I currently have the following DNS Query Alert rule set up in Suricata (for test purposes):   alert dns any any -&gt; any any (msg:”Test dns_query option”; dns_query; content:”google”; nocase; sid:1;)   Which is triggered when it captures DNS events which contain the word "google", such as in this packet:  {"timestamp":"2017-06-08T15:58:59.907085+0000","flow_id":1798294020028434,"in_iface":"ens33","event_type":"dns","src_ip":"172.16.10.132","src_port":53,"dest_ip":"192.168.160.140","dest_port":52385,"proto":"UDP","dns":{"type":"answer","id":57334,"rcode":"NOERROR","rrname":"www.google.com","rrtype":"A","ttl":300,"rdata":"172.217.12.164"}}   However, instead of searching for resource record names that contain "google", I want to use this same kind of alert to trigger on IP addresses that resolve to loopback, as is the case with the following packet (Notice the rdata field):  {"timestamp":"2017-06-08T15:59:37.120927+0000","flow_id":36683121284050,"in_iface":"ens33","event_type":"dns","src_ip":"172.16.10.132","src_port":53,"dest_ip":"192.168.160.140","dest_port":62260,"proto":"UDP","dns":{"type":"answer","id":53553,"rcode":"NOERROR","rrname":"outlook1.us","rrtype":"A","ttl":120,"rdata":"127.0.0.1"}}   As I have noticed, the contentsection of a Suricata rule searches only for a string. My current rule triggers on a text match with the rrname/domain, how would I make it so that the rule triggers on rdata/IP address?  p.s. Just out of curiosity I tried replacing the "google" in the content section of my alert with "127.0.0.1" and that didn't work either, as expected.
I am new to working with IDS' such as Suricata/Snort. I am currently trying to using Suricata to log DNS requests and responses to malicious domains on my network. On my DNS server I made it so that any request to say, bad.com, would resolve to 127.0.0.1, thus not allowing anybody on my network to access that site.   I have set up Suricata to log all DNS requests, but how do I filter that down and narrow it and tell it to only log requests to 127.0.0.1 and let everything else go unlogged?   I tried to create a rule:  alert dns any any -&gt; 127.0.0.1 any (msg: "BLACKLISTED WEBSITE"; flow:to_client; content:"rrname";sid:2240001;rev:1;)   But that did not work.   What do I need to do to only log DNS requests to certain IPs? I cannot find any information in the documentation or anywhere else on the internet.   Thanks.
What are independent parameters in Hellmann–Feynman theorem? A typical example in textbooks about the application of Hellmann–Feynman theorem is calculating $\left\langle\frac{1}{r^2}\right\rangle$ in hydrogen-like atoms.  has a nice demonstration of this. At some point in the Wikipedia derivation is used that $$\frac{\partial n}{\partial \ell}~=~1. \tag{1}$$   But why is eq. (1) true? I know that  $$n=n_r+\ell+1,$$   but $n_r$ is just another variable with different physical meaning, so why is $n_r$ independent from $\ell$, whereas $n$ is not? The Wikipedia proof for Hellmann–Feynman theorem does not address the problem of independence of different parameters. What variables are kept fixed during the differentiation $(1)$ and why?  The Wikipedia page seems to have only a vague notion of $\frac{\partial\hat{H}}{\partial\lambda}$ and $\frac{\partial E}{\partial\lambda}$, unlike in, e.g., thermodynamics, where all partial derivatives are typically written like  $$\left( \frac{\partial U}{\partial V} \right)_S \qquad ,\qquad  \left( \frac{\partial U}{\partial V} \right)_p \qquad ,\qquad  \ldots $$ so that it is clear which variables are kept fixed during the differentiations. Do free falling observers see gravitational blueshift? Observers at rest in gravitational fields will see infalling light signals as blueshifted.  Do inertial observers in free fall in a gravitational field see the same shift?  If someone is standing on a cliff at rest in the gravitational field and then steps off, do they instantly see a change in the blueshift as a result of being in free fall in an inertial reference frame? Why is it differential equations exist on an interval instead of a domain? I understand a domain is the set of input elements a function is defined for (and can have breaks in it e.g. union of 2 sets) and a interval is a continuous range of real numbers. Why do we speak of the solution to a differential equation over an interval instead of an domain? If the solution to an ODE is just a function, and we normally speak of functions as having a domain, then why wouldn't we use domain? Resuming and Finishing the flow Created a flow in the sandbox to capture a survey.  I have enabled the ability to Pause the flow and added the component to Home page.   All the screens for the flow is complete and when I test run below 2 issues are found.  1. In the last screen I do not find the Finish Button. There is a record update after last screen. When I add a screen after record update It shows the finish screen But if click the previous button present there it moves to the first and create a new record. Is there any possibility to finish without going on the previous screens   When I resume a Paused flow, after clicking on the last screen, instead of redirected to the Account page, the flow is restarting. Appreciate your help.   On pause going to first screen is normal functionality , Is there any modification that can be done. Proving a Lipschitz function is continuous A function $f:D\subset \mathbb R \to \mathbb R$  is lipschitz given that there exists a $L\gt0$ such that $|f(x)-f(y)|\le L|x-y|$  I need to prove this function is then continuous. Is there a best definition of continuous functions to use for this proof given the definition of Lipschitz?  Is the epsilon delta way the only way to do it? can someone help me set it up? I really struggle with implementing that definition. app crash in the dealloc Why doesn't planet Earth expand if I accelerate upwards when standing on its surface? According to General Relativity I am being accelerated upwards by planet earth while writing this question. But a curious person on the the other side of the planet relative to me would have the same experience. That means we are accelerated in opposite directions, although earths diameter do not seem to increase. How can this be? where is `cd` located? Suppose $ \alpha, \beta&gt;0 $. Compute:   $$ \int_{0}^{\infty}\frac{\cos (\alpha x)-\cos (\beta x)}{x}dx $$   Here is what I do: $$\begin{align} \int_{0}^{\infty}\frac{\cos (\alpha x)-\cos (\beta x)}{x}dx &amp;= \int_{0}^{\infty}dx\int_{\alpha}^{\beta}\sin (yx)dy\\ &amp;=\int_{\alpha}^{\beta}dy\int_{0}^{\infty}\sin(yx)dx\\ &amp; \\ &amp;   \qquad\text{let $ yx=u $}\\ &amp; \\ &amp;=\int_{\alpha}^{\beta}\frac{1}{y}dy\int_0^{\infty}\sin u du\\ &amp;=\int_{\alpha}^{\beta}\frac{1}{y}dy\left( -\cos u|_{\infty}+\cos u|_0 \right)\\ &amp;=\log\frac{\beta}{\alpha}(-\cos(\infty)+1)\\ &amp;=\log\frac{\beta}{\alpha}-\cos(\infty)\log\frac{\beta}{\alpha} \end{align}$$  But $ \cos(\infty) $ does not exist right? Does it mean the integral actually diverse?  Edit: The question comes from   Who can point out my mistake in the above deduction? Sometimes, I want to have enumerate lists in LaTeX start at other than the first value (1, a, i, etc.) How can I make an enumerate list start at an arbitrary value? Possible (but not serious) glitch in close/reopen I just had one of my questions closed. (Hey - it happens to everyone) When I clicked on reopen - lo and behold - it worked. I cast a reopen vote!  Is this a glitch? I know we need 4 more votes anyway but still...  And no  tag please :) “I saw a dog” vs. “I have seen a dog” I saw a dog.       I have seen a dog.   What are the differences between them? Did these events happen on the same day? javax.faces.application.ViewExpiredException: View could not be restored What is a "closed" or "duplicate" question? I have a text file abc.txt and its contents are:     /lag/cnn/org/one.txt    /lag/cnn/org/two.txt    /lag/cnn/org/three.txt   If I use:  $ tar -cvf allfiles.tar -T abc.txt   I'm getting the tar of files in the list. Similarly is it possible to copy those files in abc.txt to a folder?  I tried this:              $ cp --files-from test1.txt ./Folder   But it is not working. "They're going gorilla watching" - is there a verb at the end of the sentence? In this sentence:     They're going gorilla watching.   what's the function of the verb watching?   Is it a verb? a noun? ... maybe gorilla watching means "mirador de gorilas", in spanish?  In English, I have not seen a verb at the end of a sentece. When running sudo apt-get update I get these following errors:  Err archive.ubuntu.com quantal InRelease Err archive.ubuntu.com quantal-updates InRelease Err archive.ubuntu.com quantal-backports InRelease Err archive.ubuntu.com quantal-security InRelease Err archive.ubuntu.com quantal Release.gpg   Unable to connect to archive.ubuntu.com:http: [IP: 91.189.92.177 80] Err archive.ubuntu.com quantal-updates Release.gpg   Unable to connect to archive.ubuntu.com:http: [IP: 91.189.92.177 80] Err archive.ubuntu.com quantal-backports Release.gpg   Unable to connect to archive.ubuntu.com:http: [IP: 91.189.92.177 80] Err archive.ubuntu.com quantal-security Release.gpg   Unable to connect to archive.ubuntu.com:http: [IP: 91.189.92.177 80] Reading package lists... Done W: Failed to fetch archive.ubuntu.com/ubuntu/dists/quantal/InRelease   W: Failed to fetch archive.ubuntu.com/ubuntu/dists/quantal-updates/InRelease   W: Failed to fetch archive.ubuntu.com/ubuntu/dists/quantal-backports/InRelease   W: Failed to fetch archive.ubuntu.com/ubuntu/dists/quantal-security/InRelease   W: Failed to fetch archive.ubuntu.com/ubuntu/dists/quantal/Release.gpg  Unable to connect to archive.ubuntu.com:http: [IP: 91.189.92.177 80] W: Failed to fetch archive.ubuntu.com/ubuntu/dists/quantal-updates/Release.gpg  Unable to connect to archive.ubuntu.com:http: [IP: 91.189.92.177 80] W: Failed to fetch archive.ubuntu.com/ubuntu/dists/quantal-backports/Release.gpg  Unable to connect to archive.ubuntu.com:http: [IP: 91.189.92.177 80] W: Failed to fetch archive.ubuntu.com/ubuntu/dists/quantal-security/Release.gpg  Unable to connect to archive.ubuntu.com:http: [IP: 91.189.92.177 80] W: Some index files failed to download. They have been ignored, or old ones used instead.   I am using Ubuntu 12.04. This is the command I used after installing Ubuntu from window installer. I am sure my laptop is connected to internet. What can I do now? Exporting 2D vector graphic from ArcScene to Illustrator How can I export 2d vector graphic from ArcScene so I can edit it with Adobe Illustrator? I've tried changing the options when I export 2D scene as AI file or PDF file, but they always remain as a unique image that does not allow me to edit the lines and polygons. How is the "charge on a capacitor" defined when two plates are unequally charged? In Concepts of Physics by Dr.. H.C.Verma, in the chapter on "Capacitors", in page 144, under the topic "Capacitor and Capacitance" the following statement is given:     A combination of two conductors placed close to each other is called a capacitor. One of the conductors is given a positive charge and the other is given an equal negative charge. The conductor with the positive charge is called the positive plate and the other is called the negative plate. The charge on the positive plate is called the charge on the capacitor …   Note that the term charge on a capacitor does not mean the total charge given to the capacitor.   (Emphasis mine)  According to the above statement, "the charge on the capacitor" is the charge on the positive plate when both positive and negative plates of a capacitor are equally charged? How to extend this definition when the two plates are unequally charged?   Suppose we supply charges $+Q_1$ and $-Q_2$ to the positive and the negative plates respectively. After electrostatic conditions are attained, I determined the charge distribution on the four surfaces - outer surfaces and inner surfaces of the two plates. The charge on the outer surfaces of the two plates are equal to $\frac{Q_1-Q_2}{2}$. The magnitude of charge on the inner surface of the two plates is $\frac{Q_1+Q_2}{2}$.   Now coming to my doubt, if the "charge on the capacitor" is the charge on the positive plate, which surface of the positive plate should I want to consider - the outer one or the inner one? And what is the reason for this choice? It seems to me that, a capacitor with unequal charges on its plates is not a capacitor in the first place (inferred from the statement above). I don't know anything about Star Trek except for the fact that it's about spaceships.  In  the person only wanted to watch the TV series. I want to watch every movie and TV series there is about Star Trek but I don't know where to start. I found this page on  which is about a time line. Do I need to watch it in this order? Are the movies and TV series related?