts.txt using
-<a href="http://127.0.0.1:7657/susidns/addressbook.jsp?book=master">SusiDNS</a>,
-use a BASE64 address helper, or use a jump service link below.
+Check the link or find a Base 32 or Base 64 address.
+If you have the Base 64 address,
+<a href="http://127.0.0.1:7657/susidns/addressbook.jsp?book=router">add it to your addressbook</a>.
+Otherwise, find a Base 32 or address helper link, or use a jump service link below.
 </p>
 <p>
 Seeing this page often? See <a href="http://www.i2p2.i2p/faq.html#subscriptions">the FAQ</a>
diff --git a/installer/resources/proxy/dnfh-header_de.ht b/installer/resources/proxy/dnfh-header_de.ht
index 9f9413424e15f12e5b9b652ef04c2e61bb6bb19a..70016a619f3904e62dbbba3aa318161e991ed416 100644
--- a/installer/resources/proxy/dnfh-header_de.ht
+++ b/installer/resources/proxy/dnfh-header_de.ht
@@ -20,8 +20,8 @@ Proxy-Connection: close
 <p>
 Die Eepseite konnte nicht im Adressbuch des Routers gefunden werden.
 Überprüfen Sie den Link oder finden Sie eine BASIS64-Adresse!
-Wenn Sie eine BASIS64-Adresse haben, fügen Sie diese unter folgendem Link zu Ihrer userhosts.txt hinzu:
-<a href="http://127.0.0.1:7657/susidns/addressbook.jsp?book=master">SusiDNS</a>,
+Wenn Sie eine BASIS64-Adresse haben, fügen Sie diese unter folgendem Link zu Ihrer hosts.txt hinzu:
+<a href="http://127.0.0.1:7657/susidns/addressbook.jsp?book=router">SusiDNS</a>,
 benutzen Sie einen BASIS64-Adresshelfer oder einen der folgenden Sprungdienste:
 </p>
 <p>
diff --git a/installer/resources/proxy/dnfh-header_fr.ht b/installer/resources/proxy/dnfh-header_fr.ht
index c24e2d6bf61cef55210ede7b06e46e8330d2f7f3..0c03e0f9782f7b672713ba7b465bbab1ee703081 100644
--- a/installer/resources/proxy/dnfh-header_fr.ht
+++ b/installer/resources/proxy/dnfh-header_fr.ht
@@ -19,10 +19,10 @@ Proxy-Connection: close
 <h3>Avertissement I2P: site eep non trouvé dans le carnet d'adresses</h3>
 <p>
 Le site eep n'était pas dans le carnet d'adresses de votre routeur.
-Vérifiez le lien ou trouvez l'adresse BASE64.
-Si vous avez l'adresse BASE64,  reportez-la dans votre fichier userhosts.txt en passant par
-<a href="http://127.0.0.1:7657/susidns/addressbook.jsp?book=master">SusiDNS</a>,
-utilisez un lien d'adresse BASE64, ou un service de saut (jump) en  lien ci-dessous.
+Vérifiez le lien ou trouvez l'adresse Base 64.
+Si vous avez l'adresse Base 64,  reportez-la dans votre fichier hosts.txt en passant par
+<a href="http://127.0.0.1:7657/susidns/addressbook.jsp?book=router">SusiDNS</a>,
+utilisez un lien d'adresse Base 64, ou un service de saut (jump) en  lien ci-dessous.
 </p>
 <p>
 Si vous voyez cette page souvent: lisez la <a href="http://www.i2p2.i2p/faq_fr.html#subscriptions">faq</a> pour obtenir
diff --git a/installer/resources/proxy/dnfh-header_nl.ht b/installer/resources/proxy/dnfh-header_nl.ht
index 296a62dddcf3c41116f49ebd95d661cf9de77b94..f2a3d1d199e94ba4cb57feb129198c90bcb1f142 100644
--- a/installer/resources/proxy/dnfh-header_nl.ht
+++ b/installer/resources/proxy/dnfh-header_nl.ht
@@ -19,10 +19,10 @@ Proxy-Connection: close
 <h3>Waarschuwing: Eepsite Niet Gevonden in Adresboek</h3>
 <p>
 De eepsite was niet gevonden in je router's adresboek.
-Controlleer de link of zoek een BASE64 adres.
-Indien je een BASE64 adres hebt, plak het in je userhosts.txt via
-<a href="http://127.0.0.1:7657/susidns/addressbook.jsp?book=master">SusiDNS</a>,
-gebruikt een BASE64 adres helper, of gebruik een jump service link hieronder.
+Controlleer de link of zoek een Base 64 adres.
+Indien je een Base 64 adres hebt, plak het in je hosts.txt via
+<a href="http://127.0.0.1:7657/susidns/addressbook.jsp?book=router">SusiDNS</a>,
+gebruikt een Base 64 adres helper, of gebruik een jump service link hieronder.
 </p>
 <p>
 Zie je deze pagina vaak? Lees <a href="http://www.i2p2.i2p/faq.html#subscriptions">de FAQ</a>
diff --git a/installer/resources/proxy/dnfh-header_ru.ht b/installer/resources/proxy/dnfh-header_ru.ht
index 0e34195599710f578e6888fac971b1df748c4e9b..e7bc4c24bc2ffb282f0b93fe31ac01d90907807e 100644
--- a/installer/resources/proxy/dnfh-header_ru.ht
+++ b/installer/resources/proxy/dnfh-header_ru.ht
@@ -25,7 +25,7 @@ Proxy-Connection: close
 Попробуйте воспользоваться  jump-сервисами (блок ссылок в конце этой страницы). Если кто-то уже добавил этот сайт в jump-сервис, Вы получите addresshelper-ссылку, по которой сможете перейти на сайт.
 </p>
 <p>
-Если ни один из jump-сервисов не помог, попробуйте найти BASE64-адрес этого сайта. Добавьте BASE64-адрес в Ваш файл userhosts.txt используя <a href="http://127.0.0.1:7657/susidns/addressbook.jsp?book=master">SusiDNS</a>.
+Если ни один из jump-сервисов не помог, попробуйте найти Base 64-адрес этого сайта. Добавьте Base 64-адрес в Ваш файл hosts.txt используя <a href="http://127.0.0.1:7657/susidns/addressbook.jsp?book=router">SusiDNS</a>.
 </p>
 <p>
 Часто видите эту страницу? Загляните в <a href="http://www.i2p2.i2p/faq.html#subscriptions">соответствующий раздел FAQ</a> за помощью по <a href="http://127.0.0.1:7657/susidns/config.jsp">настройке автоматической подписки</a> на адреса новых сайтов.
diff --git a/installer/resources/proxy/dnfh-header_zh.ht b/installer/resources/proxy/dnfh-header_zh.ht
index 1e65a67c168f7d1d93017acc3ab23e0cb39c257c..09cbb24cd6ec5b2f582754bd1d440cf1cc044dc2 100644
--- a/installer/resources/proxy/dnfh-header_zh.ht
+++ b/installer/resources/proxy/dnfh-header_zh.ht
@@ -19,10 +19,10 @@ Proxy-Connection: close
 <h3>警告: 地址簿中的找不到此站点</h3>
 <p>
 您所访问的匿名站点(的目标密钥)不存在于您路由器的地址簿中。
-检查链接，或寻找对应的BASE64地址.
-如果您知道对应的BASE64地址请通过
-<a href="http://127.0.0.1:7657/susidns/addressbook.jsp?book=master">SusiDNS</a>
-将其复制入您的 userhosts.txt 中，直接使用 BASE64 地址访问，或使用下面的跳转链接。<br><br>
+检查链接，或寻找对应的Base 64地址.
+如果您知道对应的Base 64地址请通过
+<a href="http://127.0.0.1:7657/susidns/addressbook.jsp?book=router">SusiDNS</a>
+将其复制入您的 hosts.txt 中，直接使用 Base 64 地址访问，或使用下面的跳转链接。<br><br>
 经常见到此页面? 请参见 <a href="http://www.i2p2.i2p/faq.html#subscriptions"> FAQ 常见问答</a>
 中的 <a href="http://127.0.0.1:7657/susidns/config.jsp">添加更多订阅到地址簿中</a>。
 </p>
diff --git a/router/java/src/net/i2p/data/i2np/DatabaseLookupMessage.java b/router/java/src/net/i2p/data/i2np/DatabaseLookupMessage.java
index ca53fda9b120f75bb74bd3a5da0872fa644844b9..d889fce74de1df9ee808805db54dd98d66a4ccc9 100644
--- a/router/java/src/net/i2p/data/i2np/DatabaseLookupMessage.java
+++ b/router/java/src/net/i2p/data/i2np/DatabaseLookupMessage.java
@@ -222,17 +222,9 @@ public class DatabaseLookupMessage extends FastI2NPMessageImpl {
         curIndex += Hash.HASH_LENGTH;
         //_fromHash = new Hash(fromData);
         
-        boolean tunnelSpecified = false;
-        switch (data[curIndex]) {
-            case DataHelper.BOOLEAN_TRUE:
-                tunnelSpecified = true;
-                break;
-            case DataHelper.BOOLEAN_FALSE:
-                tunnelSpecified = false;
-                break;
-            default:
-                throw new I2NPMessageException("Tunnel must be explicitly specified (or not)");
-        }
+        // as of 0.9.6, ignore other 7 bits of the flag byte
+        // TODO store the whole flag byte
+        boolean tunnelSpecified = (data[curIndex] & 0x01) != 0;
         curIndex++;
         
         if (tunnelSpecified) {
@@ -277,13 +269,14 @@ public class DatabaseLookupMessage extends FastI2NPMessageImpl {
         curIndex += Hash.HASH_LENGTH;
         System.arraycopy(_fromHash.getData(), 0, out, curIndex, Hash.HASH_LENGTH);
         curIndex += Hash.HASH_LENGTH;
+        // TODO allow specification of the other 7 bits of the flag byte
         if (_replyTunnel != null) {
-            out[curIndex++] = DataHelper.BOOLEAN_TRUE;
+            out[curIndex++] = 0x01;
             byte id[] = DataHelper.toLong(4, _replyTunnel.getTunnelId());
             System.arraycopy(id, 0, out, curIndex, 4);
             curIndex += 4;
         } else {
-            out[curIndex++] = DataHelper.BOOLEAN_FALSE;
+            out[curIndex++] = 0x00;
         }
         if ( (_dontIncludePeers == null) || (_dontIncludePeers.isEmpty()) ) {
             out[curIndex++] = 0x0;
diff --git a/router/java/src/net/i2p/router/networkdb/HandleDatabaseLookupMessageJob.java b/router/java/src/net/i2p/router/networkdb/HandleDatabaseLookupMessageJob.java
index 13f81f1e6b7c3f47bd4b5074bc3f4a38ce412d06..52f32e4919491933606408fd57fef68ca9e0cb69 100644
--- a/router/java/src/net/i2p/router/networkdb/HandleDatabaseLookupMessageJob.java
+++ b/router/java/src/net/i2p/router/networkdb/HandleDatabaseLookupMessageJob.java
@@ -78,6 +78,7 @@ public class HandleDatabaseLookupMessageJob extends JobImpl {
             return;
         }
 
+        // TODO only look up once, then check type
         LeaseSet ls = getContext().netDb().lookupLeaseSetLocally(_message.getSearchKey());
         if (ls != null) {
             // We have to be very careful here to decide whether or not to send out the leaseSet,