text:
Introduction | Phrack Staff |
Phrack Loopback | Phrack Staff |
Line Noise | various |
Phrack Prophile on Glyph | Phrack Staff |
An Overview of Internet Routing | krnl |
T/TCP Vulnerabilities | route |
A Stealthy Windows Keylogger | markj8 |
Linux Trusted Path Execution redux | K. Baranowski |
Hacking in Forth | mudge |
Interface Promiscuity Obscurity | apk |
Watcher, NIDS for the masses | hacklab |
The Crumbling Tunnel | Aleph1 |
Port Scan Detection Tools | Solar Designer |
Phrack World News | disorder |
extract.c | Phrack Staff |
---[ Phrack Magazine Volume 8, Issue 53 July 8, 1998, article 05 of 15 -------------------------[ Introduction and Overview of Internet Routing --------[ krnl <email@example.com> ----[ Routing Overview: The process of routing can be quickly summarized as a node finding the path to every possible destination. Routing is present in everything from layer 1 (the physical layer) on up. The routing that most people are familiar with, however, occurs at layer 3 (the network layer) and as such, we will only reference layer 3 (and more specifically) Internet Protocol (IP) routing in this document. Protocols for exchange of routing information connect multiple routers around the world to provide them with a common view of the network through their heterogeneous, though generally consistent routing tables. Routing tables store all information necessary for the router to reach every destination on the network irrespective of size (i.e. the network could be j.random LAN with one ip router and two hosts off of an ethernet port or it could be the Internet proper). ----[ Routing Protocols: There are a wide variety of routing protocols used to contribute to the routing tables across a network. Protocols such as BGP, OSPF, RIP and ISIS help to convey a correct and coherent picture of the network to all network switches (routers). ----[ Routing Goals: You can imagine that if each router has to store information that would allow it to reach every destination on the network, there is the possibility for it to amass a large routing table. Large routing tables are difficult (and sometimes impossible) for routers to process because of physical constraints (cpu, memory or a combination). Therefore, we would like to minimize the routing table space without sacrificing the ability to reach every destination on the network. For example, if the router is connected to the Internet via one DS1 link to another router, the router could store routing table information for each destination on the Internet or it could just default non-local information out that serial link. What defaulting means is that if the router does not have a specific entry in its table for the destination that the packet is trying to find, it sends it out the default link. The router towards which a router sends defaulted packets is sometimes called the 'gateway of last resort'. This simple trick allows many routing tables to save a number of entries on the 30th order of magnitude. Routing information should not be exchanged between routers in a spurious fashion. Frequent churn in the routing table puts unnecessary stresses on the scare memory and cpu of any given router. Information propagation should not interfere with the forwarding operations of the router. Though this means that you should not send routing updates every nanosecond, it does not mean that routing information should only be exchanged and updated weekly. One of the important goals of routing is that it provide the host with a table which accurately reflects the current status of the network. The most important aspect of a router's operation is sending packets from input to correct output. Misrouting packets could cause a loss of data. Routing table inconsistencies could also cause routing loops whereby a packet is passed between two adjacent interfaces ad infinitum. It is desirous for routers to have quick convergence. Convergence can be informally defined as a metric which gauges the speed at which routers arrive at a consistent view of the network. It would be ideal to have infinitesimal convergence times because that would ensure that each router on the network can accurately reflect the current topology even after a drastic change (link failure). When the network is changing, each router must propagate data which will aid other routers in converging to the correct picture of the network status. Problems with quick convergence are found in the routing updates. If a link is flapping (changing line status from up to down) rapidly, it can generate numerous installation and withdrawal requests. Therefore, that one link can end up consuming the resources of every router on the network because the other routers are forced to install and withdraw the route in rapid succession. While convergence is an important goal of routing protocols, it is not a panacea to network woes. ----[ Distance Vector Routing Distance vector routing protocols distribute a list of <destination, cost> tuples to all of the router's neighbors. These tuples assign a cost to reach every other node of the network. It is important to note that this routing information is only distributed to routers which are assigned as neighbors to the originating router. These neighbors are often physical, but can be logical in the case of eBGP multihop. That cost is the sum of the link costs for the router to reach a destination. Routers periodically send their neighbors distance vector updates; the neighbor then compares the received distance vector to its current distance vector. If the received values are lower, the router sends output to the destination in the distance vector over the link that it received the vector over. The count to infinity problem is a problem with many distance vector implementations. We will assume that all links have a unit cost and that each hop corresponds to a unit. For example, if router X is connected to router Y and router Y is connected to router Z, we can demonstrate this problem (see fig 1). Y knows a 1 hop path to Z and X knows a 2 hop path to Z. Assume that link YZ goes down and the cost of that route is increased to infinity (fig 2). Now, Y knows an infinite cost route to Z because it knows the link is down so it propagates this distance vector to X. Suppose X has sent an update to Y which advertises a 2 hop distance vector. Now, Y will think that it can get to Z through X, so it sends X an update that says it can get to Z in three hops (fig 3). Note that X has no idea that the distance vector being advertised to it was originated from X. This is a serious flaw in distance vectors. In their unmodified form, they do not contain the full path information that the route has traversed. As illustrated above, the router alternates states of advertising a path to Z and advertising infinity to Z. They keep this exchange up forever or until they have reached some internally defined infinity count (say 15 as in the case of RIP). Count to Infinity problem: X--------------------Y--------------------Z Y:1 X:1 X:2 Z:2 Z:1 Y:1 [ fig 1 ] All links are up, below each node we note the destination and hopcount from each respective node. X--------------------Y--------* *---------Z Y:1 <------------- Z:infinity Z:2 -------------> X:1 [ fig 2 ] The link Y - Z breaks. Node X advertises Z:2 to node Y. X--------------------Y--------* *---------Z Z:infinity(frm Y) -> X:1 Y:1 <------------- Z:3 [ fig 3 ] Node Y sends its Z distance vector to X _before_ it recieves node X's infinity. Once node Y receives node X's infinity, it sets its distance to infinity. A path vector is an easy way to defeat the count-to-infinity problem. Basically, each distance vector also includes the router path that it traversed (fig 4). The router rejects an update from its neighbor if the path included in the update includes the router receiving the update (fig 5). The Border Gateway Protocol (which is used to exchange routing information between Autonomous Systems on the Internet) incorporates the path vector to stop the count-to-infinity problem. Obviously, you have to incorporate more information in the routing table if you want to include the AS path information that the route has traversed. The designers of BGP decided that it was optimal to sacrifice storage space and processing power for the robustness that the path vector affords the routing protocol. Path Vector Solution: X--------------------Y--------------------Z Y:1 (Y) X:1 (X) X:2 (YX) Z:2 (YZ) Z:1 (Z) Y:1 (Y) [ fig 4 ] All links are up, below each node we note the destination, hopcount and path vector from each respective node. X--------------------Y--------* *---------Z Y:1 (Y) X:1 (X) Z:2 (Y Z) Z:infinity [ fig 5 ] The link Y - Z breaks. Node Y knows to ignore Xs advertisement of Z because Y is the path vector. The avoids the count-to-infinity problem. Another way to counter this problem is the split horizon. Basically, this means that a router shouldn't advertise a path to a neighbor if that neighbor is the next hop to the destination. This solves the problem presented in the example above because the path to Z from X through Y would not have been advertised to Y because Y is the neighbor _and_ the next hop to the destination (Z). A variation called split horizon with poisonous reverse has router X advertise an infinite cost to get to destination Z. Under a split horizon, router X would not advertise that it could get to router Z. ----[ Link State Routing A router using a link state routing protocol distributes the distance to its neighbors to every other router on the network. This allows each router on the network to make a routing table without knowing the full cost to the destination from any one source. The problems of loops are avoided because each router contains the full topology of the network. Basically, the router makes a 3 tuple containing the source router (itself) the neighbor and the cost to its neighbor. Therefore, if router A is connected to Router B over a link of cost 3 and router A is connected to router C over link cost 5, then router A would advertise the Link State Packets (LSPs) <A,B,3> and <A,C,5> to all routers on this network. Each router on the network would evaluate all of the LSPs that it receives and calculate a shortest path to every destination on the network. Obviously, the LSP is an integral part of the convergence process. If someone could inject false LSPs into the network, it could result in misrouted information (a packet taking a longer path than it should) or even in the blackholing of a router on the network. This is not necessary a malicious attack of a network, however. Router C could advertise a link to its neighbor D with the 3 tuple <C,D,6> and then withdraw the announcement when the link goes down. Unfortunately, if the LSP advertising the link having an infinite cost arrives before the LSP advertising the cost of that link being 6, the routing table will not reflect the topology of the network and will be in that state until another LSP comes to correct the problem. To combat this, a sequence number is introduced into the LSP. Therefore, all of the routers on the network would initialize their sequence number to some starting value and then start advertising their LSPs. This solves the above problem in that the LSP advertising the link of infinite cost would have a higher sequence number than the LSP advertising the link as having cost 6. Some problems encountered when using sequences numbers are finite sequence space, sequence initialization, and aging. It is in the best interest of a robust link state protocol needs to protect its LSPs as well as choose a sequence space which is sufficiently large to accommodate updates. The sequence space that the LSPs can use is set to some finite value. Therefore, when the sequence numbers reach the top of the space, they must wrap around towards the smallest sequence number. This presents a problem because when a router compares link state updates, the greater sequence number takes preference. To combat this problem, you can define a maximum age of the LSP. Therefore, if you have not received an update in X ticks, you discard the current LSP information and wait for a further update. It must be noted that this invalidates the path information to a destination. For example, if router Y advertises a cost to its neighbor router Z where router Y is connected by one link to a meshed network, when the link between the mesh and router Y breaks, the other routers in the mesh have preserved link state information that will allow them to find a path towards Z. If they receive no updates in MAX_AGE, then they will assume that the link to Y is unreachable. This will allow each router to converge its table and allow it to advertise an infinite LSP for Y and Z. Sequence initialization is also an important facet of this problem. Say router Y crashed and is rebooting while the network is recalculating paths to it. When it starts its link state protocol back up, it must somehow indicate that it needs to reinitialize its sequence number to the last number it gave all of the other routers to allow for coherence. Therefore, it can announce paths with a sequence number in a special "initialization set". This initialization set will tell the other routers that this router needs the sequence where it left off. This is the "lollipop sequence" idiom. The sequence space really resembles a lollipop in that the normal sequence number keep churning around the finite sequence space while reinitialization takes place in a short linear sequence space (comparable to the stick :). Great pains are taken to ensure the integrity of LSPs. In fact, this entire routing algorithm depends on the LSP being digested in a coherent method to guarantee that each router has the correct view of the network topology. The question still remains how the root node router computes the distance to each destination. Because of the general nature of a link state protocol, you have various nodes of the network advertising the distance to get to their neighbors to every other node on the network. Thus each node has a collection of neighbor distances from various routers on the network. The routing table is basically 'grown' outward from the root node to all of the network extremities. This will be explained in a slightly rigorous fashion in the next section. ----[ Dijkstra's Algorithm This algorithm is a simple and elegant way to determine network topology. Basically, there are two distinct sets of destinations on the network. Destinations in set K are known routes for which a shortest path has been computed. Destinations in set U are routers for which the best path to that router is not currently known. In this set, paths are being considered as candidates to be the best path to that destination. To start off, add the current node p into the set K. Then add all of its neighbors into the set U with path/cost associations. If there is another path to one of the neighbors in the U set, then choose the path which costs the least. When the neighbors N* are added to U make sure that they indicate the cost through p as well as p's ID . Once this has been done for the set U, then pick the neighbor n to p which has the smallest cost to reach p. This is assuming that the neighbor has not already been installed in K. This algorithm stops when set U is equivalent to the empty set. When set U is null, it is implied that all destinations are in set K and have the shortest cost from the root node P on which this algorithm is running. Note, that each step evaluates adds ONE neighbor into K. That neighbor is the router with the smallest cost to reach p. ----[ Distance Vector vs. Link State We are left with these protocols like BGP which uses path vector and OSPF which uses link state. Why do they occupy such orthogonal space? When a link state protocol is working correctly, it guarantees that there will be no routing loops in the network. The link state protocol also guarantees fast convergence when there is a change in the topology of the network because the link state is distributed on a flat routing space. Since link state protocols contain these inherent advantages, why do protocols like BGP chose to employ the path vector approach? Taking a cross-section of routing protocols that are employed on the internet, one finds that the majority of large providers use OSPF to resolve routing information on their internal network and BGP to talk to other distinct networks (or autonomous systems) at their borders of administration. What suits BGP as an external protocol and OSPF for an internal routing protocol? One issue, which will be discussed in the next section, is hierarchy. BGP provides a mechanism for a routing hierarchy which enables it to greatly reduce the space of its table. OSPF, which is a link state protocol, provides a flat routing table whereby any internal router knows the full hop by hop path to any destination within the autonomous system. Furthermore, distance vector protocols understand that different areas can have different views of the network where link state protocols require that each node independently compute a consistent view of the network. This saves the DV protocol the overhead of maintaining a correct LSP database. BGP also has another 'advantage' in that it is layered on top of the Transmission Control Protocol (TCP). Therefore, in the 'best-effort' service of IP networks, BGP has assurance (to the level that TCP can guarantee) that routing information will be propagated. Whereas, you can (or should) be able to govern the status of your internal network, the nebulous exterior past your border routers confers no delivery guarantee on your routing information. Each type of routing algorithm is suited for its function. Link State protocols provide the quick convergence that is essential to an internal network while distance vector protocols provide external reachability. Hierarchy is not something that is inherent in distance vector protocols, but the implementation of a hierarchy has made BGP a widely used exterior gateway protocol. ----[ Routing Hierarchy Routing hierarchy is an oft fought debate that borders on religion. There are constantly questions about how hierarchy should be implemented (if at all) in the free form state of the current global network. Hierarchy imposes a tree of authority with the overall authority at the top of the tree and branching down to regional authorities, local authorities ad infinitum. Hierarchy simplifies routing because if a destination is not locally routable (or under your section of the tree). You can iterate up towards the top tree to try and deliver that information. As you move towards the top, the routing information contained in the routers becomes less and less specific until you reach the root node which is the least specific. It does, however, know how to route information to every possible destination on the network. It may help you to envision the hierarchy of the telephone network (built under one collective). If a call cannot be placed within a central office, it is handed to either another central office in the area code or a wide area link. The wide area link understands how to route to each area code in a full national mesh whilst the local 5ess switch only knows routing information for more specific prefixes. As the phone number becomes less specific (from right to left), the routing decision moves further up the strict hierarchy. This similar to how the domain name system (DNS) works on the internet (fig 6). You provide local records for domains that you host. When your nameserver receives a query for a record, it either returns the fact that it has authority for that record or points toward the root nameserver. The root nameserver knows the delegations of .com, .net, .org et al. and then points towards the site responsible for that top level domain. That site then points towards the site that has authority for the specific second level domain. Domain names take the form of most specific -> least specific; i.e. microsoft.com is more specific than just .com. Likewise gates.house.microsoft.com is more specific than microsoft.com. DNS Hierarchy: ___ . ___ / | \ .com. .org. .edu. / | \ microsoft.com. eff.org. isi.edu. / | \ billy.microsoft.com. x0r.eff.org. rs.isi.edu. [ fig 6 ] Each level in the hierarchy is responsible for levels of greater specificity. Root authority is controlled by the Internet Assigned Numbers Authority (IANA). It provides the top of the hierarchy in a "centrally" managed database (in fact, there are multiple root servers distributed across the county which maintain a consistent database). This is the closest example of strict hierarchy that can be found on the internet. With IP addresses, specificity increases in the opposite direction. IP addresses (version 4) are 32-bits. The rightmost bit signifies the greatest amount of specificity and the leftmost, the least. IP routing authority information is not maintained in a centralized database. Routing information is exchanged between autonomous systems via the BGP protocol. Routes take preference in order of most specific -> least specific. In this way, there is some type of hierarchy in the system (even though it is more loose than the DNS example). Generally, larger providers control larger parts of the total IPv4 space ((2^32) - 3 addresses). The converse is also true. Classless Inter-Domain Routing (CIDR) also helped to decrease the size of routing tables and increase the appearance of hierarchy. Now, instead of Sprint announcing routes to 126.96.36.199 through 126.96.36.199 (on the classical B space boundary) it could announce 18.104.22.168/12 which encompasses that entire 16 class B range. The classful ranges, subnetworking and the like are discussed in my "introduction to IP" page and are therefore not included in this document. ----[ Routing Hierarchy and Aggregation BBN divides their 8/8 network into two subnetworks and advertises reachability to the aggregate to save table space. Once inside an AS, routing obeys a fairly strict hierarchy. Router A is responsible for the entire 131.103/16. It divides it into two /17. Likewise, Router D in AS1 is responsible for 8/8 and chooses to divide it into 8.0/9 and 8.128/9 and divides responsibility for these networks to Routers E and F respectively (fig 7). Routers B, C, E, and F can further choose to subdivide their networks in a hierarchical fashion. Because of the binary nature of subnetting, networks can only be divided in half. Routing Hierarchy and Aggregation: BGP 22.214.171.124/16 <--------------------> 22.214.171.124/8 A (AS1239) D (AS1) / \ / \ B / \ C E / \ F / \ / \ 22.214.171.124/17 184.108.40.206/17 8.0/9 8.128/9 [ fig 7 ] In the internet, there is no strict routing hierarchy. There are simply large networks which peer via BGP to distribute aggregated routing information. The national backbone is populated by few nodes (when compared to the end nodes). Most national providers are one or two router hops away from every large network. Through aggregation in networks below, national providers provide fully (or at least we hope) aggregated routing information. In a strict hierarchy, only one router on any given hierarchy level can advertise reachability to a specific portion of the network. In the current state of the Internet, multiple routers can advertise reachability information. For example, Sprint announces 126.96.36.199/16 out to Digex, MCI, and BBN. Though this breaks some of the benefits of a strict hierarchy, it confers other benefits. This scheme allows for distributed control of routing information instead of depending on the node above. Also, nodes on the same level are often interconnected to aid in the dissemination of routing information. ----[ Aggregation As discussed slightly before, aggregation allowed the internet to reduce the size of its external reachability tables. Before, the granularity of route announcements allowed for only /8, /16, and /24 (octet boundaries). Now, with CIDR you could use variable length subnet masks. The only requirement was that they fall on one of the 32-bit boundaries of the IP address. Classless routing not only allows us to minimize routing table space, it also allows us to divide up large chunks of unused space into manageable pieces. Much of the Class A space is terribly under-utilized. With this scheme one can more efficiently allocate IP addresses to providers/netizens. The American Registry of Internet Numbers (ARIN) controls the allocation of IP addresses within the United States. Aggregation helps alleviate the problems of not being in a strict hierarchical structure. It allows the least amount of route table specificity at each level (assuming the routers on that level choose to fully aggregate their announcements.) The less specific aggregates do not necessarily indicate the position of a router in the hierarchy. For example, a university may announce a /8 and be 3 hops away from the national backbone. A problem with aggregates can be found when we examine candidate route specificity. If ISP A only has address space from within the allocated block to their parent P, then aggregation could cause problems if ISP A wanted to multihome to parent Q. The problem comes in that ISP A is obligated to advertise reachability only to their space. This would constitute them announcing their address space to Parent Q. Assume that parent P aggregates ISP A's space into a /16 for the sake of saving route announcements. Now, ISP A would seem to have better reachability only through parent Q because of the specificity of the route announcement (remember that more specific routes take precedence over less specific routes). This would nullify the benefits of multihoming in an attempt to distribute load over the two lines. In this case, ISP A would ask parent P to announce a more specific destination which has a length matching the length of the aggregate assigned to ISP A. Therefore, to the world above parent P and parent Q, the path to ISP A looks equally appealing. ----[ Exterior/Interior It is important to look at how routing information is disseminated throughout the network. It has already been discussed that we use separate routing protocols (with their respective benefits/costs) to talk to the internal and external world. However, these protocols cannot take orthogonal views on routing information. In fact, the interplay between interior and exterior routing protocols is what allows data to be effectively relayed to a destination external to the network as well as to distribute external routing information to all nodes on the internal network. There are a few ways to ensure that each router has a consistent view of the network. One is to distribute the external protocol into the internal protocol. Thereby, the internal protocol instantly has routing information injected in it for the best path to every external destination. Note that the router which talks eBGP (or comparable protocol) only redistributes the route that it installs in its routing table and not the other candidate routes which may have been advertised to it. Another approach is to inject the interior protocol into the exterior protocol. Of course, this necessitates filtering at the entrance point to the exterior protocol to prevent the announcement of all internal specifics. You can accomplish internal routing dissemination inside an Interior Gateway Protocol mesh. Because of the specifics of protocols like BGP, externally learned routing information will only be propagated one logical hop within the network. Therefore, every router that must know this external reachability information, must be fully meshed with the eBGP speaking routers. Also, if other routers are injecting information into the Exterior Gateway Protocol, the router should be logically fully meshed with them. ----[ Multicast Routing Overview What we have been talking about above is unicast routing. In unicast routing, you assume that each packet has a single destination address. Assuming infinite resources being available, unicast is a feasible solution for every situation. However, there are situations when it would be advantageous to send a packet to multiple destinations from a single source (point to multipoint) or from multiple sources to multiple recipients (multipoint to multipoint). The point of multicast is to provide a multicast group to which hosts can subscribe and get the specific multicast feed. The multicast group is a single IP address in class D space. Therefore, the senders and receivers are only associated by a given multicast group address. Thus, the senders move their data towards the multicast group address and the receivers specify that they want to receive information from a given group address. In fact, the sender is not required to know any information about the hosts that are receiving the feed. ----[ Multicast vs. Unicast If one was sending packets from a single source to a set of destinations, it is important to investigate how multicast and unicast handle the distribution. Assume that router A is sending data to routers B, D and E. A is at the top of the hierarchy, B and C are at the second level of the hierarchy, and D and E are below router B. With multiple unicast (fig 8), router A makes 3 copies of the packet and sends them down link AB. Router B then sends one packet to a host off of its ethernet and forwards the last two packets to routers D and E whereupon those routers send the packets to the their respective hosts in the multicast group. Therefore, this transmission takes up 3 packets per second on link AB and 1 pps on links B->Host(b), router D and router E. In a multicast routing implementation, assuming the same topology, we will have less packets. The difference is that router A sends _one_ packet over link AB. Router B then triplicates the packet and sends it to Host(b), router D and router E (fig 9). One way for triplicating the packet is to simultaneously close crossbars on a fully crossed switch fabric, thus sending data from one input to three outputs simultaneously. As long as there is route redundancy, multicast is very efficient because it minimizes redundant packets traveling to the same next-hop. Simply, as long as there is route redundancy for the distributed session (for example, an audio feed) you will see an advantage with multicast over unicast. Multicast Overview Example: Multiple Unicast: A A sends 3 packets to B. / \ / \ 3 / \ C B B sends 1 packet to each to D and E. / \ 1 / \ 1 / \ D E D and E send 1 packet to their respective hosts. [ fig 8 ] Multicast: A A sends 1 packet to B / \ / \ 1 / \ C B B duplicates the packet for its host; / \ therefore, there is 1 packet (at most) on 1 / \ 1 each link. / \ D E [ fig 9 ] This is a multicast topology rooted at node A. There is also a shortest path from A to every destination in the multicast group. This is called the shortest path multicast tree rooted in A. Data would like to shortest path on the network layer. One problem with multicast sessions is that recipients join and leave during a multicast session. This requires pruning of the multicast "tree" so that packets do not clutter a link on which there is no one requesting data from a given multicast group. To detect if there are hosts on a particular broadcast LAN that are interested in a multicast group, the router sends out Internet Group Management Protocol (IGMP) messages. Each packet has a random reply time from which the host will express interest. This is to prevent all hosts on a broadcast LAN from responding at the same time to an IGMP query. Once one host desires to receive data destined for a particular multicast groups, all other hosts which desire to be in the multicast group can discard their replies because the router knows to multicast all incoming packets destined for that group. The host then configures its adapter to answer for the MAC address corresponding to that group. Multicast must also be functional outside of the broadcast LAN. A simple solution to the problem is to give each router for which multicast is enabled the multicast packet. This is called flooding. Basically, it functions by forwarding the packet to every interface other than the one that the packet arrived on. The inherent flaws in this approach is that there is packet duplication as well as packets being sent to routers which have no hosts subscribed to the multicast group. To clarify the duplication statement, if Router A is physically meshed with routers B, C, and D and linked to its upstream via serial, when router A receives the multicast packet, it floods it out the interfaces to routers B, C, and D. These routers then flood the packet out the interface other than the one they received the packet on (namely the interface that connects them to A). This results in each of these routers receiving two copies of the packet (other than the one they received from A) in this exchange. A solution to this problem can be found in a technique called Reverse Path Forwarding (RPF). RPF specifies that the router forwards a packet with a source address of X only if the interface which the router receives the packet on corresponds to the shortest path that router has to source X (fig 10). Therefore, in the above example, each of the meshed routers _still_ receives 2 duplicate packets in the second step, but they refuse to forward them because only the packet received from the interface directly connected to A will be forwarded. As noted, RPF does not completely solve the problem of packet duplication. To solve this, we must introduce pruning. The idea is simplistic: inform neighbors that you do not wish to receive multicast packets from source X to multicast group Y. You can also specify prunes to a particular group. If a router tells its neighbors that it did not desire to receive packets for group Y and then has a host which desires to receive group Y, it sends a graft message to its neighbors specifying that it be added into the multicast tree. As a unicast aside, RPF can also be used to eliminate source address spoofing in that the router will only forward packets from source Y if it is receiving it on the interface which is the shortest path to source Y. Thus, if the router receives packets from an external link which say their saddr == saddr(y), the router will not forward them because its shortest path to Y is not from the external link. RPF Example: | <-- Point of ingress. | A-----------C |\ /| | \_______/ | | / \ | |/ \| B-----------D [ fig 10 ] ABCD are physically meshed. When A distributes a packet to BCD, there is no problem. Now, in the next step, B, C,and D forward the packet to each of their respective neighbors (for B it would be C and D and ! A because it received the packet from A). This results in C and D receiving 2 packets in this entire exchange. Note that C and D now do _not_ forward the packet they have received from A through B because that is not their shortest path to A. Their shortest path is their direct link. ----[ The Multicast Backbone (MBONE) It would be myopic to assume that every router on the internet supports multicast. Thus, when a router needed to find the shortest path to a destination (for forwarding of a multicast packet) it could look in the unicast routing table. Unfortunately (or fortunately depending on your perspective) most routers on the Internet do not support multicast or do not have it enabled by default. Therefore, until most routers support multicast, it has been "layered" over IP and tunneled from multicast router to multicast router (more specifically, the multicast header and data is encapsulated in a unicast IP header). The tunnel (which bridges the gap of unicast only routers between multicast routers) informs each end that some packets will contain a multicast group in their payload. This allows data to be routed by using unicast forwarding tables while at the same time preserving the integrity of the multicast group id. Because these multicast routers are not necessarily connected physically (though they are tunneled logically), they must be connected by a multicast routing protocol. This is necessary because the closest path via multicast may not correspond to the shortest path over unicast only routers. Distance Vector Multicast Routing Protocol (DVMRP) is an initial foray into this realm. DVMRP distributes "unicast" routes to facilitate the construction of shortest path trees. DVMRP uses the flood and prune method discussed above to discover /maintain multicast trees. There is also a link state foray into this arena. Multicast Open Shortest Path First (MOSPF) takes the LSP approach and calculates shortest absolute path. One host off of a multicast router can request to be in a multicast group. That router then distributes an LSP over the network. Of course, MOSPF (being a link state protocol) runs into salability problems. It is computationally expensive for a router to compute reachability information for each end node router. Core based trees (CBT) are an attempt to alleviate the problems that DVMRP and MOSPF experience. The concept is that multicast routers send join requests to core routers of arbitrary designation. When a router learns of a host which wishes to join a specific multicast group, it forwards a packet to the core multicast router. Every router along the way forwards the packet towards the core router and marks the interface on which the packet arrives so that it knows where to forward the multicast packets from the core. This solves the problem of having to communicate topology among all of the endpoints. The choice of a core multicast router is a non-trivial because all multicast traffic for multicast routers branching off of it _must_ pass through the core router. ----[ Protocol Independent Multicast Protocol independent multicast (PIM). Pim is a balance between flood and prune and CBT. When there are many multicast routers on a given network, it is more efficient to use the flood-and-prune method. This network environment is called "dense". On the contrary, sparse mode defines networks where there are few multicast routers. In sparse mode, it is more efficient to use CBT because the core router is not weighted in an environment when it 'polices' few multicast routers. When most of network is comprised of multicast routers, it is not prudent to require all sessions to be coordinated (and routed through) a core. Sparse mode PIM has been adapted from CBT to allow data to reach its destination via the core or through the shortest path tree. Currently, the operator must define whether groups are sparse or dense instead of leaving it up to the protocol. cisco systems' implementation of pim also supports a middle ground called 'sparse-dense' mode. ----[ Border Gateway Protocol There has been some mention of the Border Gateway Protocol (BGP) in this document. BGP was groomed as the successor to the Exterior Gateway Protocol (EGP). BGP is mainly an exterior routing protocol. It is used to communicate with systems outside of the operator's control and both distribute and receive network layer reachability information (NRLI) from the neighboring routers. BGP must be a robust protocol which has the capability of quick convergence while at the same time, not being influenced by frequent shifts in topology. When you use BGP to receive routing information, you are depending on the other networks to distribute correct information to your network. A BGP speaking router communicates with its peers via TCP. TCP over IP is a mechanism for guaranteeing the transmission of data over a best effort service at the IP layer. The choice of TCP as the distribution mechanism for BGP information is a point of contention. While TCP provides inherent checksums, acknowledgments, retransmissions and duplicate suppression mechanisms for received packets, it does not guarantee packet order or packet path. This can lead to headaches for the router receiving this information. BGP peers communicate with a variety of message formats. BGP speakers use the OPEN message to establish a peering relationship with other speakers. BGP speakers use the UPDATE message to transfer routing information between peers. Update information includes all routes and their associated attributes. KEEPALIVE messages assure that BGP peers are active. NOTIFICATION messages inform peers of error conditions. ----[ BGP path selection It is important that we understand the messages that constitute the Border Gateway Protocol, but we are still left with the question of how BGP works on the internet. One important area of clarification is in the BGP path selection algorithm. This algorithm is how BGP decides which route to prefer and attempt to install in the routing table. This algorithm is employed when there are multiple paths to a destination. As a failsafe, the first selection looks at the next hop and determines if it is accessible. If the next hop is not accessible, it is important not to consider that route as a candidate path to a destination because all data sent to its next_hop will be blackholed. The second selection mechanism is the weight of the route. Weight is a proprietary implementation to cisco Systems routers and is analogous to local preference. If two routes have different weights, the route with the largest weight is selected. Notice that the selection mechanism is basically a logical if->then chain. If candidate paths differ at a level of the selection algorithm, then the favorable path is selected and the algorithm ceases trying to decide which path to prefer. The next level is the local_pref attribute. This is a well known mandatory BGP attribute. Much like weight, the path with the highest local_pref is preferred. After local preference, the router selects the path that it originated. If the router didn't originate the paths, then the path with the shortest AS_PATH length should be selected. AS path length gauges the number of autonomous systems that this routing information has traveled through. The purpose of this selection relies in the assumption that the less ASNs the route has passed through, the closer the destination. If all of the above attributes are identical, then prefer path origin in this fashion IGP > EGP > Incomplete. If the path origins are the same, prefer the path with the lowest value MULTI_EXIT_DESCRIMINATOR (MED). MEDs are commonly used to distinguish between multiple exit points to the same peer AS. If none of these attributes are dissimilar, then prefer the path through the closest IGP neighbor. If that fails, the tiebreaker is preferring the path with the lowest IP address specified in the BGP router-id section discussed above. This selection algorithm allows effective establishment of routing policy. If I wanted to prefer routes from a certain AS over routes to another AS, I could establish a route-map at both entry points of external routing information and assign a higher LOCAL_PREF to the routes from the AS I want to favor. Unfortunately, this does not provide much granularity. This means that all traffic will be routed to the favorable AS and does not allow us to balance the load over our multiple connections. If you allow path selection to progress to the AS path length decision level, then you will get decent (though not 50-50) load balancing to destinations. This of course is assuming that you have providers with comparable customer routes and connectivity. If you have a DS3 to MCI and a DS3 to the local BFE provider, nearly all traffic will move out the MCI pipe if the BGP decision is allowed to progress down to the AS path length category. At earlier selections, you can change the preference of routes by using AS path access lists to select routes based on as path regular expressions. For example, if you wanted to select all routes that traversed UUnet and send them out your BFE provider, you could use a route map to match an AS path access list which contained _701_ and set the local_pref to 100 (or some value higher than the UUwho traversed paths from MCI). This will force all traffic destined for UUwho to exit your AS over your BFE DS3. While this affords you some granularity in load balancing, it is often not optimal. Basically, you are forcing traffic out a path that it would not normally select. If that BFE provider has many hops before it can reach UUnet, you are forcing the traffic you send out that link to traverse all of those hops and be subject to (possibly) more link congestion, latency, etc. Routing policy is something that requires the tweaking of many knobs. Much of the tweaking I have described above pertains to cisco Systems routers. It is important to understand that you must think through routing policy before you implement it. You must evaluate what load balancing you want, what traffic symmetry you want, and what general quality of service your traffic will receive because of your decisions. For information more specific than this, read the BGP RFC or current BGPv4 internet draft [1]. ----[ Open Shortest Path First v2 (OSPFv2) We are not going into great detail about OSPF. It is a link state routing algorithm. As noted above, link state algorithms route on flat space (no hierarchy). OSPF is an improvement over the vanilla LS protocol because it provides areas of maintenance for hierarchy purposes. Areas distribute full information internally by running a separate OSPF process with its area ID. Each router has an identical link state database with other routers within its area, but not with external routers. Each area operates in an autonomous state and transfers inter-area information at junction routers called area border routers. These routers are in two or more areas and help distribute information between these areas. The router has separate link state databases for each area to which it is connected. OSPFv2's main advantage is that it supports Variable Length Subnet Masks (VLSM). This means that a router can advertise reachability with more granularity than a scheme which advertised host reachability. Therefore, if the router can distribute packets to all hosts from 18.104.22.168 -> 188.8.131.52 it advertises reachability to 188.8.131.52/23 instead of each classful network separately or each host separately. This obviously saves immensely on link state database size and processing power required. For information more specific than this, read the current OSPFv2 RFC or internet draft [2]. ----[ References [1] Rehkter, Y., Li, T., " A Border Gateway Protocol 4 (BGP-4)", draft-ietf-idr-bgp4-07.txt, February 1998. [2] Moy, J., "OSPF Version 2", draft-ietf-ospf-vers2-02.txt, January 1998. ----[ EOF


text:
Free Local Delivery on all orders over £10 During Cornoavirus Lockdown / Free UK Delivery on all UK Orders Over £50
Diamante cake picks are a wonderful way to add that "Wow" factor to your special celebration cakes. Perfect for making that milestone birthday cake extra special they also makes a wonderful keepsake of the event.
Can be combined with matching letters, banding and also individual diamantes to complete your creations.
Size approx 45 x 55mm

subset: commoncrawl


text: Following their success in the qualifying round for the Kansai regional competition, the members of the Kitauji High School concert band set their sights on the next upcoming performance. Utilizing their summer break to the utmost, the band participates in a camp where they are instructed by their band advisor Noboru Taki and his friends who make their living as professional musicians. Kumiko Oumae and her friends remain determined to attain gold at the Kansai competition, but trouble arises when a student who once quit the band shows interest in rejoining and sparks unpleasant memories for the second-year members. Kumiko also learns about her teacher's surprising past and the motivation behind his desire to lead the band to victory. Reaching nationals will require hard work, and the adamant conviction in each student's commitment to the band will be put to the test.


text:
Thirteen-member gang arrested at Kotoka over $5m fake currency
The National Security has busted a 13-member gang involved in the printing and distribution of fake currency notes to unsuspecting victims, mostly foreign nationals.
A statement issued by the National Security Secretariat said the gang, led by one Yassei Alia, a 45-year-old Syrian resident in East Legon, and owner of Hardford Auto Service in Accra, together with Danjuma Zakaria, alias Alhaji Mohammed, 49 and resident of Tema West, were rounded up in a warehouse within the premises of NacCharter Cargo and Freight Company, near KLM offices within the Kotoka International Airport, on Monday, April, 27 at around 1730 hours.
Freshly printed $10,000 bundles of fake $100 notes concealed in two large metal trunks and a suitcase were retrieved from the warehouse.
The statement said the amount was estimated to be over five million United States Dollars (USD).
Other suspected accomplices arrested during the operation include Esther Omozeea, Emad Aldalhi, Kamal Mohammed, Abdulai Yakubu Osman and Samuel Ababio.
The remaining are John Denyo, Desmond Delali Dumenu, Alike Happiness, Prosper Chukwu, Victor Israel, Padi Christian Holdbrook.
It said in their caution statements, Yassei and Mohammed, who drove to the warehouse in the former's car, denied knowledge of the deal.
It noted that however when questioned separately, Yassei, who held a Syrian passport, a Republic of Guinea-Bissau diplomatic passport, and a Nigerian national driver's licence issued in Ogun State, indicated that he had gone to the warehouse to have a discussion with one Kojo, an alleged cargo dealer and operator of the premises, regarding a V8 engine the latter was to import on his behalf, while Alhaji Mohammed stated that he had gone to solicit for financial help from Kojo to enable him procure a vehicle from Holland.
The statement said further, while Yassei claimed Kojo sat in a meeting with them on the said day, Alhaji Mohammed indicated that Kojo was not at the premises at the time of their visit and that while waiting for him, they were arrested.
It said incidentally, two of the suspects interrogated separately corroborated Mohammed's claim that Kojo was not seen at the premises on the said day.
"The group's modus operandi, according to intelligence, suggests that they lure unsuspecting victims with claims that they have access to millions of US dollars in Libya," the statement said.
"Victims are given genuine sums of US dollars to spend for free, as a proof of the genuineness of the deal."
It noted that once convinced, victims were requested to deposit huge sums of USD dollars as freight charges to aid the shipment of the said dollars to the victims. Upon receipt of the amount, the suspects packaged fake dollars stashed in between a few hundreds of genuine notes, for onward delivery to their victims.
Shortly after the arrest, one Bandoh, Alhaji-Ahmed, alias Alhaji Bamed, owner of Bamed Travel and Tours, who claims to be a Presidential Staffer at the Castle, and a client of Yassie, drove to the National Security headquarters, verbally assaulted the leader of the operation, and vowed to free the suspects.
It said the aggressive conduct of Alhaji Bamed, suggested that he might be involved in the deal, particularly when investigations are ongoing.
It said officials of National Security had assured Ghanaians that the Government was determined to rid the country of fake currency syndicates and warned that persons involved in the illegality would be arrested and dealt with accordingly.
The National Security has therefore urged the public to report suspicious activities of persons to security agencies to aid their arrest and prosecution.


text:
I was recently contacted by South African based providore and blogger Matt Allison on Twitter. He had bought my book Rethink: The Way You Live and found a connection with his own life when he read the pages. This wonderful video showcases his story from musician to urban backyard farmer providing produce to some of Cape Town's prestigious restaurants and cafes.
Carrots Don't Always Grow Straight!
The biggest joy in producing a book like Rethink: The Way You Live is how wonderful folk like Matt share their stories with me in how they have rethought their lives. If you are sitting on the fence dreaming about a new career, a life long dream then I highly recommend watching this this video. Matt's story is living proof you can do anything as long as you are passionate and willing to put in the hard work.


text:
PROVIDENCE, R.I. — Climate scientists have warned for years that a warming planet would cause more extreme storms, like the one that walloped Texas in February, knocking out power and leaving millions in a deep freeze.
Yet as the snow fell and the wind howled, some looked for other explanations for the storm and its resulting power outages. The conservative website The Gateway Pundit made the false claim that President Joe Biden's energy policies somehow prevented Texas plants from generating the power the state needed and "led to Texans literally freezing to death."
The next day, the conspiracy theory website Infowars published a similarly untrue story that was shared 70,000 times on Facebook and Twitter. Four days later, U.S. Rep. Lauren Boebert, R-Colorado, tweeted to her 100,000 followers that Biden's energy policies were "leaving millions of Texans freezing to death."
All those claims were false. In fact, an emergency request granted by the Biden administration gave the state authority to exceed federal environmental limits in order to provide enough power to Texans.
To climate scientists and misinformation researchers, claims like these mark an important shift: Instead of focusing on denialism, climate misinformation is getting local, focused on extreme weather events tied to a changing climate — such the Texas storm or recent wildfires that ravaged California and Australia.
"It just isn't credible to deny climate change or the impacts it's having. People see it with their own two eyes," said Penn State University climate scientist Michael Mann. "So there's a shift in tactics. Now it's softer forms of denial, and efforts to diminish the impacts of climate change."
That evolution is evident online. Media intelligence firm Zignal Labs analyzed millions of social media posts, news stories and other online content and found that overall, conversations about climate change in the past 12 months peaked during high-profile natural disasters, including the Texas storm and the California wildfires. Overall, online mentions of natural disasters and their relationship to climate change also increased by 27%, Zignal found.
Surveys also show that extreme weather is changing people's thinking about climate change. According to a 2019 poll by The Associated Press-NORC Center for Public Affairs Research and the Energy Policy Institute at the University of Chicago, nearly 75% of Americans said their opinions about climate change have been influenced by extreme weather in the previous five years.
With about 7 in 10 Americans saying they believe climate change is happening, misinformation has now shifted from denialism to focus on its real world impacts. In some ways, that's a positive, as it demonstrates increased public understanding of the problem. But it also creates new opportunities for those who would spread bogus claims.
"We still see claims that global warming doesn't exist, but we also see misinformation about specific areas — such as the wind turbines in Texas," said Emmanuel Vincent, director of Science Feedback, a global network of scientists based in France who work to debunk inaccurate claims about climate change. "A lot of the misinformation is more subtle."
Those who still dispute a connection to a changing climate are grasping for increasingly far-fetched explanations. Following the Texas storm, for instance, some claimed the snow was fake and wouldn't burn, or that it was the result of weather control technology used by Biden. Recent California wildfires? While experts say dry and hot conditions are to blame, some, including U.S. Rep. Marjorie Taylor Greene, R-Georgia, have speculated it might be the work of space lasers.
Such misinformation persists online, despite stated attempts by online platforms to stamp it out. While Facebook, Twitter and YouTube have all removed content spreading misinformation about COVID-19 or the recent U.S. election, critics say they've been less aggressive when it comes to climate information.
A spokesman for Facebook said the platform is doing more than ever to connect users with accurate information about climate change. Its Climate Science Information Center, created last year, is now available in 16 countries and nine languages, and has a new section dedicated to dispelling climate change myths.
YouTube, owned by Google, was singled out as a leading source for climate misinformation by the U.S. House Select Committee on the Climate Crisis. In a letter to Google, the committee urged the tech giant to do more to combat falsehoods on its platforms.
In an emailed statement, YouTube acknowledged the challenge of "drawing the lines between misinformation, political speech, legitimate debate, and opinion."
U.S. Rep. Kathy Castor, D-Florida, chairwoman of the House climate committee, told the AP in a statement that groups who oppose meaningful responses to climate change — including fossil fuel companies — use misinformation to confuse the public. But she said many people aren't buying it.
"It's becoming harder for polluters and their allies to keep standing in the way of climate solutions, which is why they resort to false and harmful misinformation," she said.
"Most Americans, and particularly young Americans, are demanding their representatives take this crisis seriously."


text:
The Unwanteds #3: Island of Fire
The fate of Artimé is at stake—and an unlikely alliance could redeem it—in book three in the New York Times bestselling Unwanteds series.
The magical world of Artimé is gone. The Unwanteds have no food, no water, and no hope. And everyone is looking to Alex Stowe for answers.
Overwhelmed and feeling totally helpless, Alex knows it's up to him to find a way to restore Artimé, rescue his captive friends, and free Megan from her voice-stealing necklace of thorns—three impossible tasks. But could help lie with the silent, orange-eyed newcomers?
Meanwhile, in the stark land of Quill, Alex's twin brother Aaron continues to build his army, preparing for the ultimate showdown with the Unwanteds. But a shocking twist reveals that Alex and Aaron share a common enemy more dangerous than either could have imagined...


text:
Ovarian Cancer Facts
All information and facts have been have been compiled by the American Cancer Society.
For additional information visit the American Cancer Society website:http://www.cancer.org/cancer/ovariancancer/detailedguide/ovarian-cancer-new-research
The most common symptoms are:
Additional symptoms include:
Symptoms that are out of the ordinary for you and persist for 2 weeks or more should be checked by your gynecologist. Don't wait to make an appointment. This should be brought to your physician's attention immediately.
The American Cancer Society estimates for ovarian cancer in the United States for 2019 are:
Ovarian cancer ranks fifth in cancer deaths among women, accounting for more deaths than any other cancer of the female reproductive system. A woman's risk of getting ovarian cancer during her lifetime is about 1 in 78. Her lifetime chance of dying from ovarian cancer is about 1 in 108. (These statistics don't count low malignant potential ovarian tumors.)
This cancer mainly develops in older women. About half of the women who are diagnosed with ovarian cancer are 63 years or older. It is more common in white women than African-American women.
The rate at which women are diagnosed with ovarian cancer has been slowly falling over the past 20 years.
What's new in ovarian cancer research and treatment?
Risk factors and causes
Scientists continue to study the genes responsible for familial ovarian cancer. This research is beginning to yield clues about how these genes normally work and how disrupting their action can lead to cancer. This information eventually is expected to lead to new drugs for preventing and treating familial ovarian cancer.
Research in this area has already led to better ways to detect high-risk genes and assess a woman's ovarian cancer risk. A better understanding of how genetic and hormonal factors (such as oral contraceptive use) interact may also lead to better ways to prevent ovarian cancer.
New information about how much BRCA1 and BRCA2 gene mutations increase ovarian cancer risk is helping women make practical decisions about prevention. For example, mathematical models have been developed that help estimate how many years of life an average woman with a BRCA mutation might gain by having both ovaries and fallopian tubes removed to prevent a cancer from developing. Studies have shown that fallopian tube cancers develop in women with BRCA gene mutations more often than doctors had previously suspected. However, it is important to remember that although doctors can predict the average outcome of a group of many women, it is still impossible to accurately predict the outcome for any individual woman.
Recent studies suggest that many primary peritoneal cancers and some ovarian cancers (such as high-grade serous carcinomas) actually start in the fallopian tubes. According to this theory, the early changes of these cancers can start in the fallopian tubes. Cells from these very early fallopian tube cancers can become detached and then stick to the surface of the peritoneum or the ovaries. For reasons that are still not understood, these cancer cells may grow more rapidly in their new locations.
This theory has important implications for preventing ovarian cancer because having the ovaries removed early can cause problems from lack of estrogen, such as bone loss, cardiovascular disease, and menopause symptoms. Some experts have suggested recently that some women who are concerned about their ovarian cancer risk (especially those with a strong family history and/or BRCA gene mutations) consider having just their fallopian tubes removed first. They then can have their ovaries removed when they are older. This approach lets women keep their ovaries functioning for longer, but because of that, it might not help breast cancer risk as much. This is an active area of research.
Other studies are testing new drugs for ovarian cancer risk reduction.
Researchers are constantly looking for clues such as lifestyle, diet, and medicines that may alter the risk of ovarian cancer.
Early detection
Accurate ways to detect ovarian cancer early could have a great impact on the cure rate. Researchers are testing new ways to screen women for ovarian cancer, and a national repository for blood and tissue samples from ovarian cancer patients is being established to aid in these studies. One method being tested is looking at the pattern of proteins in the blood (called proteomics) to find ovarian cancer early.
From time to time, lab companies have marketed unproven tests to look for early ovarian cancer. Because these tests had not yet been shown to help find early cancer, the US Food and Drug Administration (FDA) told the companies to stop selling them. So far, this occurred with 2 different tests looking at protein patterns: OvaSure and OvaCheck. Both were taken off the market at the request of the FDA.
Two large studies of screening have been completed. One was in the United States, and the other was in the United Kingdom. Both studies looked at using the CA-125 blood test along with ovarian (transvaginal) ultrasound to find ovarian cancer. In these studies, more cancers were found in the women who were screened. Some of these were found at an early stage. But the outcomes of the women who were screened were not better than the women who weren't screened. - the screened women did not live longer and were not less likely to die from ovarian cancer.
A test called OVA1 is meant to be used in women who have an ovarian tumor. It measures the levels of 4 proteins in the blood. The levels of these proteins, when looked at together, are used to put women with tumors into 2 categories − low risk and high risk. The women labeled low risk are not likely to have cancer. The women called "high risk" are more likely to have a cancer, and so should have surgery by a specialist (a gynecologic oncologist). This test is NOT a screening test − it is only meant for use in women who have an ovarian tumor.
Treatment research includes testing the value of currently available methods as well as developing new approaches to treatment.
New chemotherapy (chemo) drugs and drug combinations are being tested. The drugs trabectedin (Yondelis®) and belotecan have shown promise in some studies.
When the drugs cisplatin and carboplatin stop working, the cancer is said to be platinum resistant. Studies are looking for ways (like other drugs) to make these cancers sensitive to these drugs again.
Although carboplatin is preferred over cisplatin in treating ovarian cancer if the drug is to be given IV, cisplatin is used in intraperitoneal (IP) chemotherapy. Studies are looking at giving carboplatin for IP chemo.
Another approach is to give IP chemo during surgery using heated drugs. This, known as heated intraperitoneal chemotherapy or HIPEC, can be effective, but is very toxic. It still needs to be studied and compared with standard IP chemo to see if it actually works better.
Targeted therapy
Targeted therapy is a newer type of cancer treatment that uses drugs or other substances to identify and attack cancer cells while doing little damage to normal cells. Each type of targeted therapy works differently, but they all attack the cancer cells' inner workings − the programming that makes them different from normal, healthy cells. Bevacizumab (Avastin) is the targeted therapy that has been studied best in ovarian cancer, but other drugs are also being looked at, as well.
Pazopanib (Votrient®) is a targeted therapy drug that, like bevacizumab, helps stop new blood vessels from forming. It has shown some promise in studies.
Poly(ADP-ribose) polymerases (PARPs) are enzymes that have been recently recognized as key regulators of cell survival and cell death. Drugs that inhibit PARP-1 help fight cancers caused by mutations in BRCA1 and BRCA2. In one study, the PARP inhibitor olaparib was also able to shrink tumors in ovarian cancer patients who did not have BRCA mutations. Clinical trials of this type of drug are being done to see who will benefit most from them.
Vintafolide (EC145) is a newer drug that targets the folic acid receptor. This receptor is found on some ovarian cancers. In one study, it helped stop the growth of cancers that had the folic acid receptor.
Another approach is to develop tumor vaccines that program the immune system to better recognize cancer cells. Also, monoclonal antibodies that specifically recognize and attack ovarian cancer cells are being developed. These antibodies are man-made versions of the antibodies our bodies make to fight infection. They can be designed to home in on certain sites on the cancer cell. Farletuzumab is a monoclonal antibody that is directed against the folic acid receptor, which is on the surface of some ovarian cancer cells. It has shown promise in treating ovarian cancer in early studies. Another monoclonal antibody being studied in ovarian cancer is called catumaxomab. It binds to a protein that is in some cancer cells and some immune system cells. When it is administered into the abdominal cavity, it can help treat fluid buildup (ascites) that can occur when cancer is present.
Last Medical Review: 08/05/2014
Last Revised: 08/11/2014


text:
The FRET or Future Real Estate Tokens are concentrated in Germany in the European Union. It's also focusing on expanding across the globe to provide immense opportunities in real estate to ordinary people. Intending to revolutionize real estate, the developers build a robust token with high-security standards. The FRET allows users to access 24/7 trading facilities. Moreover, it also supports managing liquidity and capital raise. The key features of FRET are strong security standards, flexibility, and transparency.
The FRET solves the primary problem in real estate or illiquid assets(such as cars, properties, arts, etc.) such as high transaction fees and longer transaction periods. The commissions or taxes across the globe for illiquid assets range from 20% to 30%. However, FRET made real estate easier and convenient by allowing 24/7 trading with immediate transactions. Also, it has lower transaction fees which attract most investors. Since FRET is launching the presale, hurry up to buy enough coins to enjoy colossal benefits. Also, grab the highest number of rewards to attain maximum financial freedom.
Benefits of FRET
A few benefits of FRET include the following:
Minimal to zero transaction fees.
Easier and fast transactions.
Hassle-free trading across the globe within a few moments.
Guaranteed security.
High transparency.
Dedicated team and robust technology.
Practical and distinct goals.
2% of transaction fees are offered to the account holders.
How To Purchase Future Real Estate
Here's the detailed information about how to purchase FRET. All you need to do is follow the step-by-step guide carefully.
First of all, download and install the MetaMask or Trust Wallet applications.
Next, buy BNB tokens and send them to your wallets(Either Metamask or Trust Wallet)).
Then, navigate to the Futuretoken.io homepage and tap on the button, "BUY Futuretoken."
After completing the presale, it opens a token exchanging platform called "PancakeSwap."
Sync your wallet to this PancakeSwap. Now, decide the number of future tokens you'd like to buy and set them. After that, put the slippage to 5%. Finally, click on the swap button to purchase future tokens.
FRET Tokenomics:
Token Ticker: FRET
Network: BSC(NEP-20)
Total Supply: 100 Billion FRET
Transaction fee: 5%(Charity: 1%, Token Holders: 2%, Liquidity: 2%)
Token Distribution:
FRET Team: 10%
Marketing and Future Projects: 10%
Liquidity: 40%
Presale on DX: 35%
Burn: 5% to 10%
Instagram: https://www.instagram.com/futurerealestatetoken/
Telegram: https://t.me/futurerealestatetoken
Twitter: https://twitter.com/FutureREtoken
Official Website: http://www.futuretoken.io/


text:
Courtney Stodden Alleges Chrissy Teigen Told Them to 'Kill Myself' in DM
Courtney Stodden is looking back on their one-time feud with Chrissy Teigen, and it seems the online abuse went much further than anyone knew.
"I think because I experienced so much harassment and bullying from her when I was just 16 years old," the media personality told The Daily Beast. "At a time when I needed help. Like, I was being abused.
Content warning below // suicide & bullying
Stodden, who identifies as non-binary, alleged that Teigein "sent me so many different tweets, private DMS, up to a couple years ago. Among the bullying they endured, Stodden claims, were private messages from Teigen telling them to "kill myself."
The bombshell accusation comes directly on the heels of Teigen rejoining Twitter just weeks after deleting her profile as one of the app's most popular users due to cyberbullying in the wake of her newborn son Jack's death during delivery.
Scrolling ten years back through the supermodel's tweets reveals numerous public messages directed at Stodden, including "@CourtneyStodden my Friday fantasy: you. dirt nap. mmmmmm baby," and "@Courtney Stodden i hate you". ("Dirt nap" is slang for death.)
However, that's not all. Stodden also pointed to multiple other celebrities who piled on them during their controversial marriage to actor Doug Hutchison, who was 35 years older than his then-16-year-old bride.
"Joy Behar had a field day with calling me a 'slut.' Courtney Love told me I was a 'whore.' People came out of the woodwork to beat up on a kid because she was in a situation that she shouldn't have been in," the model said.
The bullying both online and in the media got so bad that Stodden says it dangerously impacted their mental health: "There have probably been five times that I've felt like I wanted to kill myself ... and made the actions to go ahead and do it."
However, these days Stodden is focused on forgiveness... and holding cyberbullies accountable.
"She's never given me a chance to forgive her," Stodden concluded regarding Teigen. "And I guess forgiveness, right, starts with ourselves. But it's so damaging when you have somebody like Chrissy Teigen bullying children. So I definitely think it's time to speak out. I'm not going after her to bully her, and I don't think it's OK that people are bullying Chrissy. But I also don't think it's OK to cry wolf either."
If you or someone you know needs help, please contact the National Suicide Prevention Lifeline at 1 800-273-TALK (8255).


text:
Dave Grohl, Eddie Vedder Added to 12-12-12 Hurricane Sandy Relief Concert
Foo Fighters frontman Dave Grohl and Pearl Jam singer Eddie Vedder are among the artists added to the lineup of the 12-12-12 Hurricane Sandy relief concert set to take place in New York City next month. The two alt-rockers and Bon Jovi join a star-studded bill that already includes Bruce Springsteen, Paul McCartney, the Who and several other artists.
The 12-12-12 gig is scheduled to take place Dec. 12 at Madison Square Garden, with all proceeds going directly to the Robin Hood Relief Fund in aid of victims of Sandy, which devastated the New York and New Jersey coast in late October. Tickets go on sale to the general public at noon on Dec. 3, with Chase card holders having access to tickets at 9AM that same day. More information, including VIP packages and telecast plans, is expected to be available shortly via the concert's official website.
"We are extremely grateful that the incomparable list of musicians appearing at 12-12-12 continues to grow, as more and more inimitable performers sign on to ensure the event has the greatest possible impact on relief efforts relating to Hurricane Sandy," reads a joint statement from event producers James Dolan, John Sykes and Harvey Weinstein.


text:
Reviewed by John M. Grohol, Psy.D. on February 12, 2010
Thanks to the stresses of modern life, post-traumatic stress disorder (PTSD) threatens to overload health care and social support systems worldwide.
Sadly, experts acknowledge that treatment interventions are insufficient. Current treatment philosophy involves long-term intervention that often cannot be delivered because of logistics or costs.
Consequently, new approaches to treatment are relying on technology, such as virtual reality, to alleviate the psychologically damaging effects of PTSD.
PTSD is common in soldiers returning from combat duty and may also result from sexual or physical assault, imprisonment or hostage situations, terrorism, surviving an accident or disaster, or diagnosis of a life-threatening illness.
Conventional approaches to treatment, including antidepressant medication and psychotherapy, yield unacceptable recovery rates.
Exposure therapy has been recognized as a highly promising method for treating patients with PTSD.
Rather than relying on patients' visualization skills to "relive†the traumatic experience, technological strategies such as virtual reality (VR) provide a controlled environment in which patients can experience a situation or scenario while learning to cope with their emotional responses.
Virtual reality has the potential to play an important role in treating survivors of mass casualty disasters, for example. Countries can implement this tool and the available handheld VR technology as part of a comprehensive plan to respond to catastrophe survivors' mental health needs.
"We are so fortunate in being able to learn from our patients who give us invaluable feedback and important information so that we may continuously improve treatment protocols,†says Dr. Brenda K. Wiederhold, PhD, MBA, BCIA.
"We thank those who have shared their memories and experiences for the benefit of others."
These innovative solutions are explored in a special issue of Cyberpsychology, Behavior, and Social Networking, a peer-reviewed journal published by Mary Ann Liebert, Inc. The special issue is available free online.
Source: Mary Ann Liebert, Inc./Genetic Engineering News


text:
Press Release
Light Dawns on Dark Gamma-ray Bursts
16 December 2010
Gamma-ray bursts are among the most energetic events in the Universe, but some appear curiously faint in visible light. The biggest study to date of these so-called dark gamma-ray bursts, using the GROND instrument on the 2.2-metre MPG/ESO telescope at La Silla in Chile, has found that these gigantic explosions don't require exotic explanations. Their faintness is now fully explained by a combination of causes, the most important of which is the presence of dust between the Earth and the explosion.
Gamma-ray bursts (GRBs), fleeting events that last from less than a second to several minutes, are detected by orbiting observatories that can pick up their high energy radiation. Thirteen years ago, however, astronomers discovered a longer-lasting stream of less energetic radiation coming from these violent outbursts, which can last for weeks or even years after the initial explosion. Astronomers call this the burst's afterglow.
While all gamma-ray bursts [1] have afterglows that give off X-rays, only about half of them were found to give off visible light, with the rest remaining mysteriously dark. Some astronomers suspected that these dark afterglows could be examples of a whole new class of gamma-ray bursts, while others thought that they might all be at very great distances. Previous studies had suggested that obscuring dust between the burst and us might also explain why they were so dim.
"Studying afterglows is vital to further our understanding of the objects that become gamma-ray bursts and what they tell us about star formation in the early Universe," says the study's lead author Jochen Greiner from the Max-Planck Institute for Extraterrestrial Physics in Garching bei München, Germany.
NASA launched the Swift satellite at the end of 2004. From its orbit above the Earth's atmosphere it can detect gamma-ray bursts and immediately relay their positions to other observatories so that the afterglows could be studied. In the new study, astronomers combined Swift data with new observations made using GROND [2] — a dedicated gamma-ray burst follow-up observation instrument, which is attached to the 2.2-metre MPG/ESO telescope at La Silla in Chile. In doing so, astronomers have conclusively solved the puzzle of the missing optical afterglow.
What makes GROND exciting for the study of afterglows is its very fast response time — it can observe a burst within minutes of an alert coming from Swift using a special system called the Rapid Response Mode — and its ability to observe simultaneously through seven filters covering both the visible and near-infrared parts of the spectrum.
By combining GROND data taken through these seven filters with Swift observations, astronomers were able to accurately determine the amount of light emitted by the afterglow at widely differing wavelengths, all the way from high energy X-rays to the near-infrared. The astronomers used this information to directly measure the amount of obscuring dust that the light passed through en route to Earth. Previously, astronomers had to rely on rough estimates of the dust content [3].
The team used a range of data, including their own measurements from GROND, in addition to observations made by other large telescopes including the ESO Very Large Telescope, to estimate the distances to nearly all of the bursts in their sample. While they found that a significant proportion of bursts are dimmed to about 60–80 percent of the original intensity by obscuring dust, this effect is exaggerated for the very distant bursts, letting the observer see only 30–50 percent of the light [4]. The astronomers conclude that most dark gamma-ray bursts are therefore simply those that have had their small amount of visible light completely stripped away before it reaches us.
"Compared to many instruments on large telescopes, GROND is a low cost and relatively simple instrument, yet it has been able to conclusively resolve the mystery surrounding dark gamma-ray bursts," says Greiner.
[1] Gamma-ray bursts lasting longer than two seconds are referred to as long bursts and those with a shorter duration are known as short bursts. Long bursts, which were observed in this study, are associated with the supernova explosions of massive young stars in star-forming galaxies. Short bursts are not well understood, but are thought to originate from the merger of two compact objects such as neutron stars.
[2] The Gamma-Ray burst Optical and Near-infrared Detector (GROND) was designed and built at the Max-Planck Institute for Extraterrestrial Physics in collaboration with the Tautenburg Observatory, and has been fully operational since August 2007.
[3] Other studies relating to dark gamma-ray bursts have been released. Early this year, astronomers used the Subaru Telescope to observe a single gamma-ray burst, from which they hypothesised that dark gamma-ray bursts may indeed be a separate sub-class that form through a different mechanism, such as the merger of binary stars. In another study published last year using the Keck Telescope, astronomers studied the host galaxies of 14 dark GRBs, and based on the derived low redshifts they infer dust as the likely mechanism to create the dark bursts. In the new work reported here, 39 GRBs were studied, including nearly 20 dark bursts, and it is the only study in which no prior assumptions have been made and the amount of dust has been directly measured.
[4] Because the afterglow light of very distant bursts is redshifted due to the expansion of the Universe, the light that left the object was originally bluer than the light we detect when it gets to Earth. Since the reduction of light intensity by dust is greater for blue and ultraviolet light than for red, this means that the overall dimming effect of dust is greater for the more distant gamma-ray bursts. This is why GROND's ability to observe near-infrared radiation makes such a difference.
More information
This research is presented in a paper to appear in the journal Astronomy & Astrophysics on 16 December 2010
The team is composed of: J. Greiner (Max-Planck-Institut für extraterrestrische Physik [MPE], Germany), T. Krühler (MPE, Universe Cluster, Technische Universität München), S. Klose (Thüringer Landessternwarte, Germany), P. Afonso (MPE), C. Clemens (MPE), R. Filgas (MPE), D.H. Hartmann (Clemson University, USA), A. Küpcü Yoldaş¸ (University of Cambridge, UK), M. Nardini (MPE), F. Olivares E. (MPE), A. Rau (MPE), A. Rossi (Thüringer Landessternwarte, Germany), P. Schady (MPE), and A. Updike (Clemson University, USA)
ESO, the European Southern Observatory, is the foremost intergovernmental astronomy organisation in Europe and the world's most productive astronomical observatory. It is supported by 14 countries: Austria, Belgium, Czechia, Denmark, France, Finland, Germany, Italy, the Netherlands, Portugal, Spain, Sweden, Switzerland and the United Kingdom. ESO carries out an ambitious programme focused on the design, construction and operation of powerful ground-based observing facilities enabling astronomers to make important scientific discoveries. ESO also plays a leading role in promoting and organising cooperation in astronomical research. ESO operates three unique world-class observing sites in Chile: La Silla, Paranal and Chajnantor. At Paranal, ESO operates the Very Large Telescope, the world's most advanced visible-light astronomical observatory and VISTA, the world's largest survey telescope. ESO is the European partner of a revolutionary astronomical telescope ALMA, the largest astronomical project in existence. ESO is currently planning a 42-metre European Extremely Large optical/near-infrared Telescope, the E-ELT, which will become "the world's biggest eye on the sky".
- Research paper in A&A
- GROND website
- Photos of the La Silla Observatory
- Photo of MPG/ESO 2.2-metre telescope
Jochen Greiner
Max-Planck Institute for Extraterrestrial Physics
Garching bei München, Germany
Tel: +49 89 30000 3847
Email: firstname.lastname@example.com
Richard Hook
ESO, La Silla, Paranal, E-ELT and Survey Telescopes Public Information Officer
Garching bei München, Germany
Tel: +49 89 3200 6655
Cell: +49 151 1537 3591
Email: email@example.com
About the Release
Release No.: | eso1049 |
Type: | Unspecified : Cosmology : Phenomenon : Gamma Ray Burst |
Facility: | MPG/ESO 2.2-metre telescope |
Instruments: | WFI |


text:
Security recommendations
All web application software is highly complex, and every application has security issues that are found from time to time, usually involving some combination of input that the programmers did not anticipate. The Moodle project takes security seriously, and is continuously improving Moodle to close such holes as we find them.
- This page contains important security measures for your Moodle installation.
- You should report security problems to the Moodle tracker (and mark it as a security issue!) so that developers can see it and inform registered Moodle sites about fixes as soon as possible.
- You should not post actual exploits in the forums or elsewhere on the web (to protect Moodle admins who have not upgraded yet).
Simple security measures
- The best security strategy is a good backup! But you don't have a good backup unless you are able to restore it. Test your restoration procedures!
- Load only software or services you will use
- Perform regular updates
- Model your security after the layers of clothing you wear on a cold winter day
Basic recommendations
- Update Moodle regularly on each release
- Published security holes draw crackers attention after release. The older the version, the more vulnerabilities it is likely to contain.
- Use https to secure all pages (not just the login page)
- Protect all traffic from your Moodle instance and your users by making all pages accessible via https only. This not only protects passwords on login but also ensures the privacy of your users so that all user data cannot be intercepted or manipulated ("ad injections") from third parties like WLAN providers for example. Free https certificates are available from https://letsencrypt.org/. In addition, set httpslogin=yes in your moodle config to add an extra layer of protection for submitting login credentials.
- Register globals MUST be disabled
- This will help prevent against possible XSS problems in third-party scripts.
- Use strong passwords for admin and teachers
- Choosing "difficult" passwords is a basic security practice to protect against "brute force" cracking of accounts.
- Only give teacher accounts to trusted users. Avoid creating public sandboxes with free teacher accounts on production servers.
- Teacher accounts have much freer permissions and it is easier to create situations where data can be abused or stolen.
- Separate your systems as much as possible
- Another basic security technique is to use different passwords on different systems, use different machines for different services and so on. This will prevent damage being widespread even if one account or one server is compromised.
Run regular updates
- Use auto update systems
- Windows Update
- Linux: up2date, yum, apt-get
- Consider automating updates with a script scheduled via cron
- Mac OSX update system
- Stay current with php, apache, and moodle
Use mailing lists to stay updated
- CERT - http://www.us-cert.gov/cas/signup.html
- PHP - http://www.php.net/mailing-lists.php - sign up for Announcements list
- MySQL - http://lists.mysql.com - sign up for MySQL Announcements
- Security experts recommend a dual firewall
- Differing hardware/software combinations
- Disabling unused services is often as effective as a firewall
- Use netstat -a to review open network ports
- Not a guarantee of protection
- Allow ports
- 80, 443(ssl), and 9111 (for chat),
- Remote admin: ssh 22, or rdp 3389
Password policy
A password policy may be set up in Settings > Site administration > Security > Site policies.
There is a check box to determine if password complexity should be enforced or not, the option to set the minimum length of the password, the minimum number of digits, the minimum number of lowercase characters, the minimum number of uppercase characters and the minimum number of non alphanumeric characters.
If a user enters a password that does not meet those requirements, they are given an error message indicating the nature of the problem with the entered password.
Enforcing password complexity along with requiring users to change their initial password go a long way in helping ensure that users choose and are in fact using "good passwords".
However, making the check too onerous just results in them writing it down so be realistic.
Be prepared for the worst
- Have backups ready
- Practice recovery procedures ahead of time
- Use a rootkit detector on a regular basis
Moodle security alerts
- Register your site with Moodle.org
- Registered users receive email alerts
- Security alerts also posted online
- Web - http://moodle.org/security
- RSS feed - http://moodle.org/rss/file.php/1/1/forum/996/rss.xml
Miscellaneous considerations
These are all things you might consider that impact your overall security:
- Use the secure forms setting
- Always set a mysql root user password
- Turn off mysql network access
- Use SSL, httpslogins=yes
- Use good passwords - set up a password policy in Settings > Site administration > Security > Site policies
- Do not enable the opentogoogle setting (in Settings > Site administration > Security > Site policies)
- Disable guest access
- Place enrollment keys on all courses or set Course Enrollable = No for all courses
- Ensure the enrolment key hint is disabled (which it is by default) in Administration > Site administration > Plugins > Enrolment > Self enrolment.
Most secure/paranoid file permissions
Note: The following information applies to Linux/Unix based installations only, as MS Windows permission system is quite different.
Depending on your server set-up there are two different scenarios:
- You are running Moodle on your own dedicated server.
- You are running Moodle on a shared hosting environment.
In the sections below, you are required to use the web service user account and group to set the permissions, so you need to know them. This can vary quite a bit from server to server but if this feature has not been disabled in your server, you can go to http://your.moodle.site/admin/phpinfo.php (logging in as admin), and then search for the line that reads 'User/Group', inside the 'apache' table. For example, I get 'www-data' for the user account and 'www-data' for the group too.
Running Moodle on a dedicated server
Assuming you are running Moodle on a sealed server (i.e. no user logins allowed on the machine) and that root takes care of the modifications to both moodle code and moodle config (config.php), then this are the most tight permissions I can think of:
1. moodledata directory and all of its contents (and subdirectories, includes sessions):
owner: apache user (apache, httpd, www-data, whatever; see above) group: apache group (apache, httpd, www-data, whatever; see above) permissions: 700 on directories, 600 on files
2. moodle directory and all of its contents and subdirectories (including config.php):
owner: root group: root permissions: 755 on directories, 644 on files.
If you allow local logins for regular users, then 2. should be:
owner: root group: apache group (apache, httpd, www-data, whatever; see above) permissions: 750 on directories, 640 on files.
Think of these permissions as the most paranoid ones. You can be secure enough with less tighter permissions, both in moodledata and moodle directories (and subdirectories).
If you are running Moodle on a shared hosting environment, then above permissions are probably wrong. If you set 700 as the permission for directories (and 600 for files), you are probably denying the web service user account access to your directories and files.
If you want to tighten your permissions as much as possible, you will need to know:
- the user account and the group the web service is running under (see above).
- the owner of the directories/files of both moodledata and the moodle directory (this should normally be your client user account), and the group of the directories/files. You can usually get this information from the file manager of your hosting control panel. Go to the moodle folder and pick any directory or file and try to view/change the permissions, owner and group of that file. That would normally show the current permissions, owner and group. Do the same for the moodledata directory.
Then, depending on the following scenarios you should use a different set of permissions (listed from more secure to less secure) for your moodledata directory:
- if the web service account and the owner of the directories/files is the same, you should use 700 for directories and 600 for files.
- if the web service group and the group of the directories/files is the same, you should use 770 for directories and 660 for the files.
- if none of the above, you will need to use 777 for directories and 666 for files, which is less secure but it is your only option. 707 and 606 would be more secure, but it might or might not work, depending on your particular setup.
In fact, you just need to set moodledata the permissions specified above, as all the directories and files inside are created by the web service itself, and will have the right permissions.
Regarding the moodle directory, as long as the web service user account can read the files plus read and execute the directories, that should be enough. There is no need to grant write permission to the web service account/group on any of the files or subdirectories. The only drawback is that you will need to create the config.php by hand during the installation process, as Moodle will not be able to create it. But that should not be a big problem.
See also
Using Moodle forum discussions:
- Guide to Securing your Moodle Server
- How to secure Moodle website from hacking including recommendations on emergency recovery