From peterson@easyadpost.com" This is a multi-part message in MIME format --=_NextPart_2rfkindysadvnqw3nerasdf Content-Type: text/plain Content-Transfer-Encoding: quoted-printable www.EasyAdPost.com -- Promote your Products and Services on Thousands of Classified Sites. Simply the Best Way to Sell on the Internet=21=20 No time to post an ad for your business? Struggling with numerous classified sites? Seeking effective means to promote your business?=20 All of these are great reasons for you to visit EasyAdPost.com. Currently EasyAdPost.com boasts a database of 120,000+ popular classified sites, to which we will submit your classified ad quickly and effectively. We will as well submit your business site URL or Logo URL to hundreds of thousands of search engines and directories worldwide. Quickly and effectively, EasyAdPost.com will attract potentially millions of people to your business on the Internet, without any hidden cost for advertising=21 Visit Links below for More Details *********************************************** To learn the generals about EasyAdPost, view http://www.easyadpost.com To browse the sample list of classified sites, go to http://www.easyadpost.com/sample.php=20 Questions or comments? Post your Query Form to us at http://www.easyadpost.com/aboutus.php=20 *********************************************** Spend your market dollar wisely and good luck to your business=21 Peterson Slade customer=40easyadpost.com EasyAdPost.com --=_NextPart_2rfkindysadvnqw3nerasdf Content-Type: text/html Content-Transfer-Encoding: quoted-printable EasyAdPost.com =20 =20 =20
http://cider.caida.org/outreach/resources/learn/=20
=20
=20 =20 =20
=20

=20
 
=20
=20 =20
=20


EasyAdPost.com=20 --
Promote your Products and Services on=20 Thousands of Classified Sites.
Simply the Best Way to Sell on the Internet=21 =20

No=20 time to post an ad for your business?
Struggling with numerous classified sites?
Seeking effective means to promote your business?

All=20 of these are great reasons for you to visit EasyAdPost.com.=20 Currently EasyAdPost.com boasts a database of 120,000+ popular=20 classified sites, to which we will submit your classified=20 ad quickly and effectively. We will as well submit your business=20 site URL or Logo URL to hundreds of thousands of search engines=20 and directories worldwide. Quickly and effectively, EasyAdPost.com=20 will attract potentially millions of people to your business=20 on the Internet, without any hidden cost for advertising=21

Visit=20 Links below for More Details

***********************************************

To=20 learn the generals about EasyAdPost, view http://www.easyadpost.com

To browse the sample list of classified sites, go to http://www.easyadpost.com/sample.php=20

Questions=20 or comments? Post your Query Form to us at http://www.easyadpost.com/aboutus.php=20

***********************************************

Spend=20 your market dollar wisely and good luck to your business=21

Peterson=20 Slade
customer=40easyadpost.com
EasyAdPost.com

 

 
--=_NextPart_2rfkindysadvnqw3nerasdf-- From Canadian Publications" CANADIAN SUBSIDY DIRECTORY 4865 HWY 138,R.R 1 ST-ANDREWS WEST ONTARIO, KOC 2A0 PRESS RELEASE CANADIAN SUBSIDY DIRECTORY YEAR 2002 EDITION Legal Deposit-National Library of Canada ISBN 2-922870-02-2 (2002) ISBN 2-922870-01-4 (2001) Canadian Business Publications is offering to the public a revised edition of the Canadian Subsidy Directory, a guide containing more than 2800 direct and indirect financial subsidies, grants and loans offered by government departments and agencies, foundations, associations and organizations. In this new 2002 edition all programs are well described. The Canadian Subsidy Directory is the most comprehensive tool to start up a business, improve existent activities, set up a business plan, or obtain assistance from experts in fields such as: Industry, transport, agriculture, communications, municipal infrastructure, education, import-export, labor, construction and renovation, the service sector, hi-tech industries, research and development, joint ventures, arts, cinema, theatre, music and recording industry, the self employed, contests, and new talents. Assistance from and for foundations and associations, guidance to prepare a business plan, market surveys, computers, and much more! The Canadian Subsidy Directory is sold $ 49.95, to obtain a copy please call one of the following distributors: Canadian Business Resource Center: (250)381-4822, 8am-4pm pacific time. Fureteur bookstore: (450)465-5597 Fax (450)465-8144 (credit card orders only.) Canadian Publications: 819-322-3376 From puhuri@netlab.hut.fi Wed Nov 20 14:20:37 2002 From: puhuri@netlab.hut.fi (Markus Peuhkuri) Date: Wed, 20 Nov 2002 16:20:37 +0200 (EET) Subject: [Coral-dev] Sequence number arithmetic in perl Message-ID: <15835.39477.311628.114973@keskus.tct.hut.fi> Has anyone routines to do sequence number arithmetic in perl? It is trivial in C, but perl uses signed integers when "use integer" is used. I could not find routines from libcoral. -- Markus Peuhkuri ! internet: Markus.Peuhkuri@hut.fi HUT/Networking Lab. ! http://www.iki.fi/puhuri/ P.O.Box 3000, 02015 HUT! tel: +358-9-451 2467 fax: +358-9-451 2474 Finland, EUROPE ! gsm: +358-40-50 19683 From dmoore@caida.org Wed Nov 20 16:12:19 2002 From: dmoore@caida.org (David Moore) Date: Wed, 20 Nov 2002 08:12:19 -0800 Subject: [Coral-dev] Sequence number arithmetic in perl In-Reply-To: <15835.39477.311628.114973@keskus.tct.hut.fi> References: <15835.39477.311628.114973@keskus.tct.hut.fi> Message-ID: <20021120081219.M4210@login.caida.org> On Wed, Nov 20, 2002 at 04:20:37PM +0200, Markus Peuhkuri wrote: > Has anyone routines to do sequence number arithmetic in perl? It is > trivial in C, but perl uses signed integers when "use integer" is > used. > > I could not find routines from libcoral. Why are you using `use integer'? performance? -- david From puhuri@netlab.hut.fi Wed Nov 20 18:03:59 2002 From: puhuri@netlab.hut.fi (Markus Peuhkuri) Date: Wed, 20 Nov 2002 20:03:59 +0200 (EET) Subject: [Coral-dev] Sequence number arithmetic in perl In-Reply-To: <20021120081219.M4210@login.caida.org> References: <15835.39477.311628.114973@keskus.tct.hut.fi> <20021120081219.M4210@login.caida.org> Message-ID: <15835.52879.878156.425183@keskus.tct.hut.fi> David Moore writes: > Why are you using `use integer'? performance? Performance is not an issue as this is just proof-of-concept trial. I'm not sure about this, but based on perl docs perl uses signed ints, and if the number is larger than 2**31-1, it gets "promoted" to float. Actually, if I have code like: my $tcp_up = new Unpacker("tcp", [ "th_sport", "th_dport", "th_seq", "th_ack", "th_off", "th_flags" ]); ... my($th_sport, $th_dport, $th_seq, $th_ack, $th_off, $th_flags) = $tcp_up->unpack($ip_record, $ip_hl * 4); then $th_seq, $th_ack are *negative* values (if they are larger than 2**31-1). What i'm looking for is perl-routines for int before(u32 seq1, u32 seq2); int after(u32 seq1, u32 seq2); /* is s2<=s1<=s3 ? */ int between(u32 seq1, u32 seq2, u32 seq3) int difference(u32 seq1, u32 seq2); -- Markus Peuhkuri ! internet: Markus.Peuhkuri@hut.fi HUT/Networking Lab. ! http://www.iki.fi/puhuri/ P.O.Box 3000, 02015 HUT! tel: +358-9-451 2467 fax: +358-9-451 2474 Finland, EUROPE ! gsm: +358-40-50 19683 From dmoore@caida.org Wed Nov 20 21:11:56 2002 From: dmoore@caida.org (David Moore) Date: Wed, 20 Nov 2002 13:11:56 -0800 Subject: [Coral-dev] Sequence number arithmetic in perl In-Reply-To: <15835.52879.878156.425183@keskus.tct.hut.fi> References: <15835.39477.311628.114973@keskus.tct.hut.fi> <20021120081219.M4210@login.caida.org> <15835.52879.878156.425183@keskus.tct.hut.fi> Message-ID: <20021120131155.O4210@login.caida.org> On Wed, Nov 20, 2002 at 08:03:59PM +0200, Markus Peuhkuri wrote: > David Moore writes: > > Why are you using `use integer'? performance? > > Performance is not an issue as this is just proof-of-concept trial. > I'm not sure about this, but based on perl docs perl uses signed ints, > and if the number is larger than 2**31-1, it gets "promoted" to float. > > Actually, if I have code like: > my $tcp_up = new Unpacker("tcp", [ "th_sport", "th_dport", "th_seq", > "th_ack", "th_off", "th_flags" ]); > ... > my($th_sport, $th_dport, $th_seq, $th_ack, $th_off, $th_flags) > = $tcp_up->unpack($ip_record, $ip_hl * 4); > > then $th_seq, $th_ack are *negative* values (if they are larger than > 2**31-1). Oh, we should have made th_seq (and th_ack) unsigned. probably easiest thing to do is: my($th_sport, $th_dport, $th_seq, $th_ack, $th_off, $th_flags) = $tcp_up->unpack($ip_record, $ip_hl * 4); if ($th_seq < 0) { $th_seq += 2**32; } if ($th_ack < 0) { $th_ack += 2**32; } The double representation used holds more than 32 bits of precision, so this is fine to do. Then you can just do the comparisons you want. Although you still have to be careful about when sequence numbers actually wrap, which is why there is no generic way to provide the perl-routines you want. ie, seq#100 is the expected next number after seq#4294965936 with 1500 byte MTU. > What i'm looking for is perl-routines for > int before(u32 seq1, u32 seq2); > int after(u32 seq1, u32 seq2); > /* is s2<=s1<=s3 ? */ > int between(u32 seq1, u32 seq2, u32 seq3) > int difference(u32 seq1, u32 seq2); From rapier@psc.edu Mon Nov 25 19:50:50 2002 From: rapier@psc.edu (Chris Rapier) Date: Mon, 25 Nov 2002 14:50:50 -0500 Subject: [Coral-dev] crl_to_pcap and snaplen Message-ID: <3DE27F1A.4020800@psc.edu> I've been trying to get the latest revision of coralreef to only capture the 1st 48 bytes of each packet on a live pcap interface. I thought I would use something like -C'm=48' or 'iomode=\!user' and various combinations but I still seem to be capturing payload data as well. Is there a way to do this on a live pcap interface (SysKonnect GigE card) or should I just resort to tcpdump? From coral-info@caida.org Mon Nov 25 21:07:51 2002 From: coral-info@caida.org (Ken Keys) Date: Mon, 25 Nov 2002 13:07:51 -0800 Subject: [Coral-dev] crl_to_pcap and snaplen In-Reply-To: <3DE27F1A.4020800@psc.edu> References: <3DE27F1A.4020800@psc.edu> Message-ID: <20021125130751.L1109@login.caida.org> On Mon, Nov 25, 2002 at 02:50:50PM -0500, Chris Rapier wrote: > I've been trying to get the latest revision of coralreef to only capture the > 1st 48 bytes of each packet on a live pcap interface. I thought I would use > something like -C'm=48' or 'iomode=\!user' and various combinations but I > still seem to be capturing payload data as well. Is there a way to do this > on a live pcap interface (SysKonnect GigE card) or should I just resort to > tcpdump? The -Cm=48 should work as expected on live pcap interfaces, capturing only the first 48 bytes of each packet. But you probably want 54 for TCP (14 byte ethernet header + 20 byte IP header + 20 byte TCP header) or 42 for UDP, not 48. (You see 48 in our docs a lot because it is the size of an ATM cell and it's sufficient to hold an 8 byte RFC 1483 LLC/SNAP header + IP header + TCP header, but that's not relevant here). If you just want to capture to a file (as opposed to running a CoralReef analysis app in realtime), tcpdump is just as good as crl_to_pcap. -- Ken Keys kkeys@caida.org CoralReef: http://www.caida.org/tools/measurement/coralreef/ From rapier@psc.edu Mon Nov 25 21:34:18 2002 From: rapier@psc.edu (Chris Rapier) Date: Mon, 25 Nov 2002 16:34:18 -0500 Subject: [Coral-dev] crl_to_pcap and snaplen References: <3DE27F1A.4020800@psc.edu> <20021125130751.L1109@login.caida.org> Message-ID: <3DE2975A.7090907@psc.edu> Ken Keys wrote: > On Mon, Nov 25, 2002 at 02:50:50PM -0500, Chris Rapier wrote: > >>I've been trying to get the latest revision of coralreef to only capture the >>1st 48 bytes of each packet on a live pcap interface. I thought I would use >>something like -C'm=48' or 'iomode=\!user' and various combinations but I >>still seem to be capturing payload data as well. Is there a way to do this >>on a live pcap interface (SysKonnect GigE card) or should I just resort to >>tcpdump? > > > The -Cm=48 should work as expected on live pcap interfaces, capturing > only the first 48 bytes of each packet. nope, not working. /usr/local/Coral/bin/crl_to_pcap -C'duration=5' -Cm=48 -r -o foo if:sk0 If I then run strings against foo I see html headers, bits of email, and so forth - which leads me to believe that far more that the first 48 bytes are being snagged. > for TCP (14 byte ethernet header + 20 byte IP header + 20 byte TCP > header) or 42 for UDP, not 48. 48 was a just a number I pulled out of the air. > If you just want to capture to a file (as opposed to running a CoralReef > analysis app in realtime), tcpdump is just as good as crl_to_pcap. Capturing to a file was simply for testing purposes. it will eventually be shunted to another application but only if I can resolve this issue. From coral-info@caida.org Mon Nov 25 23:26:05 2002 From: coral-info@caida.org (Ken Keys) Date: Mon, 25 Nov 2002 15:26:05 -0800 Subject: [Coral-dev] crl_to_pcap and snaplen In-Reply-To: <3DE2975A.7090907@psc.edu> References: <3DE27F1A.4020800@psc.edu> <20021125130751.L1109@login.caida.org> <3DE2975A.7090907@psc.edu> Message-ID: <20021125152605.M1109@login.caida.org> On Mon, Nov 25, 2002 at 04:34:18PM -0500, Chris Rapier wrote: > > Ken Keys wrote: > >On Mon, Nov 25, 2002 at 02:50:50PM -0500, Chris Rapier wrote: > > > >>I've been trying to get the latest revision of coralreef to only capture > >>the 1st 48 bytes of each packet on a live pcap interface. I thought I > >>would use something like -C'm=48' or 'iomode=\!user' and various > >>combinations but I still seem to be capturing payload data as well. Is > >>there a way to do this on a live pcap interface (SysKonnect GigE card) or > >>should I just resort to tcpdump? > > > > > >The -Cm=48 should work as expected on live pcap interfaces, capturing > >only the first 48 bytes of each packet. > > nope, not working. > /usr/local/Coral/bin/crl_to_pcap -C'duration=5' -Cm=48 -r -o foo if:sk0 > > If I then run strings against foo I see html headers, bits of email, and so > forth - which leads me to believe that far more that the first 48 bytes are > being snagged. Ok, I've found the problem; the workaround is to supply a bpf filter (e.g., "-C'filter ip'"; or if you really want everything, use a filter that matches everything, e.g. "-C'filter ip or !ip'"). Explanation: snaplen truncation is done by the code that applies the bpf filter, not by the libpcap code that reads packets. The reason tcpdump works without a filter but coral does not is that even when you don't give tcpdump a filter it still effectively applies an empty filter, whereas coral does not apply any filter at all. -- Ken Keys kkeys@caida.org CoralReef: http://www.caida.org/tools/measurement/coralreef/