text:
Need to cool off?
Shiba (No) Zojo-ji, color woodblock print by Kawase Hasui.
On Met Museum. Use Fullscreen link and download arrow.
One must always draw, draw with the eyes, when one cannot draw with a pencil.
- Balthus
There is no model;
there is only color.
- Paul Cezanne
Need to cool off?
Shiba (No) Zojo-ji, color woodblock print by Kawase Hasui.
On Met Museum. Use Fullscreen link and download arrow.
Weather extremes were among others:
Longest hot spell (world): Marble Bar, W. Australia, 100° F (37.8° C) (or above) for 162 consecutive days, Oct. 30, 1923 to Apr. 7, 1924.
Largest hailstone (U.S.): Aurora, Neb., 7 in. (17.8 cm) in diameter, 18.75 in. (47.6 cm) in circumference, June 22, 2003.
Costliest U.S. hailstorm: Denver, Colorado, July 11, 1990. Total damage was $625 million.
Do we really need to be reminded of the next winter, Charley?
I enjoyed this! Sweltering weather down here in Florida, nice to see something "cool"!
The above is one of the best designs Hasui ever did! Good choice!
On my blog I have an original preparatory design for a woodblock print by Hasui. As well as a movie showing Hasui (himself) making preparatory sketches for woodblock prints. The master carver Maeda Kentaro is carving the woodblocks.
Below I'm including a link to the blog page. Please enjoy!
Hasui making woodblock prints


text:
His use of "I," "me," and "my" may not be the signifier one pundit suggests.
Ronald Reagan's died 10 years ago on June 5, 2004, 20 years after he delivered this notable address.
Christie's got nothing on Vladimir Putin.
The president mentioned "Iraq" or "Afghanistan" 10 times.
The Massachusetts Democrat gave a fiery speech Sunday with a lot for liberals to love.
The best (and worst) of the final night of the Democratic National Convention.
President Obama's speech patterns, examined.
What to watch for in the final night of the Democratic convention.
The former president's most memorable lines came when he was in attack-dog mode.

subset: commoncrawl


text:
PCF Jobs in Kingston, NY
Hiring? Post a Job
Show: All Results Last 7 Days
No jobs found – change your filters above for more results
PCF Reviews
Recommend to a friend
Approve of CEO
0 Ratings
"Delivery "
Doesn't RecommendNeutral Outlook
- Work/Life Balance
- Culture & Values
- Career Opportunities
- Comp & Benefits
- Senior Management
You work independently.pretty much. Flexible schedule overall. Corporate office staff is professional.
Terrible disorganized management team! Low pay for the demands of the job. Wear & tear on your vehicle. No consideration for employees' personal time & life events. Managers lie to the employees and are rude in their delivery. They only care about productivity.
Advice to Management
Grow up and act professional!!! You need to speak correctly to the employees. Create a better relationship with the employees. Pay well and then you can make reasonable demands.
Work at PCF? Share Your Experiences
Click to Rate
Don't Miss Out On a Job You Love
Upload a resume to easily apply to jobs from anywhere. It's simple to set up.


text: vOverall we had a good stay at the Hotel but it was faulted by some problems which shouldnt occur at a four star Hotel. The rooms are fine but a little bit used and we couldnt help but feel like in a small bunker with the Junior Suite that faces the pool and is built into the Basement. The window... More


text:
|Numéro de publication
|Type de publication
|Numéro de demande
|Date de publication
|19 mai 2005
|Date de dépôt
|14 nov. 2003
|Date de priorité
|14 nov. 2003
|Autre référence de publication
|Numéro de publication
|Richard Bussiere, Mark Townsend, Steven Pettit, David Harrington, John Roese, Richard Graham
|Cessionnaire d'origine
|Enterasys Networks, Inc.
|Exporter la citation
|BiBTeX, EndNote, RefMan
|Citations de brevets (34), Référencé par (46), Classifications (10), Événements juridiques (7)
|Liens externes: USPTO, Cession USPTO, Espacenet
1. Field of the Invention
The present invention relates to systems and methods for responding to intrusion events detected in a network system. More particularly, the present invention relates to a distributed system of intrusion response by enabling network policy allocation through a plurality of network infrastructure devices.
2. Description of the Prior Art
Computing systems are useful tools for the exchange of information among individuals. The information may include, but is not limited to, data, voice, graphics, and video. The exchange is established through interconnections linking the computing systems together in a way that permits the transfer of electronic signals that represent the information. The interconnections may be either cable or wireless. Cable connections include, for example, metal and optical fiber elements. Wireless connections include, for example infrared, acoustic, and radio wave transmissions.
Interconnected computing systems having some sort of commonality are represented as a network. For example, individuals associated with a college campus may each have a computing device. In addition, there may be shared printers and remotely located application servers sprinkled throughout the campus. There is commonality among the individuals in that they all are associated with the college in some way. The same can be said for individuals and their computing arrangements in other environments including, for example, healthcare facilities, manufacturing sites and Internet access users. A network permits communication or signal exchange among the various computing systems of the common group in some selectable way. The interconnection of those computing systems, as well as the devices that regulate and facilitate the exchange among the systems, represent a network. Further, networks may be interconnected together to establish internetworks. For purposes of the description of the present invention, the devices and functions that establish the interconnection represent the network infrastructure. The users, computing devices and the like that use that network infrastructure to communicate are referred to herein as attached functions and will be further defined. The combination of the attached functions and the network infrastructure will be referred to as a network system.
The process by which the various computing systems of a network or internetwork communicate is generally regulated by agreed-upon signal exchange standards and protocols embodied in network interface cards or circuitry and software, firmware and microcoded algorithms. Such standards and protocols were borne out of the need and desire to provide interoperability among the array of computing systems available from a plurality of suppliers. Two organizations that have been responsible for signal exchange standardization are the Institute of Electrical and Electronic Engineers (IEEE) and the Internet Engineering Task Force (IETF). In particular, the IEEE standards for internetwork operability have been established, or are in the process of being established, under the purview of the IEEE 802 committee on Local Area Networks (LANS) and Metropolitan Area Networks (MANs).
The identified organizations generally focus on the mechanics of network and internetwork operation, less so on rules and restrictions on access to, and the provisioning of services associated with, the network. Presently, access to applications, files, databases, programs, and other capabilities associated with the entirety of a discrete network is restricted primarily based on the identity of the user and/or the network attached function. For the purpose of the description of the present invention, a "user" is a human being who interfaces via a computing device with the services associated with a network. For further purposes of clarity, a "network attached function" or an "attached function" may be a user connected to the network through a computing device and a network interface device, an attached device connected to the network, a function using the services of or providing services to the network, or an application associated with an attached device. Upon authentication of the offered attached function's identity, that attached function may access network services at the level permitted for that identification. For purposes of the present description, "network services" include, but are not limited to, access, Quality of Service (QoS), bandwidth, priority, computer programs, applications, databases, files, and network and server control systems that attached functions may use or manipulate for the purpose of employing the network as an asset. The basis upon which the network administrator grants particular permissions to particular attached functions in combination with the permissions is an established network usage policy. For example, one policy may be that any user (one type of attached function) with an employee identification number is granted access to the enterprise's electronic mail system at a specified bandwidth and QoS level.
Typically, the network administrator establishes policies. The policies may be defined in and regulated through a policy server controlled by the administrator. The established policies are transmitted to and enforced by the devices of the network infrastructure, typically at the entry connection points or ports. As part of the authentication process and access process, a particular set of policies are established by the administrator for an attached function. That is, the port at which that attached function is connected to the network infrastructure is configured to effect those policies. For example, QoS, bandwidth, and priority levels may be set at certain values for one identified attached function and at different levels for another attached function. Once that set of policies has been established for that attached function, there is typically no coordinated mechanism to revise the set of policies at any time during network connection based on a change of circumstances.
Unfortunately, events and activities do occur that may be harmful to the network system. For purposes of this description, harm to the network system includes, for example, access denial, intentionally tying up network computing resources, intentionally forcing bandwidth availability reduction, and restricting, denying, modifying, or gaining access to data or services. There are currently two generally available forms of network protection designed to minimize such types of network harm: firewalls and Intrusion Detection Systems (IDS). Firewalls are designed to prevent the passage of packets to the network based on certain limited specific conditions associated with the packets. Firewalls do not permit packet passage for the purpose of further analysis nor do they enable assigned policy modifications. IDS are designed to observe the packets, the state of the packets, and patterns of usage of the packets entering or within the network infrastructure for harmful behavior. However, the available IDS do not prevent packet entry to the network infrastructure. Further, for the most part, they only alert a network administrator to the existence of potentially harmful behavior but do not provide an automated response to the detected occurrence. There is some limited capability to respond automatically to a detected intrusion. However, that capability is static in nature in that the response capability is ordinarily restricted to limited devices of the network infrastructure and the response is pre-defined, there being no option to respond in a dynamic fashion to multiple network infrastructure devices.
For the most part, existing IDS, whether network-based (NIDS), host-based (HIDS) or a combination of the two (NIDS/HIDS), are centrally configured. That is, all detected potentially harmful occurrences are transferred to a central processing function for analysis and, if applicable, alarm reporting. The detection functionality may reside in one or more devices associated with one or more network infrastructure devices. Each device provides its own report to the central processing function with respect only to those packets passing to it. The central processing function then conducts the analysis and the alarm reporting.
Upon receipt of an alarm, the network administrator may do nothing or manually adjust the state of the entire network infrastructure or a particular network infrastructure device in response to the detected occurrence. That process takes a relatively significant amount of time, with the response delay potentially allowing increasingly greater harm to the network system as the occurrence continues. If a response is effected, it may result in a much more widespread restriction on network usage, due to the limited number of select entry ports, than is warranted by the actual occurrence. Further, the use of a centralized processing function is a potential problem in that a failure of the central function affects the entire network infrastructure.
Therefore, what is needed is an improved IDS that provides a rapid response to detected occurrences for which a response is required. Further, what is needed is such an improved IDS that employs a greater portion of the network infrastructure for detection and response. Further, what is needed is a system that enables response, preferably automated response, to detected occurrences in a more focused or granular manner than has heretofore been employed. Yet further, what is needed is such a response system that minimizes the impact on the network infrastructure as a whole when a failure occurs in any one portion of the system.
The present invention is a Distributed Intrusion Response System (DIRS) for enforcement of policies associated with network usage based on detection of identified events or occurrences deemed suitable for triggering such enforcement. The DIRS is configured to enable that policy enforcement at any suitable network infrastructure device without requiring the device to have advanced knowledge of the particular policies to enforce or the attributes of the intrusion causing the policy enforcement. Further, the DIRS is configured such that the network administrator is not required to know in advance which network infrastructure device is to be used to respond to an intrusion occurrence. In effect, the DIRS enables all network infrastructure devices to be intrusion response devices as means to enforce policies associated with network usage security. That is, no prior knowledge is required of the particular network infrastructure device that will respond in an on-the-fly arrangement rather than a static, hardwired one. Any network device may be considered a network security enforcement device. That distributed arrangement results in a web of security protecting all aspects of the network system.
The response generated by the DIRS may be generated at a network entry device, by a centralized network infrastructure device, or a combination thereof. The response may be a single response action generated by a single device, it may be a combination of actions generated by one or more devices, including entry and core devices, or it may be a set of serial or parallel responses generated by one or more such devices. For example, a detected intrusion of the network may produce a response resulting in a change of policy at the network entry device where the intrusion was detected. Alternatively, the detected intrusion may trigger a response involving policy changes at one or more network entry devices including or not including the network entry device where the intrusion was detected. In another alternative, the detected intrusion may trigger a response involving policy changes only at one or more centralized devices, or some combination of entry and centralized devices. Further, the response may involve a series of stepped responses, such as first directing an intruder to perform some activity and, if not completed, then initiating one or more additional policy changes. It is contemplated that policy changes may include timed changes, such as making a policy change at one or more devices and, if no further triggering conditions are observed over a specified period of time, converting the changed policy back to its origin or some other, possibly less restrictive, policy. The response may be a calculated response created based upon the triggering condition, or it may be a set response automatically generated based on a particular type of triggering condition.
The DIRS of the present invention interacts with, and enables acting upon information from, an IDS or intrusion detection function, whether that function is established in hardware, firmware, software, or any combination thereof, for network monitoring. (For purposes of this invention, an intrusion of the network infrastructure may enter the network infrastructure from an attached function or it may be generated within the network infrastructure.) One example of a suitable intrusion detection function is the Dragon™ Intrusion Defense System offered by Enterasys Networks, Inc., of Andover, Mass. The intrusion detection function must be able to detect and report identified occurrences deemed by the network administrator to be network security threats. The DIRS may operate through a policy manager function, which function may be established in hardware, firmware, software or any combination thereof, directly or indirectly connected to the intrusion detection function and configured to regulate network infrastructure device policies.
The DIRS includes one or more distributed network infrastructure enforcement devices directly or indirectly connected to the policy manager function and with the capability to be configured to enforce security, usage, and/or network access policies managed by the policy manager function. The network infrastructure devices having the enforcement function include one or more physical or logical connection points or ports through which policies are enforced. As indicated, those policies may be enforced at a network entry device, a centralized network infrastructure device, or a combination thereof. As a result, enforcement may be established at any network infrastructure device provisioned with the enforcement function. Centralized responses to triggering conditions are no longer required. Human intervention may continue to form part of the response strategy, but not exclusively so.
For effective implementation of distributed policy enforcement response to detected intrusions, the DIRS preferably also includes a directory service function, either contained within the DIRS or accessible via one or more external interfaces from the DIRS to a shared management service, to map the physical and logical locations of all network infrastructure devices, including the distributed enforcement devices. Each of the enforcement devices preferably includes the capability to provide to the directory service function its physical location information, its logical location information, its OSI layer 2/MAC address information, its OSI layer 3/network address information, and its OSI layer 2 to layer 3 mapping information for the device itself or all attached functions and transit signal traffic. That information may be stored locally on the devices themselves, or it may be stored centrally (in a single device or in a distributed manner), such as in a network management server that may or may not include, or be a part of, the policy manager function.
The DIRS provides improved dynamic response to detected intrusions in a much more focused manner than has been achieved in prior detection and rudimentary response methods. That is, policy enforcement may be enabled only at the point or points of intrusion rather than network wide, unless that broader approach is specifically desired. This granular enforcement is primarily enabled at network entry devices but may also be implemented at other network infrastructure devices that may be centrally located. Policy enforcement may occur at the network infrastructure entry devices as well as at centralized internal devices. As a result, detected intrusions may be more quickly barred from spreading throughout the network infrastructure, thereby minimizing harm to the network system as a whole. It is also possible that the DIRS may dampen rather than eliminate the activity of the offending or potentially offending source or sources. That would enable subsequent auditing and gathering of forensic evidence without allowing the source or sources to impact the network system adversely or significantly. The dampening function would simply be one form of policy alternative to a complete denial or shutting off policy and that form of response may be driven by the assessment of the harm or potential harm to the network system. Where the potential harm or threat is high, the DIRS may isolate fully the source or sources but where the DIRS determines that the threat is slow moving or relatively low, a dampening policy may be preferable so that connectivity is not fully prohibited.
Focused responses to detected intrusions may include, but are not limited to, disablement of particular transport protocols (e.g., TCP, OSI Layer 4/Transport), logical addresses (e.g., IP, OSI Layer 3/Network), or physical addresses (e.g., OSI Layer 2/MAC) active in the detected intrusion, or other such protocols or addresses that may be involved in an intrusion, all without disabling other protocols or addresses not involved in the intrusion. That selective disablement may be part of a static policy arrangement (e.g., a static policy that in all instances where virus type A is detected, specified transport protocol X is immediately disabled), a dynamic policy arrangement (e.g., if a particular server access has been detected and a particular port has been probed, then packets on the probed port may be monitored or diverted to a honeypot), or a combination of the two. Further description of static and dynamic policy provisioning is described in pending U.S. patent application Ser. No. 10/629,331, filed Jul. 29, 2003, entitled "System and Method for Dynamic Network Policy Management" and assigned to common assignee Enterasys Networks, Inc. The contents of that application are incorporated herein by reference.
The response method achieved with the DIRS of the present invention involve the following steps, all or a portion of which may be used to establish a focused response in a rapid manner. The steps include upon receiving information regarding a triggering event or condition, such as an intrusion alarm from an intrusion detection function, a) identifying the source or sources of the intrusion or intrusions; b) identifying one or more enforcement devices to respond to the intrusion or intrusions; and c) implementing a response at the one or more identified devices. The method further optionally includes the step of verifying the legitimacy/accuracy of address information associated with the identified source or sources of the detected intrusion(s). The method further includes the optional step of reporting the detected intrusion(s) and the generated response to the network administrator. Detection of intrusions may be achieved using a HIDS, a NIDS, or a combination thereof, such as the Dragon™ Intrusion Defense System of Enterasys Networks, Inc., or some other form of detection capability. The step of identifying the source of the intrusion includes identifying the source address or addresses of the particular detected packet or packets by analysis using the policy manager function or as part of the IDS reporting function. The address identification may be performed locally, through one or more device-to-device interfaces, or via one or more centralized devices or services. The step of determining on which particular network infrastructure device or devices the intrusion packets were received may be made by using existing network management functions. The step of implementing a response may be achieved by transmitting a policy change from the policy manager function to the identified network infrastructure device that acts as a security enforcement device.
For the purpose of this invention description, the DIRS enables a network administrator to establish granular control of network services usage generally, or usage of particular network services specifically, based on intrusions that are detected at any time throughout network operation. An intrusion is any event, activity, occurrence, information or characteristic identified in a network system by the network administrator as being harmful or potentially harmful to the network system, or unauthorized in any way. The intrusion may be generated by an attached function or a network infrastructure device. The types of intrusions that would force a change in policy associated with an enforcement device of the network infrastructure may be of any type of interest to the network administrator. The system configuration can vary and can include any type of voice, data, or voice/data network, including LANs, MANs, Wide Area Networks (WANs), Personal Area Networks (PANs), Virtual Private Networks (VPNs), and Home Networks. The system may be used to improve network usage, control, and security.
The network administrator can configure the DIRS such that, upon detection of an intrusion, any of a selectable number of policies may be directed to one or more of the security enforcement devices. For example, if some form of network virus previously unknown to the network administrator is detected, all attached functions may be forced off the network infrastructure, and then required to re-authenticate and verify the addition of a virus detection function suitable for detecting that newly identified virus prior to re-acquiring full or specific portions of network system usage. Alternatively for example, the identified source port of the identified enforcement device may simply be disabled with respect to a specific transport protocol for a specified period of time or until a particular corrective action occurs.
In one aspect of the invention, a method is provided for responding to the detection of an intrusion on a network system that provides network services, the network system including one or more attached functions and network infrastructure. It includes the steps of identifying the source or sources of an intrusion or intrusions, identifying one or more network infrastructure enforcement devices to which the identified source(s) is/are attached, and configuring the identified network infrastructure enforcement device(s) with one or policy changes responsive to the detected intrusion(s). The method also includes the step of configuring one or more of the enforcement devices to report their physical and logical address information to a policy change function. The response function is initiated upon receiving information from a centralized or distributed intrusion detection function. The step of identifying the one or more intrusion sources includes the optional step of verifying the one or more addresses of the one or more identified sources via the network infrastructure devices to which they are directly or indirectly attached. For example, a network entry device may be queried for the current state of a specific address or its current address lists and the lists compared with the intrusion source(s) information. The source address(es) information may also be verified through a combination of entry and central device queries or addresses lists.
In another aspect of the invention, a system is provided to respond to the detection of an intrusion on a network system that provides network services, the network system including one or more attached functions and a network infrastructure. The system includes means for receiving information from one or more intrusion detection functions. The system includes a directory service function including address information for devices of the network system. It also includes means for receiving provisioning information from a policy manager function that provisions devices of the network infrastructure with policies. One or more network devices of the system are configured to report address information to the directory service function, and to enforce policy changes established thereon by the policy manager function in response to detected intrusions. The system further includes a policy decision function configured to receive detected intrusion information from one or more intrusion detection functions, to receive network infrastructure device information from the directory service function, to evaluate whether a policy change or changes is or are required on one or more of the security enforcement devices in response to the detected intrusion information, and to direct the policy manager function to configure identified devices with determined policy changes upon deciding to do so based upon the evaluation. The policy manager function and the policy decision function are preferably part of a central policy server of the network infrastructure, but not limited thereto. In addition, the one or more enforcement devices may be any one or more of any combination of routers, switches, access points, gateways, and firewalls or other devices of the network infrastructure. A network management system may be employed to identify address information for the network security enforcement devices, and that network management system preferably communicates with the intrusion detection function.
In another aspect of the invention, there is an article of manufacture comprising a machine-readable medium that stores executable instruction signals that cause a machine to perform the method described above and related methods described herein.
The details of one or more examples related to the invention are set forth in the accompanying drawings and the description below. Other features, objects, and advantages of the invention will be apparent from the description and drawings, and from the appended claims.
The present invention is a system and related method to detect and respond, in a distributed and dynamic manner, to intrusions associated with the operation of a network system. Referring to
An attached function is external to infrastructure 101 and forms part of network system 100. Examples of attached functions 104 a-104 e are represented in
One or more of the devices of the infrastructure 101 may include a responsive dynamic policy enforcement module 108. For purposes of illustration, network infrastructure devices 105 a-b, 106, and 210 illustrated in
The information providing function provides device information associated with that particular infrastructure device and any attached functions connected directly or indirectly to it. That device information may be stored or cached locally or in a more centralized manner. In a preferred embodiment of the invention, the device information is provided to a central directory service in a manner to be described herein. Alternatively, a network infrastructure device such as central switch device 106 may provide that information directly to the policy server 103. Further, the directory server function may be embodied in the policy server 103 or another central device controlled by the network administrator. The enforcement function puts into effect the set of policies responsive to an intrusion detected by an Intrusion Detection System (IDS) function (not shown), and assigned to the device by the policy server 103.
The enforcement module 108 of any particular device of the infrastructure 101 may include any one or both of the two identified functions. It is contemplated that the policy server 103 under control of the network administrator will have primary responsibility for decision making of assigning and modifying sets of policies, but that device information reporting and policy enforcement in particular, are distributed functions. However, it is also contemplated that some decision making and policy assignment function may be established in the module 108 of a network device. That is, for example, module 108 of central switching device 106 may include a policy assignment function and modules 108 of network entry devices 105 a-c may have information reporting and enforcement functions for the attached functions to which they are connected. In addition, as indicated, there may be network devices that have no enforcement module 108. Instead, such "dumb" devices may simply provide packet exchange functionality only and leave combinations of reporting, assigning, and enforcement functions for their connections to other devices of the infrastructure 101.
The information providing, policy assignment, and enforcement functions may include algorithms and processes necessary to identify information about attached functions and devices, provide that information, enforce sets of assigned policies, and make decisions regarding assigned policies. Module 108 can be implemented in hardware and/or software. For example, particular software, firmware, or microcode functions executing on the network infrastructure devices can provide the information providing functions, policy enforcement as presently available in network infrastructure devices, and policy assignment decision making. Alternatively, or in addition, hardware modules, such as programmable arrays or ASICs, can be used in the devices to provide some or all of those capabilities. Further, the intrusion detection function may be implemented by any commercially available IDS, including the Dragon™ Intrusion Defense System provided by Enterasys Networks, Inc. of Andover, Mass. While the IDS may be a standalone appliance, it may alternatively be embodied in part or in full in one or more other devices of the network infrastructure 101.
Access by an attached function to the network services associated with network system 100 includes a setting of static and/or dynamic policies, referred to generally as a set of policies, for the attached function. Sets of policies are established by the network administrator. Information regarding an attached function seeking or having access to network services and the sets of policies may be stored centrally or in a distributed manner, including being stored locally. In an example of a centralized approach, the policying system of the present invention stores attached function and policy set information for all of the connection points of the network system 100 in a server such as policy server 103. In an example of a distributed approach, the policying system stores attached function and policy set information for all attached functions, or a portion of the attached functions, in one or more of the local network devices 105 a-b and 106 of the network infrastructure 101.
A preliminary process for network entry by an attached function includes the initial steps of the complete process to respond to detected intrusions of the network system 100 throughout the entirety of a network session. The entry process may be started using conventional entry methods upon attached function initiation of a network entry request such as by booting up a network entry device or initiating a connection to a network entry device at a connection point using a computing device such as a computer. The network control system then initiates attached function authentication methods.
Entry to the network system 100, and the infrastructure 101 primarily, may be initially regulated using authentication systems such as Network Operating Systems (NOSs), Remote Authentication Dial-In User Service (RADIUS), described in IETF Request For Comment (RFC) 2138, and IEEE 802.1×standard, which provides for port-based network entry control based on a MAC identifier. Firewalls also provide a technique for network entry regulation based on their packet analysis functionality previously described.
In addition to acquiring the attached function information necessary to authenticate access to the network services, the policying system is preferably configured, or forms part of a system, that directly or indirectly obtains any further additional information identified by the network administrator as being of importance in assessing relevant policies and for establishing the mechanism for responding to detected intrusions for which policy changes may be required. Such further additional information includes, but is not limited to, attached function physical (MAC) address, attached function logical address, and attached function physical/logical address binding, attached function location, attached function configuration, attached function operating system, attached function security features, user location, and network entry port information.
Based upon information obtained using standard authentication and any additional attached function information observation or query, a determination is made of the attached function's permission to access network services. If the information acquired is authenticated or otherwise accepted, the attached function enters the network usage control process of the invention. If either the authentication information or the additional attached function information is insufficient to permit preliminary network entry (e.g., a password is incorrect or the user's identified location is not known), network entry is restricted or denied.
With reference to
Throughout network system operation, the intrusion detection function monitors the network infrastructure 101 for activities, events, or occurrences that may be considered to be unusual or out of the ordinary (step 204). Upon detection of noteworthy or potentially noteworthy activity, the intrusion detection function makes a report to the policy server 103 or other suitable intrusion detection function (step 205) in a manner corresponding to the reporting process associated with the IDS of choice. The reported information may include information identifying the source or sources of an intrusion or intrusions. The information provided by the intrusion detection function (or by other means, such as a node alias table) includes the address(es) of one or more sources of the packet(s) associated with the detected activity. As those skilled in the art of intrusion detection operations understand, the information reported by the intrusion detection function may be generated by a single device or by a plurality of devices. Further, the information gathered may be associated with activity involving one or more network infrastructure devices, one or more attached functions or any combination thereof. The information related to any one network infrastructure device or any one attached function may not of itself be considered related to noteworthy activity; however, a combination of disparate events or occurrences may result in a response trigger, such as in the case of a distributed network attack.
The system of the present invention is further configured to enable the network administrator to monitor the information reported by the intrusion detection function that are defined by the network administrator as triggers for changing, or evaluating whether to change, the static/dynamic policy set initially established (step 206). Monitoring of the network system 100 preferably includes monitoring of all intrusion reports and may further include monitoring for other selectable events, activities or occurrences. Monitoring is conducted on some or all attached functions, some or all of the network infrastructure 101 devices, some or all of the intrusion detection function, or combinations thereof. In effect, the monitoring is a continuous observation of all network activity as well as identified external events that the administrator may wish to have considered, including the time of day, for example.
In addition to the available intrusion reporting function, a great number of mechanisms exist for automatically monitoring network links, L2 topologies, L3 topologies and the status and utilization of ports and attached functions. Remote monitoring (RMON) tools and Simple Network Management (SNMP) Management Information Bases (MIBs) are useful and valuable methods to collect the information about network infrastructure devices, attached functions, links, network state and status, to provide input into creating the events to trigger policy changes. They may also be used to learn address information for attached functions that are sources of intrusions, and address information for network infrastructure devices associated with such attached functions. For purposes of this description, association means the direct or indirect wired or wireless connection of an attached function to a network infrastructure device. Further, input ports on access switches and routers may be capable of classifying traffic based on all layers of the ISO (International Standards Organization) seven layer Architecture model. Activities may be monitored on a port by port basis yet many are better suited to a distributed model with local and remote inputs. The Netsight™ Atlas™ network management tool offered by Enterasys Networks, Inc. of Andover, Mass. may be suitable for that purpose. It is contemplated that the IDS function, the network management tool, or both include one or more application program interfaces for collecting the attached function and enforcement device information and for querying the directory service for response requirements.
If the reported activity is determined to be insufficient to require a change of policies associated with the network infrastructure 101, the system permits continued and ongoing intrusion monitoring without any policy changes. However, if the intrusion detection function indicates that an intrusion response is required, the intrusion detection function contacts the directory service with the address or addresses of the source or sources of the captured packet(s) (207). The address information may be a Layer 2 address such as a MAC address, a Layer 3 address, such as an IP address, or preferably a combination of both. It is to be understood that an intrusion source may have one or more of each type of address. The directory service provides information sufficient to identify one or more enforcement devices to which the identified source or sources is/are attached (step 208). The address information may be a Layer 2 address such as a MAC address, a Layer 3 address, such as an IP address, or preferably a combination of both. It is to be understood that an enforcement device may have one or more of each type of address, each of which may or may not be associated with the detected intrusion. The DIRS then determines if the reported address(es) for the identified source(s) is/are legitimate, either by querying the network management system to confirm the authenticity of the identified address, by testing for its presence using a technique such as an SNMP get-and-respond exchange, or by some other means of address identification verification (step 209).
With continuing reference to
The policy manager function modifies policy for an enforcement device in a distributed manner by sending control information to the identified enforcement device or devices (i.e., by SNMPv3) such that some or all of the following may be accomplished: 1) further network access by or through the device is blocked completely (i.e. MAC address filter is installed; 2) access by the IP address (only) is blocked (L3 filter installed); 3) access or use of the offending protocol is denied (e.g., L7, L2/L4 or L3/L4 protocol is blocked); 4) limit bandwidth from, to, or from and to the device; 5) direct traffic to a honeypot or other monitoring device; and 6) direct traffic to a simulation device, such as a simulated network, or other methods. Policy changes may also include removing a policy change made, either automatically or periodically. Further, it may involve conducting a test as to whether the triggering condition remains and, if so, keeping the policy in effect, and if not, removing the change policy. Also as previously noted, the enforcement response may be an incremental set of responses. For example, making a minimal policy change and then examining whether that change has resolved the triggering condition. If not, an increased or broader policy change may be enabled and the result re-tested. It is to be understood that the policy change may be associated with ingress into a port or ports of a network infrastructure device, egress from a port or ports of a network infrastructure device, or messaging through the network infrastructure to an attached function. The Netsight™ Atlas™ network management product offered by Enterasys Networks, Inc. of Andover, Mass., including the User Personalized Network™ policy provisioning functionality thereof, may be suitable for that distributed policy change control function.
As noted, the present system and related method employ a centralized policy server 103 that includes the policy manager function and the intrusion response function and may further include the directory service. It may also include a policy information database. That functionality may alternatively be distributed throughout the infrastructure 101. On the other hand, the information reporting and enforcement functions are preferably distributed. As described below, for a distributed system example, devices both inside and outside network infrastructure 101 can optionally maintain policy information that affects their operation. Relatedly, the policy information may be stored in the centralized policy server 103, distributed, or stored or cached locally for rapid access and access permissions established by the designated policies.
The following is a list of a few possible devices (but not limited to only those devices) that may contain the policy server and/or any one or more of the reporting and enforcement functions: network switches, data switches, wireless access points, routers, firewalls, gateways, computing devices such as network file servers or dedicated usage servers, management stations, network connected voice over IP/voice over data systems such as hybrid PBXs and VoIP call managers, network layer address configuration/system configuration servers such as enhanced DHCP servers, enhanced Bootstrap Protocol (bootp) servers, IPv6 address auto-discovery enabled routers, and network based authentication servers providing services such as RADIUS, extensible authentication protocol/IEEE 802.1× or others.
As indicated above, in order to distribute policy changes to enforcement devices, network system 100 may employ SNMP. A network administrator provisions the policy information of the terminus of a network cable associated with the attached function in the SNMP ifDescr variable (e.g., the ifDescr is a read only attribute, but many systems allow a network operator to "name" a port, which then will be displayed in this field). The module 108 of a network infrastructure device reads the terminus information via the SNMP. In another example MIB parameters may be established or used to obtain and configure the table of information, the intrusion triggers, and the policying options. MIBs may also be employed to populate the table of dynamic and static historical information for storage and/or caching.
Other variations of the above examples can be implemented. One example variation is that the illustrated processes may include additional steps. Further, the order of the steps illustrated as part of processes is not limited to the order illustrated in their figures, as the steps may be performed in other orders, and one or more steps may be performed in series or in parallel to one or more other steps, or parts thereof. For example, the IDS and trigger monitoring steps may be performed in parallel.
Additionally, the processes, steps thereof and various examples and variations of these processes and steps, individually or in combination, may be implemented as a computer program product tangibly as computer-readable signals on a computer-readable medium, for example, a non-volatile recording medium, an integrated circuit memory element, or a combination thereof. Such computer program product may include computer-readable signals tangibly embodied on the computer-readable medium, where such signals define instructions, for example, as part of one or more programs that, as a result of being executed by a computer, instruct the computer to perform one or more processes or acts described herein, and/or various examples, variations and combinations thereof. Such instructions may be written in any of a plurality of programming languages, for example, Java, Visual Basic, C, or C++, Fortran, Pascal, Eiffel, Basic, COBOL, and the like, or any of a variety of combinations thereof. The computer-readable medium on which such instructions are stored may reside on one or more of the components of system 100 described above and may be distributed across one or more such components.
A number of examples to help illustrate the invention have been described. Nevertheless, it will be understood that various modifications may be made without departing from the spirit and scope of the invention. Accordingly, other embodiments are within the scope of the claims appended hereto.
|Brevet cité
|Date de dépôt
|Date de publication
|18 avr. 1988
|12 févr. 1991
|L'etat Francais Represente Par Le Ministre Des Ptt Centre National D'etudes Des Telecommunications 5Cnet
|System and process for controlling the flow of either data packets or channel signals in an asynchronous time multiplexer
|4 sept. 1990
|5 oct. 1993
|Digital Equipment Corporation
|Multiple protocol routing
|22 oct. 1992
|14 févr. 1995
|Digital Equipment Corporation
|Packet format in hub for packet data communications system
|18 déc. 1992
|11 avr. 1995
|Chrimar Systems, Inc.
|Network security system for detecting removal of electronic equipment
|30 sept. 1992
|6 févr. 1996
|Bay Networks Group, Inc.
|System having central processor for transmitting generic packets to another processor to be altered and transmitting altered packets back to central processor for routing
|25 avr. 1995
|4 mars 1997
|Cabletron Systems, Inc.
|Network bridge with multicast forwarding table
|8 nov. 1996
|23 nov. 1999
|Harris Corporation
|Network surveillance system
|12 janv. 1998
|11 juil. 2000
|Motorola, Inc.
|Adaptive system and method for responding to computer network security attacks
|30 déc. 1996
|3 oct. 2000
|Cabletron Systems, Inc.
|System for broadcasting messages to each of default VLAN ports in subset of ports defined as VLAN ports
|31 aoűt 1999
|14 nov. 2000
|Cabletron Systems, Inc.
|Method for establishing restricted broadcast groups in a switched network
|23 nov. 1999
|26 déc. 2000
|Pittway Corp.
|Secure communications in a wireless system
|9 nov. 1998
|20 nov. 2001
|Sri International
|Network surveillance
|22 déc. 2000
|14 mai 2002
|Cisco Technology, Inc.
|Flow control technique for traffic in a high speed packet switching network
|29 oct. 1997
|24 sept. 2002
|Enterasys Networks, Inc.
|Network address resolve blocker
|4 oct. 1999
|6 mai 2003
|Enterasys Networks, Inc.
|Virtual LANs
|5 mai 2003
|16 mars 2004
|Sri International
|Network surveillance
|15 oct. 1999
|7 sept. 2004
|Networks Associates Technology, Inc.
|Method and apparatus for providing a policy-driven intrusion detection system
|2 mars 2001
|6 déc. 2001
|Terrence Hussey
|High-speed data processing using internal processor memory space
|23 aoűt 2001
|14 févr. 2002
|Anderson Walter F.
|Key management methods and communication protocol for secure communication systems
|18 sept. 2001
|4 juil. 2002
|Tenor Networks,Inc.
|System resource availability manager
|5 janv. 2001
|11 juil. 2002
|Steven Branigan
|Methods and apparatus for secure wireless networking
|10 janv. 2002
|12 sept. 2002
|Rowland Craig H.
|Computer security and management system
|13 juin 2002
|16 janv. 2003
|Gupta Ramesh M.
|Protocol-parsing state machine and method of using same
|8 févr. 2002
|30 janv. 2003
|Gladstone Philip J. S.
|Stateful reference monitor
|30 aoűt 2001
|6 mars 2003
|Honeywell International Inc.
|Automated configuration of security software suites
|12 déc. 2001
|12 juin 2003
|International Business Machines Corporation
|Intrusion detection method and signature table
|1 févr. 2002
|7 aoűt 2003
|Satyendra Yadav
|Integrated network intrusion detection
|27 mars 2002
|2 oct. 2003
|Desai Anish P.
|Multi-level and multi-platform intrusion detection and response system
|28 juin 2002
|1 janv. 2004
|Robert Whelan
|System and method for detecting unauthorized wireless access points
|30 juil. 2002
|5 févr. 2004
|Day Christopher W.
|Intrusion detection system
|11 sept. 2002
|11 mars 2004
|Enterasys Networks, Inc.
|Modular system for detecting, filtering and providing notice about attack events associated with network security
|5 déc. 2002
|10 juin 2004
|International Business Machines Corp.
|Defense mechanism for server farm
|14 avr. 2003
|28 oct. 2004
|Sung Andrew H.
|Computationally intelligent agents for distributed intrusion detection system and method of practicing same
|10 sept. 2002
|16 déc. 2004
|Ghanea-Hercock Robert A
|Agent-based intrusion detection system
|Brevet citant
|Date de dépôt
|Date de publication
|7 juil. 2003
|1 juin 2010
|Lg Electronics Inc.
|Home network system and its configuration system
|20 mars 2009
|15 juin 2010
|Enterasys Networks, Inc.
|System and method for dynamic network policy management
|30 oct. 2007
|10 aoűt 2010
|Nextlabs, Inc.
|Detecting behavioral patterns and anomalies using information usage data
|25 févr. 2008
|23 nov. 2010
|Intel Corporation
|Generic bootstrapping protocol (GBP)
|28 oct. 2004
|1 févr. 2011
|Samsung Electronics Co., Ltd.
|System and method for scalable and redundant COPS message routing in an IP multimedia subsystem
|14 mai 2004
|8 mars 2011
|Lg Electronics Inc.
|Home network system
|12 nov. 2004
|8 mars 2011
|Symantec Corporation
|Automated environmental policy awareness
|17 aoűt 2007
|26 avr. 2011
|Informod Control Inc.
|System and method for remote authentication security management
|14 mai 2004
|24 mai 2011
|Lg Electronics Inc.
|Method of assigning a node address in a local network
|13 juin 2005
|23 aoűt 2011
|Oracle America, Inc.
|Dynamic defense of network attacks
|14 mai 2004
|4 oct. 2011
|Lg Electronics Inc.
|Home network system
|30 mars 2010
|29 mai 2012
|Enterasys Networks, Inc.
|System and method for lost contact response
|30 oct. 2007
|14 aoűt 2012
|Nextlabs, Inc.
|Analyzing usage information of an information management system
|23 oct. 2007
|9 oct. 2012
|International Business Machines Corporation
|Blocking intrusion attacks at an offending host
|30 oct. 2007
|27 nov. 2012
|Nextlabs, Inc.
|Detecting behavioral patterns and anomalies using activity profiles
|12 mars 2013
|Nextlabs, Inc.
|Using information usage data to detect behavioral patterns and anomalies
|15 juil. 2010
|11 juin 2013
|Allegiance Corporation
|Collapsible fluid collection and disposal system and related methods
|22 févr. 2007
|16 juil. 2013
|Cisco Technology, Inc.
|Mitigating threats in a network
|24 mars 2008
|6 aoűt 2013
|Allegiance Corporation
|Fluid collection and disposal system having interchangeable collection and other features and methods relating thereto
|17 nov. 2011
|29 oct. 2013
|Symantec Corporation
|Systems and methods for blocking a domain based on the internet protocol address serving the domain
|15 juil. 2010
|4 mars 2014
|The Trustees Of Columbia University In The City Of New York
|Systems and methods for correlating and distributing intrusion alert information among collaborating computer systems
|14 aoűt 2012
|8 avr. 2014
|Nextlabs, Inc.
|Analyzing usage information of an information management system
|13 mai 2008
|12 aoűt 2014
|At&T Intellectual Property, I, L.P.
|Methods and apparatus for intrusion protection in systems that monitor for improper network usage
|22 déc. 2006
|30 sept. 2014
|Nextlabs, Inc.
|Analyzing activity data of an information management system
|30 sept. 2011
|7 oct. 2014
|Fortinet, Inc.
|Method, apparatus, signals, and medium for managing transfer of data in a data network
|22 déc. 2006
|14 oct. 2014
|Nextlabs, Inc.
|Detecting behavioral patterns and anomalies using activity data
|29 déc. 2006
|3 févr. 2015
|Intel Corporation
|Network security elements using endpoint resources
|10 juil. 2013
|14 juil. 2015
|Cisco Technology, Inc.
|Mitigating threats in a network
|30 sept. 2011
|25 aoűt 2015
|Fortinet, Inc.
|Method, apparatus, signals, and medium for managing transfer of data in a data network
|16 janv. 2013
|15 sept. 2015
|The Trustees Of Columbia University In The City Of New York
|Systems and methods for correlating and distributing intrusion alert information among collaborating computer systems
|28 oct. 2004
|31 mars 2005
|Samsung Electronics Co., Ltd.
|System and method for scalable and redundant COPS message routing in an IP multimedia subsystem
|12 oct. 2005
|11 mai 2006
|Sushanthan Sudaharan
|Honeynet farms as an early warning system for production networks
|14 mai 2004
|2 nov. 2006
|Sam-Chul Ha
|Home network system
|14 mai 2004
|9 nov. 2006
|Sam-Chul Ha
|Home network system
|14 mai 2004
|25 janv. 2007
|Seung-Myun Baek
|Home network system
|7 févr. 2006
|1 mars 2007
|Fujitsu Limited
|Network management system
|21 sept. 2006
|22 mars 2007
|Reflex Security, Inc.
|Detection of system compromise by correlation of information objects
|13 mai 2008
|19 nov. 2009
|Chaoxin Qiu
|Methods and apparatus for intrusion protection in systems that monitor for improper network usage
|4 nov. 2010
|The Trustees Of Columbia University In The City Of New York
|Systems and Methods for Correlating and Distributing Intrusion Alert Information Among Collaborating Computer Systems
|26 janv. 2012
|Fortinet, Inc.
|Method, apparatus, signals, and medium for managing transfer of data in a data network
|9 nov. 2006
|30 juil. 2008
|Sourcefire, Inc.
|Intrusion event correlation with network discovery information
|9 nov. 2006
|3 sept. 2014
|Cisco Tech Inc
|Intrusion event correlation with network discovery information
|11 mai 2009
|27 oct. 2010
|Chengdu Huawei Symantec Technologies Co., Ltd.
|Database security monitoring method, device and system
|9 nov. 2006
|24 mai 2007
|Sourcefire Inc
|Intrusion event correlation with network discovery information
|26 nov. 2007
|5 juin 2008
|Ofer Amitai
|System and method of network authorization by scoring
|30 janv. 2009
|5 aoűt 2010
|Hewlett-Packard Development Company, L.P.
|Dynamically applying a control policy to a network
|Classification aux États-Unis
|Classification internationale
|Classification coopérative
|Classification européenne
|2 mars 2004
Owner name: ENTERACYS NETWORKS, INC., MASSACHUSETTS
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:BUSSIERE, RICHARD;TOWNSEND, MARK;PETTIT, STEVEN;AND OTHERS;REEL/FRAME:014390/0580
Effective date: 20040116
|10 nov. 2010
Owner name: WELLS FARGO TRUST CORPORATION LIMITED, AS SECURITY
Free format text: GRANT OF SECURITY INTEREST IN U.S. PATENTS;ASSIGNOR:ENTERASYS NETWORKS INC.;REEL/FRAME:025339/0875
Effective date: 20101109
|25 févr. 2013
|Fee payment
Year of fee payment: 4
|1 nov. 2013
Owner name: ENTERASYS NETWORKS INC., MASSACHUSETTS
Free format text: TERMINATION AND RELEASE OF SECURITY INTEREST IN PATENTS AT REEL/FRAME NO. 25339/0875;ASSIGNOR:WELLSFARGO TRUST CORPORATION LIMITED;REEL/FRAME:031558/0677
Effective date: 20131031
|27 juil. 2015
Owner name: SILICON VALLEY BANK, CALIFORNIA
Free format text: SECURITY AGREEMENT;ASSIGNOR:ENTERASYS NETWORKS, INC.;REEL/FRAME:036189/0509
Effective date: 20150724
|26 aoűt 2015
Owner name: EXTREME NETWORKS, INC., NEW HAMPSHIRE
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:ENTERASYS NETWORKS, INC.;REEL/FRAME:036467/0566
Effective date: 20150820
|3 sept. 2015
Owner name: EXTREME NETWORKS, INC., CALIFORNIA
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:ENTERASYS NETWORKS, INC.;REEL/FRAME:036538/0011
Effective date: 20150820


text:
Erin Snow's luxe brand of couture sportswear combines athletic utility with artistic glamour. Snow's chic belted coats, ski jackets, thermal "Bea" tops and other designs will put you ahead of the style curve whether you're on the slopes or shopping downtown. And for chic downhill runs, look to Snow's insulated "Liv" ski pants to keep you both warm and ultra-fashionable. Erin Snow's use of high-tech materials, detachable waist powder guards and other clever details, and vintage-inspired fur trims make it the perfect sportswear for bringing glow to snow — or anywhere you go.
Sleek jeans, strappy heels, and more, saturated in the hottest hue of the moment.
Freshly remixed classics from a troop of industry favorites.
Our favorite brands and styles from this week's can't-miss sales
Effortless, city staples from designers with a cool edge.


text:
"This is a sponsored post for SheSpeaks/Pampers though all opinions are my own."
We have always been big fans of Pampers diapers because they were soft for my son when he was in diapers and did not cause any issues. With some of the other diaper samples we had gotten from friends and online we found they were not as durable, soft or as good as pampers. My son had sensitive skin and we didn't have any issues.
Thanks to SheSpeaks and Pampers I was sent a great kit review! The kit included the New Pampers Premium Care diapers (now available to purchase at Walmart), Super cute diaper clutch, a mothers diary and some great info!
Pampers Premium Care Diaper Info:
- Absorb Away Liner: Pulls wetness and mess away from baby's skin
- Breathable Material: To keep air circulating around baby's skin
- Extra Absorb Channels: Helps distribute wetness evenly for up to 12 hours of protection – Hypoallergenic – Wetness Indicator: Lets you know when your baby might need a change
- Available for purchase at Walmart later this month
I was sent size 3 diapers and just loved how soft these diapers were out of the package. I know Pampers can cost more than some of the cheaper brands…but you get what you pay for. With some of the cheaper brands I have noticed they are not as soft and I personally would want to get the softest diaper I could for my little one. We loved the cute designs on the diapers too!
Overall we are super happy with the diapers! My little one did have some issues with some explosions out of the diaper but could be the diaper was just a tad bit too big or my little one goes a lot!!! I would will recommending these to many of my mommy friends too!
Don't forget to enter the codes found on the diapers on Pampers.com. Remember you can collect these points to later turn into some great prizes too!
Stay connected!
- Pampers on Twitter: @Pampers
- Walmart on Twitter: @Walmart
- Premium Care Diapers Purchase Page: http://www.walm
art.com/Premium Care


text:
Our Faiths: Methodist creed confuses guest
Q. I am Baptist and attended a friend's Methodist church. During the worship service, they recited a creed that said something about "apostolic and Catholic church." Why would they say that in a Protestant church? What does it mean? Our church doesn't believe in any creed but Jesus.
Bob, Edmond A. Creeds are summaries of beliefs held by a certain group. In Christianity, the earliest creeds consist of statements repeated in Paul's epistles, but for most people the term is used to identify formal renditions of faith drafted from the Council of Nicea through today. While the Apostles Creed is the more familiar statement of faith recited in many American Protestant churches today, the Nicene Creed is shared by various Protestant, Roman Catholic and Eastern Orthodox churches throughout the world. In the Nicene Creed after proclaiming faith in God the Father, the Son and the Holy Spirit, worshippers say, "We believe in one holy catholic and apostolic Church." The term catholic, when written in lowercase letters, does not refer to a particular denomination. It comes from the Greek "katholikes," which means "universal" and here refers to the worldwide Christian church. When the Nicene Creed was drafted, it was written in Greek, the Mediterranean region's language of commerce and international relations at the time. A few Protestant churches today have decided to change the creed's wording from catholic to universal to avoid confusion with the Roman Catholic Church. The term "apostolic" obviously refers to the Apostles who were the leaders of the early Christian church. Most often we think of the 12 Apostles chosen by Jesus as His inner circle. An apostolic church requires its clergy to be connected to the ordaining acts of Jesus when he picked the original Apostles.


text:
Penstar Bunkhouse
from £0 /night help Price for guests, Nights approx:
6 reviews
from £0 /night help Price for guests, Nights approx:
Estimated nightly price based on a weekly stay. Contact the advertiser to confirm the total cost.
Barn / 3 bedrooms / sleeps 20 Home 13759
Availability Your dates are available
Barn / 3 bedrooms / sleeps 20
|Key Info
The Penstar Bunkhouse was converted from an old barn during the summer of 1996 by the Powell family who have had the farm since 1918.On a working farm the site provides access directly to the Brecon Beacons and to Brecon via the Taff Trail, a recently established long distance walk route. The Bunkhouse is a self-catering facility.
|Sleeps up to 20, 3 bedrooms
|Will consider
|Corporate bookings
|Car advised
|Nearest travel links
|Nearest airport: Cardiff 65 km, Nearest railway: Merthyr Tydfil
|Family friendly
|Great for children of all ages
|Pets welcome, No smoking at this property
Features and Facilities
|Central heating, TV
|Microwave, Fridge, Freezer
|3 bedrooms, 4 bathrooms of which 4 Shower rooms
|Dining seats for 20
|Private garden, BBQ
|Suitable for people with restricted mobility, Not suitable for wheelchair users
|Further details indoors
Accommodation is for 20 people including facilities for those with disabilities in 2, 6, and 12 birth rooms. There is a drying room and fully equipped kitchen with ample living space and under floor heating.
The Powys region
The Brecon Beacons National Park is a beautiful area with dramatic scenery, abundant wildlife and a fascinating past. It is a landscape of contrasts with wild open moorland and hidden waterfalls, windswept mountains and sheltered valleys, bustling mountains and isolated farmsteads. In this rural area farming dominates the landscape and Welsh cultural traditions are strong. This agricultural landscape is rich in wildlife habitats with a wonderful variety of plans and animals both common and internationally rare. There is a powerful sense of history in the legacy of ancient monuments and buildings telling the story of the people who have lived and worked here during the last five thousand years.
The designation of the Brecon Beacons as a National Park in 1957 recognised the outstanding qualities of the landscape.
Penstar is ideally located to accommodate groups requiring a wide range of activities without having to travel too far each day. Pen-Y-Fan (886m) and Corn Du (873m) are the highest summits in the National Park and are directly accessible from Penstar.
Craig Cerrig-gleisiad National Nature Reserve is easily reached by following the Taff Trail and is a good example of Old Red Sandstone escarpment. There are glacial features such as moraines and scree.
Brecon is easily reached by car or on foot via the Taff trail.
Climbing, pony trekking and caving are but a few of the outdoor activities available in the area.
Build your perfect trip, with Holiday Lettings & TripAdvisor
Real opinions, real reviews
Genuine guest feedback from 100,000+ reviews
Quick response times
Know where you're staying within 24 hours
Guest reviewsPowered by TripAdvisor
Guest reviews no reviews
Guest reviews Powered by TripAdvisor
- 5 star
- 3
- 4 star
- 1
- 3 star
- 2
- 2 star
- 0
- 1 star
- 0
Very Good 4/5
Help other travellers decide where to stay
Add your voice to the conversation about this holiday home and your review will appear on TripAdvisor too.Write a review
This advert is created and maintained by the advertiser; we can only publish adverts in good faith as we don't own, manage or inspect any of the properties. We advise you to familiarise yourself with our terms of use.
You're booking with
Sheila P.
- 9 Years listed
90% Response rate
Calendar last updated:15 Apr 2015
Based in United Kingdom
- English


text:
Another huge Halloween Weekend At ZAR , Score and the Locker room coming up, stay tuned ...
2 weeks ago
Toddy W Schempp, Zar Nightclub and 4 others like this
Comment on Facebook
Join us tonight as we host special guests, CMI Talent - The BombSquad and Mirror Pix ! Thursday night is college night, 18+ #akron #kent #cleveland #zar #cmi #bombsquad #thursdays #clublife #downtown #nightlife ...
1 month ago
Zar Nightclub and Matthew Dompreh like this
We are pleased to share Mirror Pix's new remix, Ciara - Ride (Mirror Pix Remix). They will be performing live this Saturday night here at Zar Nightclub. Get their early, doors open at 10. VIP and bottle service available. #saturdaynight #ride #remix #soundcloud #akron #dance #edm ...
Ciara - Ride (Mirror Pix Remix)
Ben Walker and Isaac Alexander. Open format DJs and producers. Resident DJs at Zar Nightclub in Downtown Akron, OH.
Zar Nightclub, Muslim Razag and 1 other like this
Tonight is the night! Mya will be in the building performing live.Presale tickets still available by purchasing online using the paypal link at the top of the event page :)See you there!! ...
One night only national recording artist Mya will be live at Zar Nightclub!
Tickets are available for presale now and at only $10 what are you waiting for??
2 months ago
Mya Live At Zar
August 6, 2015, 10:00pm - August 7, 2015, 1:00am
Zar Nightclub
Raphael B. Dixon, George Szeto and 1 other like this
Can you believe that tomorrow night is the night?? If you have not already purchased tickets for this epic event time is running out. Only $10 for presale or $15 at the door. Tickets can be purchased via paypal by following the link on the top of the event page.Sooooo excited to see Mya perform LIVE! See you there ...


text:
Been here? Rate It!
City into city
I only have been there once, at dusk, in a dark day, rushing down to dinner in town.
Not enough time to appreciate it or to make good pictures, but time enough for a strong decision: "This is a place where I must come back".
- Architecture
- Arts and Culture
- Historical Travel
The castle.
Prague Castle is a complex of around 60 buildings. Its construction began in the late 9th century. Between the 12th and 13th centuries it was fortified and expanded. In the 14th century, under the reign of king Charles IV it was renovated and enlarged. In 1485 king Ladislaus II Jagello started to reconstruct the castle. Queen Maria Theresa ordered the final major reconstruction of the buildings in the latter half of the 18th century.
The highlights of the castle are; Saint Vitus Cathedral; the Old Royal Palace; Saint George basilica and the Golden Lane.
The building of Saint Vitus cathedral begun in 1344 on the site of a 10th century rotunda and was completed in the XIX century. The cathedral is very large and has many beautiful glass stained windows. I recommend climbing up the Wentzel Tower (it is a bell tower). It is inside the cathedral. From the top of it you will enjoy a very beautiful landscape over the castle and the city.
The Old Royal Palace is a complex of buildings set one on the other. Its construction was started from the first half of the XII century. It was the seat of Bohemian princes and from the 13th century to the 16th century it was the king' s palace.
Saint George basilica was first built as a rotunda; around 920. It was later reconstructed into a three naves basilica. It was enlarged at the beginning of the XIII century.
The access to the castle grounds is free, but if you want to see some places and/or museums there, you must buy a ticket.
- Historical Travel
- Arts and Culture
- Castles and Palaces
Prague Castle, CZ
Roughly the size of seven football fields, "Prague Castle" is the largest ancient castle in the world. Built and renovated during 13 centuries, the complex includes churches, gardens, alleyways and royal residences that would take days to appreciate.
I assume you will need several hours to see around in the castle and concerning courtyards, but you will sure need a whole day if you decide to see all the details and the cathedral and so ... :)
Don't miss the St. Vitus Cathedral. In addition to Art Nouveau stained-glass windows and a wooden depiction of the crucifixion, it houses treasures like the tomb of St. John of Nepomuk — a blinding two-metric-ton vault that is held up by an army of silver angels. Enjoy ... :)
- Historical Travel
- Castles and Palaces
- Museum Visits
The second Castle courtyard is surrounded by buildings with facades all the same! This was not always the case as when first built, each building looked different to the other.
During Emperor Rudolf II's reign, the North wing ground floor was used as Stables and for the Carriages. Now, the Stables are used as a picture gallery of Prague Castle - a small part of the Emperor Rudolf's former gallery.
The first floor is where the famous Spanish Hall is located, built for the Emperor's collections to be kept. Sometimes it was used for Royal occasions and what Emperor Leopold thought was fun - these days it would be animal cruelty and he would be in gaol!
I am talking about the year 1680, when the Emperor had a wild tomcat released into the hall so his children and dogs could chase it down and kill it, this they did by spearing it to death. Emperor Charles VI used to shoot at deer driven out from the Stag Moat from one of the Spanish Halls windows.
The courtyard is a good size and has a Baroque fountain [1686] in its centre. Nearby is a well with a pretty wrought iron cover. Was the Well dry - I am not sure as I read water was brought here for the wells!
Along one of the courtyard walls, is the Chapel of the Holy Rood, built where the kitchens once stood. Inside the Chapel are biblical themes painted upon the ceiling.
It is here where you can visit the Imperial Stables and the Treasury of St. Vitus Cathedral
- Architecture
- Historical Travel
- Castles and Palaces
On entering the third Castle courtyard, I couldn't help but notice the massive St. Vitus Cathedral and the Baroque Deanery, decorated with the statue of St. Wenceslas from 1662.
The courtyard is decorated with a replica of a 14th century statue of St. George and a 17 meter tall granite obelisk. Below the pavers in the 3rd courtyard, are the foundations of a 12th century church, which used to be connected by a covered passage to the basilica of St. Vítus.
The 3rd Courtyard opens up to the St. George Square, where St. George's Basilica and the Royal Palace are located.
This area is believed to be the oldest and perhaps where the stone throne of the Bohemian Princes may have once stood.
- Historical Travel
- Castles and Palaces
- Religious Travel
The Treasury is the largest church treasury in the Czech Republic and is one of the best I have ever seen!
NO PHOTO'S ALLOWED - I was very disappointed!
The Treasury of St. Vitus Cathedral goes back to the early middle Ages. You will see lots of marvellous historical pieces on display, such as a relic of the arm of Saint Vitus from 929, very old.
One of the "jewels" of the Treasury is Charles IV's gold coronation reliquary, as well as a cross with a fragment of Christ's loincloth.
Another is the processional crystal cross and the crystal jug, used for storing the tablecloth from the Last Supper!
Expect to see lots of gold and silver, and remember to allow time to have a look at this outstanding exhibition.
OPEN DAILY from 10am to 6pm
Full: 300 CZK Reduced: 150 CZK Family: 600 CZK
We were given a coin for FREE to remember our visit to the St. Vitus Treasury.
- Castles and Palaces
- Historical Travel
- Museum Visits
Prague Castle Art Gallery
Prague Castle Painting Art Gallery offers to the visitors more than one hundred paintings from the Prague Castle fund, which owns about 4,000 paintings.
The Gallery has in its possession a fragment of what used to be Emperor's Rudolf the Second collection plus collection from the 17th century contains artwork of renowned Italian, German, Dutch, Flemish and Czech Baroque painters.
Art Gallery is open to the public daily including Monday (from 9 am to 5 pm during Summer season, from 9 am to 4 pm during winter season).
Entrance to the exposition is from 2nd Courtyard of Prague Castle.
- Castles and Palaces
- Arts and Culture
- Museum Visits
Explore the Prague Castle Complex!
Prague Castle is one of the largest ancient castles in the world according to the Guiness Book of World Records, topping at 570 meters and 130 meters wide. It is also where you will find the Czech crown Jewels.
When I was walking around, I felt I should have read more before I did so that I could easily identify the buildings. The Prague Castle Complex actually consists of several religious structures which include the Saint Vitus Cathedral, a monastery and several jmuseum and art galleries. St Georges's Basilica is famous for evening classical concerts and you might chance upon one when visiting Prague.
There has also been several wars and fires in the area and so the place has seen a lot of rebuilding. Today, tourists from all over the world walk around and it can get a little confusing. They watch the changing of the guards every hour in this castle which is the political and historical center of the Czech republic (seat of the President)
But the beauty of the buildings remain and their history adds to their character.
I made a video of my adventure in Prague!
Hope you like this:
- Architecture
- Castles and Palaces
- Historical Travel
A visit to Prague Castle
Prague Castle actually refers to a fortified complex built in the 9th century on a hill overlooking the Vlatva River. In the beginning, the complex included a palace, three churches and a monastery, but it soon grew to include several other buildings. Prague Castle was attacked, destroyed and rebuilt on many occasions throughout the years, and it houses some of Prague's most interesting historical attractions as well as the present-day office of the President of the Czech Republic. Visitors are of course free to walk around the area (and take in the amazing views of the city!), but if you want to gain access to the buildings you must get an admission ticket. These cost 350 CZK, and most buildings are open daily from 9:00 am to 4:00 pm.
- Castles and Palaces
- Historical Travel
- Museum Visits
Prague castle
Prague castle is massive with an area of almost 7.28 hectares. It is a UNESCO World Heritage site. The history of the castle stretches back to the 9th century. The head of State like the president of Czechoslovakia rule the country from here. Also Kings of Bohemia and Holy Roman Emperors did rule from Prague castle. Within the castle are St Vitus Cathedral, Basilica of St George and also gardens, defense towers and are all open to public. Prague Castle is the centerpiece of the Czech capital. The towers of Prague Castle can be seen from virtually anywhere in Prague.
The Prague Castle is open daily:
5.00 - 24.00 in the summer season (April 1 - October 31)
6.00 - 23.00 in the winter season (November 1 - March 31)
Historical monuments are open daily except 24.12.
9.00 - 18.00 in the summer season (April 1 - October 31)
9.00 - 16.00 in the winter season (November 1 - March 31)
- Photography
- Arts and Culture
- Music
Prague castle complex
We bought family admission which covers 2 adults and 1 child for 700 Cr, which is quite a bargain. We didn't even see all sites that it covers, because we were so tired to see all, our tickets were good for the second day though, but we didn't have that 2d day.
The history of Prague began with the foundation of Prague Castle (reminds me Kremlin in Russia) in the 9th century. Despite fires and invasions, the castle has retained churches, chapels and towers from every period of its history, from the Gothic splendor of St.Vitus's Cathedral to the 16th century Renaissance additions. The courtyards date from 1753-75, when the whole area was rebuilt in the late-Baroque and neo-Classical styles. The castle became the seat of Czechoslovak president in 1918 and the current president of the Czech Republic has an office here.
According to our ticket, first site is Old Royal Palace. Although the first big thing that attracts your attention is St. Vitus' Cathedral. From the time Prague Castle was first fortified in 11th century, the Old Royal palace was the seat of a long line of Bohemian kings.
The vast palace complex consists of three different architectural layers. A Romanesque palace, built around 1135, forms the basement of the present structure. Over the next 200 years, two further palaces were built above this-the first by Premysl Otakar II in 1253 and the second by Charles IV in 1340. On the top floor is the massive Gothic Vladislav Hall, with the splendid rib vaulting. Designed for king Vladislav Jagiello, it was completed in 1502. The Rider's Staircase just off the hall, is a flight of steps with magnificent Gothic rib-vaulting ceiling. It was used by knights on horseback to get to jousting contests.
Under Habsburg rule, the palace housed government offices, courts and old Bohemian parliament.
When you explore the castle, be ready for steep and narrow stairs. The castle itself is rather gloomy and dark, you can feel medieval atmosphere there, nothing like luxury or glamour, more scary and halloweeny. It has a beautiful Prague view from windows though!
You will not miss St.Vitus's it just at the entrance, huge building that reminds me famous French Cathedral that saw inquisition. Maybe that's why it's so scary with its gargoyles (on the ornate west front, gutter spouts are given their traditional disguise as gargoyles, they look disgusting and ugly, my daughter did a research and said they were made this way on purpose to scare night thieves and bad spirits ), gloomy and dark. As for a bit of history, work began on St.Vitus's, Prague's most distinctive landmark in 1344. Architect Peter Parler was largely responsible for the grandiose Gothic design, though the building was not completed for another 600 years. The cathedral contains the tomb of Good King Wenceslav and some fine works of art including an exquisite Alfons Mucha window in Czech Art Nouvean style. Golden Portal was the main Cathedral entrance until the 19th century and it is still used on special occasions. Above it is a mosaic of the last Judgment by 14th century Venetian craftsmen. Rose window was designed by Frantisek Kysela in the 1920 (present entrance),the window above the portals depict scenes from biblical story of the Creation. The skills of architect Peter Parler are clearly seen in the delicate fans of ribbing that support (Gothic vaulting) the three Gothic arches of the Golden Portal.
Next is my personal favorite –St.George's Basilica and Convent. It was founded by prince Vratislav in 920 and is the best preserved Romanesque church in Prague. The huge twin towers and austere interior have been restored to give an idea of the church's original appearence.The tomb of Vratislav I, located opposite the presbytery. Also buried in the church are Prince Boleslav II and Princess Ludmila (grandmother of St.Wenceslas) who was murdered in 921 and revered as the first bohemian saint. Other point of interest a rare early 13th century painting, new Jerusalem, in the chore vault.outside the south portal of the church features a 16th century relief depicting St. George and the dragon.
Zlata ulicka.
The picturesque artisans' cottages along the inside of the castle wall were built in the late 16th century for castle's guards and gunners. A century later, the goldsmiths moved in and modified the buildings. However, by the 19th century the area had degenerated into a slum and was populated by Prague's poor and criminal communities. Golden lane has, however, been home to well-known writers such as Franz Kafka who stayed at No.22 with his sister around 1916-1917 and Jaroslav Seifert, the Noble Prize-winning Czech poet.
Dalibor Tower
It takes its name from the first man to be imprisoned in it. It is indeed, a jail for Nobel men with all torturing stuff in it. I don't like sites like this, but it is a history.
The story of Prague castle
It's a museum , very interesting and quite big one, worth visiting, has a lot of interesting things –archeological and historical ones.
- Castles and Palaces
- Museum Visits
- Budget Travel
The biggest castle in the world
After taking the funicular up/down Petrin Hill, we headed off on our next adventure...climbing the stairs to the Prague Castle (Pražský hrad). The castle (a UNESCO World Heritage site) is where the Kings of Bohemia, Holy Roman Emperors and presidents of Czechoslovakia and the Czech Republic have had their offices and also where the Czech Crown Jewels are kept.
The walk up the stairs provides a spectular view of not only the castle and St. Vitus Cathedral, but also of the city...simply amazing!!! Once you reach the walls of the castle, there are two guards protecting the entrance...a wonderful ceremony occurs where there is a changing of the guard. If you get the opportunity to see it, you won't be disappointed.
Within the walls, there are so many things to see and do, but the most imposing building that you come upon is Saint Vitus' Cathedral (Czech: Katedrála svatého Víta). It's a Roman Catholic cathedral in Prague, the seat of the Archbishop of Prague, tombs of many Bohemian kings and Holy Roman Emperors and an excellent example of Gothic architecture.
- Castles and Palaces
- Architecture
- Photography
Prague's Jewel
Prague castle, or Pražský hrad as it is known in Prague, is one of Prague's most significant monuments and therefore definitely a must see. Plan ahead and allocate at least 2 days of your trip to see the Castle. When we first bought the entrance ticket, we didn't realize that the ticket is, in fact, valid for 2 consecutive days. This gives you more time to look around and explore each section of the castle.
The ticket costs 350 czk and grants you access to 9 locations/galleries/exhibitions within the castle:
(1) The Old Royal Palace
(2) The Story of Prague exhibition
(3) St. George's Basilica
(4) Convent of St. George
(5) Golden Lane
(6) Prague Castle Picture Gallery
(7) St. Vitus's Cathedral
(8) Rosenberg Palace
(9) Powder Tower
The castle is quite a busy tourist attraction, however, due to its proportions, you don't normally have to queue and there's a reasonable amount of space within which you can walk comfortably. Be careful of pickpockets. They are everywhere, especially in front of St. Vitus's Cathedral.
While we were there, there was a man who got robbed and he didn't realize until it was too late. He was taking photos of the Cathedral and a man approached him to ask him if he'd be willing to take a photo of him with the Cathedral in the background. The man, put down his briefcase on a bench nearby to be able to take the photo. Little did he know that another man was waiting for just that - for him to lay down his things so that he could take them. By the time we heard the man shouting and calling for help, it was too late to even identify the man who had asked for the photo. They had both left the scene. The man was robbed of his laptop and passports.
Food and drinks are available in certain spots within the castle. Food is slightly pricey so if you're on a budget, you may want to pack your own lunch and drinks.
- Family Travel
- Budget Travel
- Romantic Travel and Honeymoons
Prague Castle
The Prague Castle (Prazhski grad) is the castle in Prague where the Czech kings, Holy Roman Emperors and presidents of the Czech Republic (and Czechoslovakia) have had their offices. The crown jewels of the Bohemian Kingdom are kept here. Prague Castle is one of the biggest castles in the world (according to Guinness Book of Records the biggest ancient castle) at about 570 meters in length and an average of about 130 meters wide.
The castle buildings represent virtually every architectural style of the last millennium. The Prague Castle includes gothic St Vitus Cathedral, romanesque basilica of St. George, a monastery and several palaces, gardens and defence towers. Most of the castle areas are opened to the tourists.
- Historical Travel
- Museum Visits
- Castles and Palaces
Prague Castle
This is actually more of a complex with several historical sites up on a hill overlooking the river and the city. When I was there, key parts were closed but I did get to see the Royal Palace, which was the most interesting part, and St. George's Basilica. There are also amazing views of Prague from up here.
- Castles and Palaces
- Architecture
Show Prices
Show Prices
Show Prices
Show Prices
Instant Answers: Prague
Get an instant answer from local experts and frequent travelers
- Great room rates
- Mandarin Oriental, Prague Prague
- Expedia.com
- Great room rates
- Four Seasons Hotel Prague Prague
- Booking.com
Sponsored Links
Explore the World
- Malgrat de Mar
- Srinagar Hotels
- Bohol Hotels
- Cebu City
- La Spezia
- Canberra Hotels
- Oued Laou Hotels
- Laoag City


text:
"If the president wants to address this issue - whether because the time has come anyway or as part of a larger Middle East peace initiative - he has the absolute power to do so as the head of the government by commuting Mr. Pollard's sentence to time served," Lowell said in an email.
The documents Pollard smuggled out of a Navy facility included classified information about U.S. weapons and military capabilities. They also detailed radar-jamming techniques and electronic capabilities of Saudi Arabia, Jordan, Egypt and other moderate Arab governments, and included information about intelligence gathering in the United States by China. The Israeli government paid Pollard $45,000 for the documents, reimbursed him for three trips to Europe and Israel, and lavished expensive jewelry on his wife.
In a 1986 court statement that was made public in December 2012, then-Defense Secretary Caspar Weinberger said Pollard had done "irrevocable" damage to the U.S. He said Pollard had provided the Israelis with more than 800 U.S. classified publications and more than 1,000 classified messages and cables.
"The defendant has substantially harmed the United States, and in my view, his crimes demand severe punishment," Weinberger wrote. The court statement was part of a declassified CIA assessment of national security damage caused by Pollard's disclosures.
During 1998 negotiations for a land-for-peace deal brokered at Wye River, Md., CIA Director George Tenet told Clinton he would resign if Pollard were freed as part of the talks. That apparently is the closest the U.S. had come to considering his release.
"I was shocked to hear Pollard's name arise in the middle of these negotiations," Tenet wrote in a memoir. "We were there to broker peace, not to pardon people who had sold out their country."
But over the years, some former U.S. officials have softened. Former secretaries of state Henry Kissinger and George Schultz and former CIA Director R. James Woolsey have called for Pollard's release, as has Sen. John McCain, R-Ariz.
Even so, McCain said Tuesday that linking Pollard's release to the Mideast peace negotiations "smacks of desperate diplomacy." He joined a chorus of Obama administration critics who said Pollard should be freed either on the merits of his parole application or on humanitarian grounds - not as a carrot to keep talks afloat.
Even Democrats were skeptical. "It's hard for me to see how that would jump-start the Mideast peace talks," said Senate intelligence Chairwoman Dianne Feinstein. "It's one thing after an agreement. It's a totally other thing before an agreement."
Elliott Abrams, a senior Mideast adviser to President George W. Bush, said it was logical that Pollard's freedom would be given more consideration now, when he is close to parole eligibility. But Abrams said "it's a very bad idea" and warned that it would amount to injecting politics into a foreign policy process.
The U.S. initially hoped to secure a peace agreement by the end of April. When it became clear several months ago that neither side was anywhere close to an agreement Kerry said he aimed to reach a framework by then to serve as the basis for continuing negotiations. But even that benchmark appeared elusive as Israeli and Palestinian leaders failed to agree on what the framework would include. Abrams said he believes Pollard should be released, but he said it appears it is being considered now only to keep Abbas from walking away in anger as a result of Israel failing to release more prisoners.
"It's diplomatic malpractice in my view," Abrams said. "You're going to keep Abbas at the table for a few more months. What are we going to give him next year to keep him at the table?"
Follow Lara Jakes on Twitter at: https://twitter.com/larajakesAP
Associated Press writers Matthew Lee in Brussels, and Robert Burns, Eric Tucker, Bradley Klapper and Donna Cassata in Washington contributed to this report.


text:
Two hours into a surgery to save Kyah, a 6-month-old giraffe, and veterinary surgeon Mark Rochat runs into a problem.
As he attempts to cut away a vessel that has grown around the giraffe's esophagus, he can't stop the bleeding. The soft tissue around the vessel isn't strong enough to hold sutures. If the bleeding can't be stopped, she will die.


text:
FiltersShow / Hide
- All Events
- Music
- Comedy
- Theatre & Shows
- Sport
- Cinema
- Festivals
- Days Out
- Anywhere In The UK
- Location: Anywhere in the UK
Radius: ... miles
This event has been and gone!
Catch the next one:
Check out the info below for future tour dates, and track them to receive alerts when they tour near you
Never miss another 'Stipe REM' show
Stipe REM
No-one gets closer to the inimitable style of Michael Stipe than Rick Southern. In 2008 the band performed for Michael Stipe himself, live on the BBC1's The One Show. Afterwards, Michael said that he thought the band sounded "awesome!" Backed by a band that play with passion and precision, this is a show not to be missed by anyone who likes R.E.M.
Stipe REM tour dates
Track this event
- Event has been added to your calendar
- Any important updates will be sent to your email address
- Add to your personal Ents24 calendar
- Sync with iCal, Outlook and others
- Receive important updates
Venue Facts
Venue: Buskers
Website: https://facebook.com/buskers
Enquiries: 01382 226451
→ Dundee 8 min walk


text:
Expand Messages
- Hi Dex,
I think that what We have all gone through up until now, will pale in comparisom compared to what Humanity
will go through over the next ten years, as We gradually come to grips, with all that is happening all
around Us, that We are presently, largely unaware of.
Kind Regards,
----- Original Message -----
From: Dex
To: firstname.lastname@example.com
Sent: Wednesday, July 14, 2010 3:45 AM
Subject: [ufodiscussion] RADIX
An important read. For days attempts have been successfully made to thwart my dispensing a story about a Light angel contactee exposing to him a cosmic war with other intelligence of space ruling our world who don't want our learning that we're here to activate light bodies.
Invaluable information.
The link below is the best I can do for now for an introduction. Five hard drives, many domains and all blocked with a variety of excuses why the mail can't be sent. Then, given enough learning time, the documents get erased. Addresses disappear, saved favorites included.
Then top all of that..directly threatened. Tech aboard craft can be quite impressive.
Any Radix edition available now is most likely an edited version leaving out important information. So it's been my experience. It all started back in the 70's when I wanted Gray Barker to read it before finishing his book on the "Men in Black."
Lo and behold, was I in for a surprising threat. Shocking the lengths an intelligence will go simply to suppress universal information. Barker wasn't allowed to read it. Geez
[Non-text portions of this message have been removed]
[Non-text portions of this message have been removed]
Your message has been successfully submitted and would be delivered to recipients shortly.


text:
Economics for a Crowded Planet
Event: Jeffrey Sachs will be in conversation with Charlie Rose
Tuesday, March 25 at 8 pm
92nd Street Y, Kaufmann Concert Hall
Lexington Avenue at 92nd Street
To learn more and purchase tickets, go here.
Weigh in: Do you ever feel helpless when it comes to solving major problems facing humanity? Do you agree with Dr. Sachs that those problems all have solutions?