About the domain:
According to http://www.adobe.com/devnet/flashplayer/articles/socket_policy_files.html, "allow-access-from" defines the domain where the SWF content is hosted. If we are planning to only host the SWF file on one or more specific servers, we can specify their names. If we want to allow anybody to host the SWF code, we need to keep domain="*".
My proposal:
- For the GSoC development phase, we should allow any domain, to make sure Anant (and I and any of us) can run it from any machine. 
- However, when in production, it may be ok to serve the SWF from the M-Lab servers and only allow third-party servers on request.
- For development and testing after beyond GSoC, we could use one of the M-Lab testing servers to host the SWF (provided that we can connected if we set-up an ssh-key).

About the port(s):
@anantsubramanian does the NDT client always bind to the same ports?