Given this network and we have a firewall on router RA, we want to stop computer 12 from accessing the web servers on network 3330. So we want to write a firewall rule on router RA that will prevent that. What do we do? What's the answer? Find the answer now. Try and write the rule looking at those five criteria of the addresses and the protocol number. So the IP and port number addresses, block computer 12 from accessing web servers on network 3. And we're always assuming at this stage, we'll change it shortly, the default policy of the firewall is to accept, which usually means we need to write rules to drop something. So except everything creates some rules to drop the things that we want to drop and stop computer 12 from accessing the web service. So the source IP, destination IP, protocol and the port numbers we need to consider. And we'll take some action. What should the source IP be? Right, we're trying to stop computer 12 from accessing the web service. So the source IP should be that of computer 12, so that we don't stop computer 11, for example. Destination IP, we want to stop computer 12 from accessing the web service on network 3. Right, we can use a network address there. Usually the firewall will allow different structures of the address. So for example, I'll write <IP_ADDRESS> and to be precise, slash 24, meeting any IP address that starts with 3.3.3 in this case. The subnet mask of slash 24 indicates that those first three numbers must match. Protocol, web browsing uses TCP. So let's do a number 6, source port. What should the source port be? Don't care, any value. That is, my web browser today may be use one port number, but tomorrow use a different port number. So when we set up the firewall, we don't have to specify the exact port number of the web browser because it changes. We cannot add all of them. So any value in this case, destination port. The web servers should be listening on port 80. Action, so we set a number of conditions. The source addresses, the protocol number are the conditions. And if those conditions match for a packet that comes to the firewall, we take some action. So it's not so hard to write the rules for different examples of security policies. So consider our aim, write the rules that we've tried to implement that aim. Any questions so far on firewall rules? The syntax we're using is just a general syntax to simplify how to specify the addresses. Particular firewall software or devices may have their own syntax. There may not be a star, it may be some other character or some other representation. It depends upon the software that you're using. Until now we've considered the default policy of accept. Now let's consider some examples where the default policy is drop, which is the recommended policy. If anyone needs some more pictures, there are a few here but I think we only have one or two networks remaining or examples. Let's try a different case. Let's say the default policy is to drop all packets at our router. And our internal network, we have a web server on computer 12 that we want to allow people outside to access. So this is my internal network, I have a public web server here. So I've set up my website on computer 12 and everyone outside should be able to access that website. But they shouldn't be able to access any other computers internal on this network one. In particular computer 11, people outside shouldn't be able to access that. And to keep things simple, let's say that no one inside needs to access services outside. So the purpose of this network with respect to communications with the external entities is that those outside can access the website on computer 12. Try to create a rule that will do that. People outside can access the website, nothing else can happen. And while you're thinking of that, I'll change the way that I write the rules because I run out of space. I'll just think of the rules as a table. That is, if we go back to our previous examples, if I can find them, this was one example that we did. We allowed secure shell. We can think there are a number of columns in each rule. There's a source IP, destination IP, protocol, source port, destination port. So five different values there and then action. That was one rule. That was to allow, actually that was to block secure shell. And then we had another rule we just created to allow web browsing, to drop access to the web service on computer network 3. So our firewall table will have multiple rules. We have two examples here and we can think the firewall table or the firewall maintains the rules in a table form. That's one way to think of it as a data structure. So every rule is a row in the table which specifies a set of conditions like the addresses, the protocol number, the ports and an action. And we build up our rules depending upon the things that we want to implement. So so far we have two rules in our table and we think there are two rows in the table. And when a packet comes into the firewall it checks that packet against all the rules in the table. And if none of those rules match it takes the default action. So in the next example I'll write it instead of just as a line like this as a table, almost the same. So returning to the goal of default policy as drop, we want to allow people outside to access the web server on computer 12. Try to write the rule to do that. Think of it as a table which we have the source and destination, both IP address and port, source and the protocol number and the action that we take. What can we do to allow people to access the website? Computer 12. Computer 12 is running a web server. Let's allow people outside to access that web server but nothing else internally. What should the source be? What should our source address be in this case? Anyone. So we're thinking about allowing anyone outside to access the web server on computer 12. So the source can be from anyone. So star for the source, source IP, source port number. Again a web browser who's the client that is the initial source may use any port number. Not any but we do not know the specific port number. So the source will be any. Destination should be the computer 12. So let's write that and I'll write it in a slightly condensed form. The source is the IP address and I'll write both the IP and port number together. The IP address, the colon character and then the port number. And for the destination the IP address is 11112 and the port number. Destination port should be web server listens on port 80. Just slightly different notation when I specify the IP address and the port number together. Web browsing uses what transport protocol? TCP number six. We could write TCP or six. Usually the firewall will allow you to specify say TCP and then automatically map to number six. And what action should we take if those conditions match? Here we're using a default policy of drop so the action here should be accept. I'll just note down here for the firewall the default action we've set to be drop. So this is the opposite. Drop everything except what we specify in the rules. Any questions on this rule? Does it work? No, it doesn't work. Find out what's wrong with it. It is that rule works but I think our aim of allowing our external users to access the website is not going to work. Let's see what happens when someone tries to access that website. Let's say, and I'll just make some space. Let's give a specific case where computer 35, for example, wants to access the website. So this will be the source and the source IP will be <IP_ADDRESS> and the source port will be what? Whatever the operating system gives to the web browser. So let's give it a number. Let's say the source port, just choose a random port number that's given to the browser when the browser tries to connect to the web server. It's given by the operating system on that computer. So the source IP is <IP_ADDRESS>, source port 50123, protocols number 6. It's using TCP. What happens is it sends a packet, destination address. It's trying to contact the web server, computer 12, destination 11112, destination port is 80. We're using web browsing. The packet gets to the firewall router RA and we check that packet against the conditions. Source, anything, okay, this matches. Source port, anything, okay, 50123 matches. Destination address, 11112, yes, it was to there, that matches. Destination port, 80 matches. Protocol matches, so yes, it matches. And we accept the packet through router RA. The packet goes on to computer 12. What happens next? Web web browsing, we've sent a request to the web server for a web page. What happens next with web browsing? The web server needs to send back the web page. Web browsing involves sending a request for a web page and the server sending back a reply. What happens with the reply? Source is computer 12. Source port is 80. Destination is computer 33335. Destination port is 50123. That packet, the response packet gets to the firewall. The firewall checks the rules and it will not match that rule because the destination of this packet is 35. So it doesn't match the first rule, so it takes the default action of dropping that packet. So we have the problem that we haven't considered the response. And most protocols, most applications we use have a request and a response. So we allowed the request in but haven't allowed the response back. How do we fix that? Add a new rule, add a second rule to accept the response. Try. So add a second rule in this case. When we use the default policy of accept, it worked okay because we just dropped the first packet and that blocks the application. But now we have a default policy of drop, we need to accept the packets in both directions. The request coming in and the response coming out. So we need two rules in this case. So when you, the administrator set up the firewall, you would add the second rule. The response coming from computer 12, the web server to someone outside, the source. What's the source address? The web server. Good. And port 80. This is the response. So the web server, when it sends a packet, the source port is 80. It's coming from the web server. Destination. What's the destination in this rule? It's not <IP_ADDRESS>. In this instance, yes, we would need the destination to be that. But what if the next time computer 36 wants to access our website, then we would need a specific rule for that one. And what if computer 2 on the network 2 does it? So it needs to be any in the destination. Note that when we set up these rules, it's like when we build the network and turn on the firewall, we add these rules and they should be static. That is, we shouldn't have to change them every second. We usually set them up and maybe for days or weeks they remain the same. This setting the rules is the job of a administrator. So the destination should be really the same as the source of the first rule because it may come from computer 35 and we may need to send back to computer 35 with port 50123 or we may need to send back to computer 36 with a different port number. So we need to allow any value. It's still using TCP and we should accept that. Now we should accept packets in both directions. The request that comes in and the response that comes back. The goal was to allow external people to access the website on computer 12. They won't be able to access anything on computer 11 because if someone sends in destination computer 11, it's not going to match the first rule. What about the second rule? Will it match? Computer 35 sends to computer 11. It doesn't match the first rule because the destination is computer 12. Does it match the second rule? No, because it's coming from source computer 35. It's not computer 12. So therefore the default action if you send to computer 11 will be to drop. So that's our intention that no one can contact computer 11. So that works. But maybe there's a problem. Anyone see a problem with this? What if we have a malicious user outside? Computer 36 is trying to access computer 11 or send a packet to computer 11. Our policy is that they shouldn't be able to. What if we set a fake source address? Computer 36 changes its source address. So when it sends a packet, it sets a fake source address. Can we bypass the firewall? That is, can we get our packet accepted? Remember when a computer sends a packet, the computer generates that packet and sets the values in the IP header and the TCP header. So in theory, the computer can set the values to whatever they like. The normal behavior is it's set to your IP address and the port number given to you. But as we saw with the denial of service attacks, setting fake source addresses is actually quite easy. Your homework task involves doing that. So it's possible for a computer with the IP address <IP_ADDRESS> to send a packet with a different source address than the one it actually has. So how could computer 36 defeat our security policy? Any suggestions? What about if we do use a fake source address on computer 36 and we set the source to be, I can squeeze it in here, <IP_ADDRESS>. So it sends a packet, but before it sends that packet, it sets the source address to this <IP_ADDRESS> and the source port set to what? So the malicious user on computer 36 creates their own special application with the intent of getting a packet to computer 11. If they can, then we've defeated our goal of the firewall. We said the firewall should be set up so that no one can contact computer 11. Again, the same as that you can set a fake source address, the computer has control of the port numbers that it uses. Normally, you create an application and the operating system will assign a port number within a range to that. You have no control, but in game it's possible, it's very easy, to specify a selected port number. So computer 36 can run an application and set the source port to anything they like. What would they set it to?  What would you set the source port to? Not any. Yes, it will be a value. What specific value should you set it to to get through the firewall? 80. Let's try. So we create a packet. Normally, 80 is reserved for web servers. But again, it's our computer we can use whatever port we like. So the default is for web servers, but the person who sends the packet can set the value to whatever they like. So we set the source address to 11112, the source port to 80. Destination, let's send to computer 11 using TCP. Destination port, whatever. Whatever I choose. We send the packet. It gets to the firewall. So the firewall sees the packet. Source address is 11112. Source port is 80. It matches this condition on the second rule. It also matches this one. The destination address is 11111. It doesn't match the first rule, but it does match the second rule. Destination can be anything. Well, 11111, is it any value? Destination port, whatever we chose from the malicious user, it could have been any port number that we wanted. It will match. The protocol we're using is TCP. So this protocol number six matches. So the firewall accepts that packet in. The packet comes in and is sent to computer 11. It defeated our intention of the firewalls to block people from contacting computer 11. So we need to be careful with the rules. But it's not so obvious in some... Well, it's not so easy to implement what sounds like a simple aim. Blocking people from accessing computer 11. Any questions on this limitation of our firewall so far? We created two rules to first allow the requests to come in to computer 12, port 80, and then allow computer 12 to port 80 to reply to send the response out. But that rule we created, the second one left a hole in our firewall such that if someone used a fake source address, they could still get through the firewall, which we don't want to happen. How could we fix that? We can fix it in the firewall or have the router do something special. What are some suggestions to stopping this malicious node from contacting computer 11? Assuming we can't stop computer 36 from setting a fake source address. They can do what they like. What could we do? Set another rule. What other conditions could we do? So far we've looked at just the addresses, the source and destination IP and port and the protocol number. But in fact, another thing that we can look at, if we look at the slides that maybe IP addresses, port numbers, protocol numbers, the direction or the interface can be used. That is, our firewall, which is running on a router, has two interfaces in our example. The one connected to the internal network and the one connected to the external network. So we can use that information as well in our conditions. We can specify rules that apply to specific interfaces. And we can use that to really implement direction. If it's packets coming from one direction do one thing, if it's coming from a different direction do something else. So we could do that. And I don't know if I can fit it in, but I can say what we wanted is if the packet was going out from computer 12, allow it. But if it's coming in from computer 12, don't allow it. So we could add another condition here. Where will I squeeze it in? Maybe here. INT for interface. Router, I think we have two interfaces. The internal and the external are the one that goes out or from outside. Actually, maybe we should rename them just external. The router has an interface for an internal and an external interface. For example, on a Linux operating system it could be ETH0 and ETH1. So in our firewall rule, if the first packet arrives on the external interface going to the web server, accept it. If the second packet arrives on the internal interface, coming from the web server, accept it. If the packet is coming and arrives on the external interface, it's coming from outside, coming in, then the second rule will no longer match and that packet will be dropped. So by specifying something about the direction we can overcome this problem of this fake address being used.  And we can make use of the interface conditions to check the direction of that packet. So sometimes it's specified by the interface or more generally the direction. If it's going out, allow it. If it's coming in, don't allow it. So even to do a simple thing like allow someone to access my website, we need two rules and we need to be careful about the interface as the directions as well. In means just, maybe I should have used a different label, it means that the name of this interface, the internal interface, in for internal. I didn't want to use int for interface. So maybe a better name would be eth0. It depends upon the operating system. So if you're using Linux, eth0, maybe the name of the interface and this may be eth1. You can specify the specific interface name there. Or you can think of it more generally as going out versus coming in. So that should achieve our aim. People can access our website on computer 12, but they cannot contact computer 11. Now, let's say I want to allow some other things to happen. I want to allow not just contacting the website or the web server on port 80, most websites support HTTBS. And we'll cover that in a later topic, but HTTBS is similar to HTTP, but one thing that differs is that a web server that supports HTTBS uses port 443. It uses a different port number on the server. So if we wanted to allow both normal HTTP and the secure version, HTTBS, we'd need another two rules specifically for port 443. And for every other service that we need to allow people to access, say a secure shell server on a particular computer internally, an email server, we'd need at least two rules to support the request coming in and the response coming out. And it can get quite complicated. That is the rules that you need to enter into the table can, of course, become quite long. And it's easy to make a mistake. And if we make a mistake, like not specifying the interface, it opens up a hole in our security. So some extensions of normal packet filtering firewalls is what we call stateful packet inspection, which tries to make it a little bit easier for us to specify the rules to capture this behavior of allowing someone to contact the server and allowing the response to come back. So in this case we added a second rule to allow the response to come back. And basically for every application we'd need to have two rules, one to allow the request in and one for the response back. But that gets tiresome to do that for every application. So what stateful packet inspection tries to achieve is to make that automatic. We create one rule to allow the packet to come in and then the firewall has some special features that will, if a packet comes in, it will allow the packet to go out automatically and any subsequent packets to be passed through. So we'll explain that concept next. Sorry. Right. In this case, we created both rules, one to let the packet in and the corresponding one to let the response out. What stateful packet inspection will allow us to do is we create one rule to let the packet in then the firewall automatically allows all subsequent packets related to that packet that came in to go through the firewall. So basically we will just have to create the one rule and the firewall will automatically handle the subsequent rule, the next rule. And that can be achieved mainly because of the fact that most applications use a request-response type communications and in particular use TCP. And in TCP, before we exchange data, we set up a connection. So let's just have a look at TCP behavior to see how we can use that. What can we draw? So we've talked generally about packet filtering firewalls. We'll come back to some examples later and the advantages and disadvantages. Now we're going to talk about stateful packet inspection, SPI for short, and explain how that works. And we'll do it via examples. First, how does TCP work? TCP, I know some of you are studying it in a course right now. Does anyone, or maybe you haven't got to the point of how to establish a connection. TCP as a transport protocol is a connection-oriented protocol.  So let's just briefly draw that. The idea is that we have some client and some server and what happens in terms of the exchange of messages between client and server over time, the client initiates communications. So the client is the one that sends the first message. And they send a message to the server with TCP. Those that are studying TCP, no need to draw this, you'll be experts on this from your other courses. So this is just the basic concepts of TCP. The details are not so important, it's just to set up how SPI works. With TCP, before we send any data between client and server, we establish a connection. We agree upon some initial values that we're going to use and really inform the other side. Let's transfer some data. And the normal way to establish a connection is the client sends a special packet to the server. It's called a synchronized packet. We abbreviate that to SIN. SIN for synchronized. It's about synchronizing some sequence numbers, but that doesn't really matter with respect to the firewall. We just call it a SIN packet. The server realizes, okay, the client's about to set up a connection with me. So the server we can think was in some state. It was initially, let's say, doing nothing, it was maybe idle. So think of the server goes through a set of states with respect to TCP. It's initially idle, doing nothing, just waiting for someone to connect. Then when they send a SIN segment, we say it's in some state. Let's say the SIN received. I'll just give it a name. That is, we're in the state of the server that we've just received a SIN, a synchronized message. And that tells us that let's allocate some memory for this upcoming data transfer. And let's send back, in the TCP 3-ray handshake, send back a acknowledgement. What's the name of the acknowledgement? It's actually an ACK saying thank you for the SIN and it's also a SIN saying I want to synchronize my values. So we call it a SIN ACK. When the client receives that, the client should send back one last message to establish this connection. What's it called? A final ACK. This is saying thank you for your SIN message. So it happens in both directions. SIN ACK, SIN ACK. It's just that the middle message combines the synchronize and the ACK into one. And from the service perspective it's received the first SIN message and now it's waiting for the ACK. When it receives that ACK what can we say about the connection? Is it set up? Yes, this is the step to set up the connection. So we say once we receive the ACK everything's okay and we say the connection is established. The idea of this was to set up or establish a connection. The server initially is idle. When it receives a SIN it goes into a special state of the SIN is received I'm now waiting for an ACK and once it gets that ACK everything's ready to transfer data so we say the connection is established. And then the client and server can start sending data. So in either direction usually from the client to the server for example with HTTP if this is our web browser and this is our web server they establish a connection first and then send the data as a HTTP request and eventually get a HTTP response. There may be an ACK in there as well, a TCP ACK. But the point is that the server goes through some states idle, nothing's happening receive a SIN and then eventually when we receive that ACK we can say our connection is established and once the connection is established we expect to get data messages we expect to receive and send and in fact eventually there's a to close the connection there's some special messages to say stop and it's called a FIN message connection. We'll not draw that. We can take advantage of this in our firewall to say that if we accept a client trying to connect to our server if we have a rule that says this client can contact our server because we want them to access our server we'll write one rule to allow them to accept the first packet and the second packet automatically maintains information such that all subsequent packets of setting up the connection and then once the connection is established of the data packets they're all automatically accepted we don't need rules to accept those subsequent packets that makes it easier for the firewall administrator they only need to create one rule not rules for the responses and the firewall now is create a rule to allow the SIN packet we specify who the source is the destination the same as we created our previous rules once that SIN packet is received the firewall will automatically keep track okay I've received a SIN packet if I next receive an act packet from the same client with the appropriate sequence numbers then I'll automatically allow that through the firewall and if I'm in the established state anyone who is sending a data packet to me or going out through the firewall it will automatically accept those packets let's see how that works in in our example network any questions on first the TCP connection establishment procedure you don't really need to know why it's SIN SINAC act not in this course but just be aware that it's these three messages to establish a connection and then data can flow in either direction so stateful packet inspection let's try and create a firewall rule that will handle our previous case of allowing everyone outside to access our web server on computer 12 we'll do that again find my network same as before anyone outside should be able to access the web server on computer 12 so we can think with respect to the firewall when we're using stateful packet inspection we have two sets of data the firewall rules and something that keeps track of the connections let's create the firewall rule first we'll draw it again there's a few more left over sheets so grab one the last one's there you should only I think this will be the last example in half if there's not enough tear it in half same as before we have a firewall rule source, destination protocol action I will not list the interface we should have the interface here as well but we will not need that in this case we could have it to be precise actually we'll have space so let's include it interface I'll call the interface IF instead of INT and we'll talk about again what do we call this is the external interface and this is the internal interface INT not the input the internal so our firewall rule will create a rule that allows the request to come in or allows specifically the sin message to come in source we said was anyone from any port and the destination was computer 12 port 80 our web server coming from the external interface that is coming in protocol 6 so this is the same as before we should accept still as before our default policy is drop so we create that initial rule we want to allow people from outside to contact our web server the interface that this packet arrives on should be the external interface it gets the firewall from this interface we'll accept it if for some reason it came from the internal interface this rule would not match now with a stateful packet inspection enabled we don't need to add the second rule SPI we handles the second case automatically and the way that it works is we can think there's a second table SPI for stateful packet inspection has its own table not of rules but of recently accepted connections and we can say that inside that table there'll be a source a destination protocol number and a state so this is a second table of information called the SPI table there are two different tables in the firewall now one is a table of rules that we created and the second is a table of connections that is going to be automatically maintained by the firewall the administrator doesn't have to update the second table to create rules in the first table and the way that the second SPI table is updated is that when a SIN packet is accepted so again computer 35 sends a packet to computer 12 let's see what happens the example we're considering is computer 35 let's say has a source port of 50123 and that's going to contact the web server or attempt to contact the web server it should be allowed source port 50123 source address is that of computer 35 it creates a packet and sends it to computer 12 web server port 80 so the packet will come to the router RA on the external interface the firewall will check that packet source address matches any value matches destination it's going to computer 12 port 80 matches it's coming from the external interface that matches it's TCP it's protocol number 6 that matches so the firewall rule says accept this packet this is the SIN packet in our connection setup remember the first packet of TCP is this SIN packet coming in so what happens now is that we add a row to the or add an entry to the SPI table that keeps track of those recent connections let's say the source was specifically 33 3 35 port number 50123 destination was 11112 port 80 protocol is 6 and we store also the state of our TCP connection at the server or the expected state and remember after receiving the SIN the first SIN packet we said the state is SIN received so the state here initially is SIN received this is the this is let's come back to that TCP handshake diagram and maybe we'll add a new one to be clear so the state of the TCP connection at the start it's idle then we receive a SIN so we say the state is SIN received from the client's perspective after receiving the SIN act let's call it SIN act received SIN act looking from the perspective of the TCP connection it goes through some states first it's idle there's no connection no attempt to establish the SIN goes through and we move into the state the SIN has been received by the server when the server sends back the SIN act eventually that SIN act has been received and when finally the act comes back the connection is established so in our firewall when that first packet goes through the firewall the firewall adds data to the SPI table saying ok I've just received the first packet the rule said accept it so I accepted that first packet and let's record who sent it in our example it was 33336 port 502 50123 and who they sent it to our computer 12 port 80 and let's say that the state is now SIN received now the next packet that the firewall sees should be a SIN act so let's go back to our firewall so currently we're in the state SIN is received with respect to this connection the SIN was received so we have an entry to our SPI table saying a SIN has been received for these pairs of computers what happens next in terms of packets being sent computer 12 sends the SIN act the next packet the SIN act coming from computer 12 it gets to the firewall does the rule accept it well in fact with SPI we don't check the rules first we check the SPI table that is when the packet comes in to the firewall source is computer 12 destination computer 35 this is a SIN act packet what the firewall does now is it checks its entries in the SPI table and it knows that there should be a SIN act between computer 12 and computer 35 because I just recorded a moment ago a SIN packet and that information is stored in this entry any questions so far this is getting more complex but it's a key part how firewalls work today so again the SIN act is coming from computer 12 going to computer 35 it gets to the firewall the firewall doesn't check the rules it first checks what's in its SPI table and it sees that I previously saw a message between 35 and 12 which was a SIN message and I recorded that by saying the state was SIN received so I expect computer 12 to be sending to computer 35 a SIN act and I should accept that because it's part of the connection establishment procedure so this entry in the SPI table tells the firewall to automatically accept the SIN act to come back be careful here with the source and destination let's list who the source and destination are of this SIN act packet we run out of space squeeze it in at the top the SIN act packet the one that was sent by computer 12 port 80 sent to computer 35 port 50123 so that the address information it's also TCP so the source is 12 port 80 the destination is computer 35 port 50123 this is the SIN act packet accepted when the firewall receives that this entry in the SPI table says accept it because that's the normal behavior with TCP if we have received a SIN packet from these pair of computers then when we receive a SIN act in the opposite direction we should accept it because we need that to set up the connection but be careful that the SPI table this is the original source of the SIN packet 333 35 and the destination of the SIN packet the SIN act the addresses have swapped it's the one coming back it still matches this row with the SPI table we just look at the pairs of addresses the type of packet determines the ordering expected questions before we finish this part I don't know this is the information the firewall stores you can think the firewall has seen a SIN being passed through it the very first message accepted by this rule was the SIN packet and when I say the state SIN received it's not really it's been received by the firewall and sent on to the server so from the firewall's perspective after that SIN packet passes through it thinks okay I've received a SIN so the next thing expected from the firewall is I should receive a SIN act in the opposite direction I received a SIN coming from 35 to 12 therefore if the next packet is a SIN act from computer 12 to computer 35 then I will automatically accept it right because the way of TCP is the thing expected after the SIN received should be a SIN act in the opposite direction and the packet the SIN act is from 12 to 35 the port numbers match therefore the firewall automatically accepts the SIN act coming back when the SIN act passes through the firewall the firewall changes the state changes the state to what to SIN act received in TCP the SIN is the first message coming from client to server and the SIN act is the first reply yes coming from server back to client so this state will change I'll just cross it out it will become SIN act received because that SIN act has now passed through the firewall it automatically accepted the firewall doesn't check these conditions if there's a match in the SPI table the SIN act comes out to computer 35 what happens next remember TCP 3-way handshake SIN SIN act AC so the next packet computer 35 will send an act to computer 12 and the details of that AC it's from computer 35 port 50123 in the connection we use the same port numbers for each packet going to computer 12 port 80 and this packet arrives at the firewall and the firewall checks okay I previously saw a SIN act going from 12 to 35 now I see an AC going from 35 to 12 let's accept it because that is expected because we expect to see SIN SIN act AC so this entry tells the firewall to automatically accept the AC message what happens next when the AC is accepted what state are we in established so this state is changed to established when the AC passes through the firewall the AC will be received by the server actually established here and in the established state any data packet that goes in either direction is accepted if for example there's data packets from computer 12 to and you don't need to write this one should be obvious we'll see if there's data from computer 12 with port 80 to computer 35 with port 50123 this SPI entry says automatically accept that no need to check the firewall rules because we know that there's a connection established between those two computers any data now should be automatically accepted and similar in the opposite direction if it's going from 35 to 12 if the packet sees a data packet in this direction then again this entry in the SPI table says automatically accepted once the connection is recorded as established data packets going in either direction are accepted by the firewall without checking the rules and this is done automatically that is the firewall has some software that once the administrator has added this rule and has set up SPI stateful packet inspection the firewall automatically when it gets the SIN message and it's accepted by this rule it automatically maintains this state for the connection and updates it as it sees the SIN and the AC and as it receives the data and at some stage the connection may be closed and there may be a FIN message saying finish this connection let's close the connection no more data to come and at that point the state will be changed to finished and eventually this information will be deleted because once the connection is closed the firewall should not accept any more packets automatically from those pairs of computers because it shouldn't be expected so the firewall automatically keeps track of the TCP connection and automatically accepts anything that was specified by our rule by the administrator on the TCP you either explicitly close the connection send a FIN message but maybe if you don't do that the firewall will probably have some time out value here after two minutes let's remove this data if there's been no packet sent between these pair of computers let's assume the connection's been closed let's remove this entry so the next packet that comes in will not match any of these this rule will be checked if it's accepted then a new entry will be added here if this rule is not met then no entry is added so the way that the firewall works overall now is that as a packet comes in check the SPI table first if there's some information about an existing connection in the SPI table that matches the packet then accept it if there's no information in the SPI table then revert to our normal rules check them if they don't match then drop if they do match then add more a new entry to the SPI table and a time out will cause this entry to be deleted from the SPI table or a FIN message will cause it to be deleted that's a lot of detail of how stateful packet inspection works the the main point to remember is that SPI automatically keeps track of TCP connections once the firewall administrator needs to add just one rule to accept the start of the connection and the firewall that will then keep track and accept all subsequent packets related to that connection so packets are connected, are related to a connection between two entities what if computer 36 tries to send to computer 12 well it will not match the entry in the SPI table because it's a different IP address or what if computer 35 using a different port number 50124 tries to contact the web server again it will not match the entry in the SPI table because the entry records the exact port number so that automatically keeps track only accept things between 50123 on 35 and the web server on computer 12 another port number it will not match here and will need to check the rules and if it's accepted here a new entry will be added to the SPI table the end result should be much easier for the firewall administrator just add one rule let the firewall keep track of the responses and that's commonly used in firewalls today right if a packet comes to the firewall and it matches the first purple rule here then that will trigger a new entry added to the SPI table if it doesn't match, if it's dropped then of course nothing's added to the SPI table so the ordering again check the SPI table first if that doesn't match check the firewall rules if not take the default action if the SPI table if there's a match accept automatically and note that the match in the SPI table any order that is the source and destination address recorded is just that of the first packet if the source and destination is in the opposite order it's still a match that is explained to some extent on the slides here stateful packet inspection is what we're doing but I think the example captures all the things that we need to know it makes it easier for the firewall administrator at the expense of the firewall needs to keep track of all this state of connections and a firewall may have millions of connections passing through it and requires a lot of state information there memory and processing to record that that's the disadvantage but I think that is enough for today what we'll do next week is we'll just summarise and what we've learnt about packet filtering firewalls the basic approach then the extension using stateful packet inspection and then we'll look at just quickly with few examples or almost no examples the last two approaches how to arrange firewalls and we should finish that on Thursday next week


Hi, my name is Yannette James and this is Jima Augustine. This is our very first time working on a lantern. We will be portraying Taiwan and St. Lucia strong. What we have done is incorporated things that are indigenous to both countries and also we have highlighted the strides of Taiwan and St. Lucia.


What's up everyone? It's your girl, Kenzie here from Layton Sports Guards and I am ripping 2021 top scroll Platinum Anniversary Baseball Hobby 12 box case break number 12. Pick your team over the teams. We'll get started here We've got Adam B with the D-backs Aaron B Cubs Andrew P Giants Austin P Rangers Benjamin V Royals Brandon C A's Carol G Brewers Dale. I blue jays Daniel H. Reds David G Rockies Harper V with the Padres Mariners Rays and Marlins Jacob H. Pirates Jake R Tigers Jake are also with the Phillies Jimmy H Wait, hold on Jake R with the Tigers and Dodgers Jimmy H with the Phillies Jonathan K Red Sox Kenneth L Astros Kevin P White Sox Mark D Mets Matthew E Braves Nicholas I Guardians Robert H Nationals Ryan S Orioles and Cardinals Scott are angels Timothy M twins and Wayne S with the Yankees. All right, everybody Here we go. Best of luck We did Here we go Good luck everybody. So Brian See, let's see. Yeah, there's still plenty of spots left for group breaks tonight The customer back end of the website is currently down right now. So we are working to get that up and running for you So just bear with us As we are looking into that having white rookie, at least Camp Zuano, right? Wayne, right? Oh, yeah It's about time. Lou and Diaz. We've got refractor Jackie Robinson Got expractor Lou Brock Nice old-school guys coming out on some parallels King Griffey, Jr Rookie refractor Chris Bubeck for the Royals Only basketball break tonight is gonna be a 10 box Tuesday basketball, but it is already filled up Ryan More tomorrow night though. If you're looking for some we've got aqua wave Tony Gwyn Only basketball going tonight. We got a little bit of everything going tomorrow. Honestly basketball football baseball F1 soccer Again starting at 11 definitive baseball release day with Forrest tomorrow, rookie refractor Tanner how? Oh We've got to 100 red atomic of Ty Cobb Detroit There's a throwback See ya we've got to 70 the platinum mini diamond sees a Hernandez person posh a rookie refractor Joey Vado Reds I start seeing some emails come through. I'll know that the back ends back Smolts really weird There is rookie Louise Garcia rookie Lavera rookie Joe Adele rookie Got rookie refractor Dalton Varshow for the D-backs We've got aqua rookie auto Tristan Mackenzie on the aqua refractor Go Guardians with the first auto again, that is nine out of one fifty Taylor Box one maze rookie refractor of Dylan Carlson.  That's gonna help a lot They let you open up cats game a little bit more by letting them play the four which is good Open up a shooting a bit more than having a place center box to Mount Castle rookie to start us off back in rookie Who big rookie refractor Rick Ferrell? Cardinals He on Sanders X-Fractor rookie for the Cubs of Tyson Miller. That's true Randy. I don't know. I hope it opens up his game a little bit more We've got aqua wave Nolan Ryan for the Rangers Yeah, right. It's nice for sure. Let's get the 52 design on refractor of Brendan McKay for the Rays yo Fletcher You got a Bob Gibson refractor Cardinals Niko Horner got to 199 many blue diamond for the Mets Michael Conforto Color match their mess Beep jerky there Rob Got refractor Ruben Sierra Rangers Correct Jack the back the customers back end of the website is currently down and we are working on it You're not able to add anything to the cart We are aware we are actively trying to get that up as soon as possible It's been like that for about the last 30 30 minutes 30 to 45 minutes. I believe got to 75 rose gold mini diamond J Unir Mariners refractor Tom Glavin Angels I Didn't know fear and you know why it's because I gave you the wrong username. That is not my username I thought it was We've got Reggie Sanders auto going to the Reds Lot of throwbacks coming out of this case Reggie Sanders Well, we'll let you know as soon as that comes That that the website gets back up and we are trying to get that fixed ASAP You've got refractor Garrett Anderson for the angels box three here Yeah, I gave you the wrong the wrong username and then I still don't know what mine is. I Just know it's not the one that I gave you Help use Yeah, Rob, you got some on definitely some unique names in this set for sure that you don't see Very often at all kind of cool though We've got Awkward wave of Kevin Newman for the pirates Yeah, that's not mine though for some reason. I thought it was maybe I changed my name. We've got refractor Billy Williams Cubs Cincinnati Reds legend Reggie Sanders We've got X Fractor of Kyle Tucker Astros Degelton, rugby, screwball, weems Garvey Got Jimmy Lambert on the rookie refractor for the white socks That's true Eric Jeter But Rob remember and like 2016 or whatever it was you had more rushing yards and Reggie Bush did Got refractor Corey seeker for the Dodgers Reggie Bush ran for negative one yards that season. So we all have more rushing yards and Ricky Bush that one year It's a pretty good set 199 blue mini diamond white socks if he has Monty Grundahl Feels pretty good being able to outperform an NFL running back Refractor of Adam Wainwright Cardinals. You got my vote Rob. You got my vote Yeah, I'll have to look at it tonight. No fear for sure refractor of O'Dorek Rangers We've got a Ramon Lariado on the platinum wave There you go. A's that is 57 out of 70 You go Oakland. I've got to 99 green and yellow furgy Jenkins for the Cubs So Nick Hopping anything tonight. Well, you're luck continue We've got Aqua wave of Carlos Delgado Delgado and refractor of Jorge Posada Yankees. Oh, yeah, it's gonna be a really cool release day tomorrow for sure Such a nice baseball product For baseball tomorrow, gotcha you win some pick your teams or random teams and don't On 2022 definitive baseball releases tomorrow Forest will be doing what I say nine cases of pick your team definitive We've got refractor Ian Kennedy Rangers Some pick your team nice would you snag Nick and then later in the night I'll be doing some random teams and some more pick your team. So we've got Luis Patino on the extractor rookie for the race Blue jade nice.  Yeah Got Roger Maris on the refractor Yankees Christian posh a rookie Got refractor Nolan Ryan Rangers Mags we're gonna go for tomorrow Create the out of 100 red atomic of Gregory Soto Tigers Give it a look on YouTube some past breaks from previous years and there's pretty solid It's a really nice product for tops refractor of Sheffield Mariners. Yeah, probably one of the top releases for baseball top three Yeah, I would say so that do that triple case of Sterling definitive and Kangaroo Akin rookie zebra Yeah, I need a look at the checklist to a rich was saying it's a crazy crazy checklist George Springer on the refractor blue James Well as a checklist is out Yeah, right. We've got Aqua wave of a Maris Ramirez cubs Mike Trump Yeah, they've been falling pretty late No auto in that box any math use on the refractor there It's a second time I've seen that happen All right box five Yeah, I've got out of 50 on the Rose gold wave Lou Bernot Boudreau Or Fractor of Joey Wendell for the rings Yeah triple threats is always a good one to Rob Especially at the price point, you know and all the hits you get areas on the X factor TJ and Tony rookie refractor Reds It takes you in 13 To another two and three teams the last two seasons Stop wins fan Griffey and trowel Jeter and Rivera the unsander's bow Jackson have a duel Refractor Jorge Guzman Marlins Caleb will like this young yellow chop one for the brew crew Shreya They got out of 199 blue mini diamond rookie for the Dodgers Alex Vesia Vesia hostile black men I'm already seeing like players who I remembered as kids having their like Their kids in the refractor of laments hundreds like Antoine Winfield Jr. That one's weird same with a Sante Samuel Jr. Those are weird It's like I remember a Sante Samuel and Antoine Winfield very well Got Aqua wave Bob Gibson for the Cardinals Brock got refractor move on Red Sox Leans Ricky Bundy From Minnesota We've got Ramon Leriano second Laryano auto base to go with the The platinum wave they go open with another hit Got a cup that's that's a big one refractor Derek Lee for the Cubs Ted Williams has a cut you imagine forest bulls I can't lose my right box six here Wow, what a check list here 50 cards in the car Oh About eight of ten black gold rookie of Zach birdie for the White Sox Nice color match there on the black and gold Chicago White Sox is Kevin P. Very nice black and gold rookie eat of ten on that one Okay They're definitely harder pulls I haven't seen too too many. Yeah, so fracter tonsis Audrey How's your day going Donald? Got X fracter tigers. No more Manzara Imagine like a eight-way or 10-way autograph from a big red machine that'd be so sick Sean Yamaguchi rookie or Refractor sorry Joe hits the Davis Larkin bench Joe Morgan Dave Concepcion Refractor Trevor story Rockies Oh cool birthday on the 4th of July that sounds fun double celebration everyone's celebrating your birthday by Crazy how smoky the air was last night out of 100 red atomic Cody Bellinger for the Dodgers Because it's so humid and hot here in Florida. The smoke just doesn't like disintegrate right away It just stays in the air Humidity just like freezes it We've got refractor Pedro Martinez Red Sox That just like So darn hot Turner first we've got aqua wave Cole Hamels brace sobbing Refractor of David Boat Zuber rookie John Western coming up here Refractor auto of Gary Matthews for the Cubs Gary Matthews sign that pretty big to refractor that is out of $1.99 You know cubbies and last pack box six Refractor of Jordan Alvarez we were gonna update on his injury Say like probably it probably concussion honestly All right box seven here You're still down get everyone we are aware the customer back end of the website is still down You can't add anything to your cart or working on getting that fixed soon as possible, but we do we do know actively working to Fix that that hard twins fan.  I feel like it was the crime dog Got to 100 red atomic rookie of Cody Whitley for the carnals color match there Carnals was good twins. So he's relaxed. He didn't do too much. Just kind of hung out eat some food. Oh, yeah How about yourself? We've got Ursula on the aqua wave Yeah, Nick the customer's back end of the website is down. It's it's not your your side It's on our end refractor of Gallaraga. I'm trying to get that fixed Whole customer back end of the website down. I won't let you add anything into your car or check out Hello, my rookie No worries Refractor Kevin Malar Yeah, they're really cool definitely a 700 player checklist so Definitely see some old-school Products we've got blue Prism Otto Steve Garvey for the Dodgers beautiful blue color match there There you go.  Got rookie refractor Joe Adele Christian posh a rookie Lee I'm at suey Niki's partial rookie ex-fractor Ryan Sandberg Cubs Robinson a little a-rod refractor Mariners Good question for you think was underrated NFL wide receivers right now. I've got one that I just like Out of 99 green and yellow Aaron judge. There you go Yankees beautiful looking card there And Jeff's chism nice off away there Marlins Off-color match there and refractor Nixon's out I just think cuz he's like he's so good and so consistent out of 199 blue mini diamond Mark Beeler But I feel like he never gets enough Like he never gets enough for spades. I think it's my devins Like thousand yards every year. He's been in the league Refractor John Smoltz Braves Granted he's got braids throwing to him now, so it's a little different, but It was underrated wide receiver in the NFL right now doc It's a good one Are they all T's they're Fractor Harrison better I think he's I just don't think he gets there like he's never in the top Station Just we've got Ray's auto Tyler glass now, you know what they say when that's Yeah Fractor of Mari will Yeah, Renfro's a good one McLauren's a good one McLauren's a very good one He's really had nobody throw it to him You have half scan this for the first like year and a half and then he had Heineken Patrick and make sure of other guys Refractor Ryan Brown And God Dylan Bundy X factor for the Angels No, oh Tani's auto in this that's got there are chill autos though. I haven't seen one yet Those must be really hard Area factor of VW today's got Aqua wave rookie Bobby Dalbeck There you go.  Wow Whoo, that was what the red is out of five, right? That would be a beautiful color match on that. Oh my goodness Marquez Ricky We have granted workmen refractor cubs I've only pulled one red Red refractor auto so far. I don't know twins fan. I'm not sure Oh no out of 199 blue mini diamond of Richie Ashburn Phillies Out of 70 Platinum mini diamond Monte Irving Met all the way rookie Ryan Castinelli rookie refractor Rockies Got rookie refractor Christian posh a for the Braves Got Lana nice one there We have raise again. We've got auto Brandon Lau They go race couple of Got a good second for you then Scott that refractor Lucasin's reds I didn't know no one Ryan was an angel in this and maybe I did feel like we talked about that All right box 10 here Trump rookie the white rookie Joey Bono Joey Bart rookie refractor Jonathan Schupin Tigers Lean right. We have a way bogs X factor red socks. All right, P Awkward way frame or ants guardians Trunks John's butter Only the auto gotcha gotcha Fractor come for him that's That makes sense a factor Mike Piazza Mets There's a few guys who's on the different teams throughout this product Interesting Got four of five red and black Keegan Akin rookie for the Orioles Wow, that is a sharp looking card Orioles is Ryan S. I am not pulling one of these yet. Wow. That is a super sharp looking card We're a five Orioles Solve it out five Not seen that yet That refractor Geary Sheffield Marlins nice color this case for sure Pasha rookie Garcia Let's see a red a factor auto Smalls out of 75. We have rose gold mini diamond Robinson Cano Mets got rookie refractor Brian Garcia Garcia Rookie got Jorge so layer on the refractor auto Royals to $199 Okay, see World Series MVP Fractor rookie Alex Kearlaw for the twins already you've got number 11 coming up You check on the late and gaining slight see that back end is down to we've got off the wave rookie Ryan Jeffers for the twins Fractor Louisa Ryan's X-fractor Nolan Ryan Rangers Got you Darvish refractor Padres Fill your twins fan Got Nick Knight on the rookie refractor Marlins Have a good one Thanks, Ronald Donald sorry Got to $199 blue mini diamonds Fernando Tatis Jr. You go Padres nice Tatis That refractor Louise Tiont Red Sox Fractor Bobby a brave Phillies They've got another carry Matthews auto here for the Cubs believe the first one was a refractor They got a base and a refractor coming to your cubbies Chisholm rookie to 99 green and yellow one Gonzalez for the Rangers Pack box 11 We've got aqua wave Brett Gardner Yankees and refractor Francisco may have raised All right last box of the break number 12 We'll do a recap again everyone who just joins our Customer back end of the website is currently down. I'm not able to add anything to your car purchase anything We are actively trying to get that Back up and running. We'll let you know as soon as we can once we get that fixed Looks like it's still down Got Raleigh fingers refractor A's X-fractor Marcona A's Refractor Rookie Dazz Cameron God is your on the rookie refractor Pirates You've got so 199 blue mini diamond rookie Casey mice Tigers That refractor Robin Roberts Philly's Brian Hayes working super hard pulling this product Hobby bias refractor Cubs aqua wave Robin Gwardy Looks like we're back Right we've got a Dave Parker auto for the pirates Sick the pillbox hat. That is so cool. There you go pirates on that one What's auto of the case? and Fractor of So to go so to go All right Yankees on that one. Let's do a quick recap here Yeah, and we had Dave Parker pirates scary Matthews Cubs Jorge Sala on their fractured 199 Royals Brandon Lau Ray's Tyler Glass no Ray Steve Garvey on the blue prism auto to 99 yep 99 their Dodgers Great Matthews refractor auto for the Cubs to 199 from on Larry on O A's We have the Larry on O on the platinum wave that is out of 70 for the A's Reggie Sanders red Trista Mackenzie on the aqua refractor auto to 150 and he red and black to five rookie for the Orioles Keegan Akin Alright, that'll do it for the first case break. We've got a half case coming up shortly


We can make the necessary updates for your users. And I hope the day was fruitful and I hope for your participation. Right then, so we can continue the chat going offline in Slack. So if you have any questions regarding any sessions we did today, and also if you encounter any logistic related issues, accessing our open edX or Slack or the DHS2 instance, please let us know because from tomorrow onwards, you will have to log into the DHS2 instance and we will be doing some activities. And about the timing, so generally our academy will go from 1 to 4 p.m. local time. That is three hours, but the thing is like as you can see, like there may be some sessions where we might have discussions, it's always good to have some discussions. So in some of the days, we might extend a bit further, especially if we have exercises that we need to discuss because our final aim is to so that most of your queries will be clarified. So please bear with us in case we exceed the time beyond 4 p.m. That is like after three hours. But just generally, we will definitely finish all the presentations, discussions and the activities before 5 p.m. That is like within four hours, all these offline activities, everything we are actually hoping to conclude. Right, so I think that's it for today. So thank you so much for joining. We hope for discussion. Yes, please. So guys, there's a feedback page available on open edX. So on the first day for the introduction logistics and management features, we have the last section here as daily feedback. If you click on this, it will open up a form for you. This couple of questions. We'd be happy to get some feedback from you on the today's sessions and then see if we need to improve a few things we will be working towards improving in the sessions from now on in the coming days. So please make sure you take some time out and feedback as well before the presentation. Thank you. So please provide feedback, everyone, because your feedback, we are really vigilant about the feedback. So if we do some of the feedback, as per your expectations, you can definitely mention it. Or if you even did something that you really like, you can mention that as well. Because like we go through feedback on a daily basis and try to improve the level of experience that we are providing in the second. So thank you very much for joining. I hope it was a fruitful discussion or a fruitful day. The first day that we had. So looking forward to seeing you all tomorrow. Have a great day. Thank you. Thank you. Thank you. Thank you. Thank you. Thank you. Thank you. Thank you.


Hey guys, right now I'm going to be going over the functions lab one tutorial workshop And I'm going to be doing question one So we can see from the question that we're given a follow or a function called triple and it returns to us Whatever our input is multiplied by three. So we've got our return type here is an integer We've got the name of the function is triple. We have our input is And it's this variable n which is an integer And then it's going to return n times three So let's just look at the first part of it and anything we do here we can always test with Processing which is great, but just make sure when you do it you have void setup I know some people are having issues with mixing active and static mode And that's because you were trying to write this function, but you didn't have void set up So if you have functions and you need to include this void setup, so you don't get that error but first let's just take a look at this triple one and See what's going to happen with it and if it's even valid So first we're calling triple and then we come into triple and we give triple the input of one and Triple requires that it has one input and it requires that that one input is an integer So this works out because we're giving it one which is an integer So and it's going to return to us It's it it will replace this n with one and then it will return to us one times three which will be three So we should get three down here Which we do So for 1.2, I'll just copy and paste what the problem is into here So we've got this integer m which is two We've got an integer p which is calling triple m and then we want to print p So we can come up here to where the calling of the function is and it's It's going to input the variable m So m is two which is an integer and we if we come down here We know that triple needs an integer so this is valid so we can call triple with our variable m 2 So now m is going to be put into here So it'll become 2 and then 2 becomes the variable n So n is a local variable for 4 triple So now instead of the variable being m. It's replaced and now n is our variable that we're looking at So now we're going to get 2 times 3 Which will be 6 so now p is going to be equal to 6 and this works out as well because P is an integer and an integer is returned to us So now when we print p we should get 6 Which we do so let's look at this next one so we're gonna call the function triple with 3 and 4 and We can already see here that this is invalid The reason for this is because triple only takes one input and we're trying to give triple two inputs So we're saying here triple here are these two inputs and triples complaining because it's saying you only told me what to do with one input I don't know what else to do So it's complaining to us. So this is invalid. This this won't run All right, so on to 1.4 We've got an integer m which is equal to 3 and Then we want to Print triple m plus 2 So when we call triple We're saying m which is 3 plus 2 which is 5. So when we call triple N is going to be equal to 5 because that's m plus 2 or 3 plus 2 and Then we enter in with n being equal to 5 And then we do 5 times 3 which is 15 and our output should be printed our effect should be 15 And we can see down here that that's correct So now on to 1.5 We have a variable fill red and it's a boolean and We're calling triple five for it So this is invalid. We're gonna get an error for this the reason for this is because We can call triple five as we know before this works. We can call triple five. It's gonna Put five in is n Five times three is 15 and then it'll return the integer 15 to us But the issue is that we're trying to put an integer Into a boolean so fill red is supposed to be a boolean value and we're trying to insert an integer which doesn't work out This isn't consistent. So we're gonna get a complaint from processing. So this is invalid And then we've got this for our last 1.6 we've got this nested Function call Which I know seems a bit confusing Let's just try and work out down here what's gonna happen So we've got this the first thing that we want to do is hop into the middle Because as we know from the basics of math operators, we need to go into the parentheses first So first we'll do This triple I call so we know that I is gonna be equal to one I mean if you're ever confused with any of this sometimes I like to write it down on a piece of paper and basically do this process Which is just going through it myself and trying to figure out what the values are gonna be if you're ever confused with anything So we know that I is gonna be one so we can replace I with one and then when we call triple one And we'll now be equal to one one times three is three. So three is gonna be returned to us So we know that triple one is gonna equal three and then we can do this whole parentheses So we know J is now equal to two Three plus two is five and as we know from our previous questions Triple five is gonna give back 15 to us So the value 15 should be printed so when we run this We can see that down here And another good thing to do if you're ever maybe a bit confused about what's happening is to use the debugger And I will show you with we'll go back to one point two because that's a good example to show the debugger with We can come up here and we can put breakpoints on everything that's happening And then we can run this it'll first stop it and it's equal to two So we'll step through this so we can see here our variable m and then We have our triple m which we know will be equal to six then we have this integer p So we step through that Now we jump we jump into the function because we called triple m So now that shows our variable n which is now two so m was two and then we put m into our Into our call for triple and then triple replaces n with two So now we also have this local variable n which is two so we can see that here Because these two variables are local to set up and this variable is this variable n is local to triple So now we don't see these variables anymore, and we just see the variable n, but then if we step out of this And is no longer here because we're back into the setup So after we call triple it comes back up to set up and this The the variable n isn't local for setup variable n is local for triple So we don't have any or we don't see n anymore So now we come up to here, and we go back up, and we see n again because we're back into the setup function Step through this we now get our variable p is shown Which we know is six and then it steps through and we get our output So if you're ever confused with how something's working with a function again I suggest writing it down and kind of trying to work through it yourself or using the Debugger and stepping through Each line of code to see what local variables and what global variables we have And kind of what's going on So hopefully this helped for you guys


Welcome back to my channel. Today's video, as you can see from the title, it is another hair review video sponsored by the best love me hair. If you're new here, hey, my name's Akira Jenae. Don't forget to subscribe and join the family before you leave. So I just wanted to hop on and show you guys the hair first and then if you want to see how I achieve this look in less than five minutes, yes, five minutes, then keep on watching. The wig took about three to four days to get to me. As you can see, the wig did come DHL. So normally shipping does not take long with them for me where I'm at. I am in Arkansas, so normally shipping is about three to four days. This is their box. Super cute. When you open the box, you're going to get your wig, of course. You get a set of two wig caps. And then this is something new. I've never received this from a love me before. It was like a cute little bitty mirror.  But this is super cute. I've never seen anyone get like a little mirror from love me. So I really thought that was super cute. It's a little mirror on the go. And it kind of fits like a credit card in your wallet. So this is the wig I have. It is a glueless 5x5 closure. It does have two combs on the side, one comb in the back, and then it also came with an elastic band on the backside of it. It wasn't pre-plugged, I don't believe. There was a little bit of tint to it on the lace, but you'll see that I am about to use lace tint. The lace tint does come in about four to five different shades, so you can use whichever shade that fits best for your skin tone. After letting the lace tint sit on there for about five to ten minutes, I do go back in and then I will start plucking after the lace tint is completely dry. If you're crunched for time, you can use a blow dryer to get the lace dry. All I do is hot comb the closure part just to get it as flat as possible. I do this so that I can go in and pluck. I don't really like to pluck with wet hair. I like to pluck with dry hair, so that's what I'm going to do, just kind of perfecting the part a little bit. I am obviously going to do a middle part. So after that, I'm going to use the edge wax, lay that down, and then I'm going to go in with the hot comb again to get it flat, and then we're going to start plucking. The method I like to do when plucking is kind of pluck, pluck, skip, pluck, pluck, skip, pluck, pluck, skip. As you can see, that's what I'm doing, and it's just the easiest plucking method for me. I learned it here on YouTube and I just find that it works fastest and the easiest, especially for a beginner, and especially for a closure. It's super simple, super easy. Just make sure you don't pluck too much in the same spot or else you're going to have like a bald spot, and since we don't want that. This me plucking for about two to three minutes, it looks so much better. So this is the side I plucked, and this is the side that has not been plucked yet. You can see a tremendous difference, and this side looks really good, and then I'm just going to go ahead and try to mimic it on the other side. The other side I can't really pluck as good as my right side, just because, you know, I'm obviously not left-handed, so that's always a challenge for me, but this is how it looks close up, super cute, blitting and looking just like skin. And I like to always go in with a razor to cut the lace. The razor just gives a more natural jagged cut rather than doing scissors straight across. And after getting the lace completely cut, you can see that it literally looks just like scalp, and there's no glue on it at all, and right here I was happy because baby it's getting scalp without it even being glued down. So here's the glue test, there's absolutely no glue on here. It's glue-less, and it's literally looking like scalp. And then I'm just going in with a little bit of powder foundation to put on the lace so it can blend in a little bit better, and then I'm using just water to make the curls pop. As you already saw, this is the finished product. The only thing that I put on the hair was water, and then I used a foaming like wrap lotion. I like to use wrap lotions rather than like Eco Styler Gel or any type of gel because the foaming wrap lotion is less harsh, and the Eco Styler Gel isn't harsh like it's meant to be with water, it's water-based, it starts getting a little crunchy, and curls like this I like for them to still be flowy and really bouncy. So that's why I like to just use a foaming wrap lotion. But yeah, super cute, and I did not glue this down, I already did the little glue test with the comb, but here's a closer look, let me scoop down some. This is how the hairline looks, I just did a little bit of plugging just because I didn't want to over plug. Since this is a closure, I don't recommend plugging too much because if you are going to wear this a lot, it's going to start to bald. So I definitely do not want this balding, but literally this is no glue. I'll pull it up a little bit. No glue, isn't glued down, super cute, glids in perfectly. And I have the elastic band on, if you saw earlier in the video, the elastic band is optional. I think you should wear the elastic band if you are trying to do a glueless method just because it does keep your wigs secure and tight, so I absolutely love that. You guys saw that it came DHL, it was two-day shipping this time, shipping was super fast. This is how the box looks, I already did an overview of that, all the goodies. One thing that I wanted to point out, again if I didn't already talk about it, is this, this is so cute, I've never seen a company have like a little mirror, it has their logo, love me. And look, it's a freaking mirror, so maybe you need to look at that lace real quick, make sure it's laying down as flat as possible. This is super cute, but yeah, it's just a mirror, so you can see my setup right there. And it comes in kind of like a little like a debit card, so it's really easy to put into your purse. I thought that was super cute. This hair, super cute, super flowy, I don't have anything to complain about, you guys know I love, love me hair. This hair, easy five minutes, five minutes and you're done. Cutting the lace, I spray lace tint, everything gets fight. So yeah, this hair is definitely a 10 out of 10, it is the easiest, one of the easiest wigs I've ever installed for sure. Literally doesn't need anything. This is definitely a beginner lace wig, it is a 5x5 HD closure, I believe they sent me either 22 or 24 inches, but honey, it's just so cute, like get into it. So yes, I always don't forget to like this video, comment and subscribe and until my next video, I will see you lovelies then, bye guys.


What I was saying was that our package, immigration, and, as soon as the Mazzoli building was saved, something mattered, are sufficiently close together that I think we can really get that through. If we do, it will be unusual because nothing else of this kind has come close to getting through. President, this is a bill I think will attest to the fact that every president before was taking two subjects, Social Security and Immigration, and worked on in the last half of the last year of his term so that they just flopped over to a successor. And the fact that you're tackling both of these early on is a lot of it. It's really something. And, in fact, there's a lot of credit because there were just so many curbs. Well, we've also been very lucky in having two committee chairmen, Alan Simpson, who has been just, superb, and Ron Mazzoli in the House Democrat, has been great too. And needless to say, this is an issue that has a lot of grassroots interest. And we're honored, too, with Simpson's because I got a letter from him. To note that we brought this discuss with us, it was used by the US Carolina team during the first competition of the US team in Rome in 1960. We would be very honored, sir, from the occasion of this kickoff if you would sign it for us at the leisure. And we would like to have it permanently in scotch in the National Wheelchair Athletic Hall of Fame. President, on behalf of the National Wheelchair Athletic Association and the Carolina Board of Iranakers, we are honored and pleased to accept the honorary chairmanship of the seven Carolina games to be held at the University of Illinois in 1984. These games are traditional, held in the same host country as our able-bodied games are. They have been since 1960. Your endorsement and support lends meaning and purpose, and certainly encourages the thousands of men and women that compete with their sports. These men and women are truly athletes in a true sense of the word. And for this, I'm honored and privileged to present to you this program in your role as honorary chairman of the seven Carolina games. Well, I am greatly honored. I'm honored to be the honorary national chairman of those seven Carolina games. And I'm honored to be a member of the honor of the National Blues Hero Athletic Association. I know something about and I've heard about the promise of our basketball player here in the first two of their Olympics. And I'm very pleased that they finally are going to be held here. I did not understand at the time, but they were always held in the same country as the other Olympics. But they're also now going to be held in my home state, Illinois, University of Illinois. And I'm very pleased. I think that you should be very proud of all of you. You must be. But the National Wound Chair Athletic Association and the Paralympics have done and achieved so much government support. He would suggest such a thing. And I know how many of those who were formed in these have any contest to going on this to challenging jobs. I'm very proud. Wish you all well and games to come. Mr. President, you have any encouraging thoughts about the budget negotiations? Are things going well there? No question. I'm going to go talk about this. Thank you. We were in particular inspired by your work trail and we had a double happy team. We had some other folks with us here today. Mr. President, I want to say hello to the University of Illinois Stadium where these will take places in familiar territory. I once appeared there to track and meet the high school state finals. And then I was also back a few times as a sports announcer broadcasting football games there during the war when Buddy Young was the great star that he was there in the officers training course at the University. I'd like to write this. Will this be at the same time as the other Olympics? It precedes the games in Los Angeles. These are June the 19th through July the 4th. You have a standing invitation to come if you will. Thank you very much. It will reissue it as the time grows near. When I say that Dr. Tim Nugent is the father of wheelchair basketball in the United States and really the father of wheelchair at Dr. Nugent at the University of Illinois is really the father of wheelchair sports in America. We all have a great deal to them. I don't know whether being a father is appropriate. We do have an elevator now. It was a long walk. When I say this too, if I may, that this entire program is really in the true spirit of your program of volunteers and everything being through volunteers, all the funds will be raised through the public sector. No money is from taxes or anything of that nature. We're not seeking it. Wouldn't you all like to come in here as long as our photographers are still here? Mr. President, I think you would be happy to know that in the 35 years of which there's sports, there's never been a paid employee here. We have thousands and thousands of people competing every year in national teams and in tournaments and all sports. I think that's coming to born. It does fit me. And we're the only country that does so. We're the only country that fully, privately supports the entire effort. And once in a while, I think there's kind of them sneering at me and telling me that they don't care about what they're doing. I mean that they, well, I saw the CDS show last night especially. And as if volunteerism you know, only government can do like that. I believe that. Are these two young minor perfect examples because they're both leaders of the field? I know. And I know what he's doing now. We're going to have a few answers for Mr. President. Very constructive, very positive answers. Hard to cut. And I'll guarantee that we'll have a good program for you. I looked at that last night and even without checking in here or checking out any, everyone of those things was disarmed.


Did you know that in 2019, Zoom had an amazing 10 million daily meeting participants? However, due to the pandemic, in May of 2020, Zoom hit an all-time record of 200 million daily meeting participants, only to smash this record the very next month, with over 300 million daily meeting participants. Subscribe to Burn2Learn, where you can learn how to master Zoom today.


2019 novel coronavirus, 2019 NCOV, is the cause of an outbreak of pneumonia in Wuhan, Hubei province of China. The study aims to investigate its epidemiologic history, clinical characteristics, treatment regimens, and prognosis of patients infected with 2019 NCOV during this outbreak. The study collected clinical data from 137 2019 NCOV-infected patients admitted to the respiratory departments of nine tertiary hospitals in Hubei province from December 30, 2019 to January 24, 2020. The majority of patients had normal or decreased white blood cell counts and lymphocytopenia. Lung involvement was present in all cases, with most chest-computed tomography scans showing lesions in multiple lung lobes. Treatment focused on symptomatic and respiratory support, an immunoglobulin G was delivered to some critically ill patients. The risk of death was primarily associated with age, underlying chronic diseases, and median interval from the appearance of initial symptoms to dyspnea. The study concludes that the majority of patients with 2019 NCOV pneumonia present with fever as the first symptom, and most of them still show typical manifestations of viral pneumonia on chest imaging. Interlaged and elderly patients with underlying comorbidities are susceptible to respiratory failure and may have a poorer prognosis. We are article.tv, links in the description below.


So there's a couple of options for improvement. We could add another feature. I think two should suffice for now. It's okay for making some mistakes. It's fine. Just try to learn, which is how we can improve the centroid function. And also a funny centroid, it wasn't a standard one. Yeah, MOM is the minimum of a mean of maximum. Centroid of area would be obviously a more standard thing to use. Yeah, we actually expected it to work with a centroid. Everything should be more or less standard. The white detection error went from 102. Yeah, now square doesn't ever give square. We also need to monitor the features for each selected waveform. One of the features of JavaScript should be pretty straightforward because most of the stuff we're doing in the back end is not ideal for a binary chaos. Should all be doing everything on the front end, on the client side. Then you'll have options to do more on the back end, on the server side. That's, yeah, server can be costly. And considering these tools are free, I want you to spend electricity and not overload my server as much as possible. So if we load all the code in theory, we should have been able to use this workspace. Can you explain the link between the files in the workspace? So it's getting a errors when using workspace. It's essentially collecting too much stuff or something. I don't know what's up. I don't know what's up with that. I bet it will work on Windows. Can I do curious if I can just do this? Send it to a GPT, see what it says. What the problem might be I'm using Ubuntu Is this a unique problem? This array buffer allocation error failed. No, this can't be right. This can't be right. I have plenty of RAM. I think it's also happening on the server side. I do have plenty of RAM. I think the problem is happening on the server side of GitHub co-pilot. I can monitor memory usage, but that won't be it. It should be a more simple command for co-pilot. So I don't know. Anyway, it doesn't seem to work on Ubuntu properly. At least the workspace command, which meant to look at all the open files, collecting workspace structure, yeah, path allocation. No, there's nothing wrong. Yeah, it's using bug role memory on my machine. Guess we asked about each file to explain each file. Let's go back to the JavaScript. We need to modify the fuzzy logic parameters. What are we currently looking at? What are we visualizing in terms of the fuzzy logic parameters to change them to? We need to visualize other parameters. Yes, we have the membership functions, symmetry, and sharpness. We have the rule activation, splotted this, outfitted the x-axis representing this symmetry, assuming the same x-axis for all rules. OK, this is odd. And aggregated output of the fuzzy inference process to splotted as a graph on the x-axis representing symmetry. So, rule activation, the rule activation is working for both asymmetry and sharpness. Yeah, we do need to modify the fuzzy rules to change how the system makes decisions, because currently it's making a lot of mistakes. And the nature of the parameters, for example, if you want to visualize input fuzzy sets, do we need the input fuzzy sets? So we have both symmetry and sharpness parameters in low, mid, high should be able to view yet the input. It keeps saying stuff is not provided on the server side, even though we did provide the Python code. Yeah, we should be able to plot. Yeah, it's probably if the copilot doesn't have all the context that from, let's do this quickly, do it in another, in a different order. OK, can we add more visualization that will help us to modify the fuzzy logic parameters? The HTML should be pretty straight forward copilot to change the code. We have the prompt. Well, it's not quite a prompt. We should advance to turn it into a prompt. Yeah, of course, we need to modify the JavaScript and then the HTML. Yeah, I want to edit the HTML. Where do we put it? It's the output graphs. We have the input graph, output graph. We place this tool over here. I have obviously a problem of fitting everything into that one window in the JavaScript. So it's a scatter plot that makes sense. Turn this into a prompt. I don't know. Material is using GPT, but in reality, the prompt shouldn't be asking silly questions like that. I should just give it, does it know of a previous prompt? How to modify the code based on the previous prompt? Now, why are we calculating symmetry? It doesn't make any sense. We already calculated the array to have calculated. Wait, why is this? We have it in the back end. We need to pass it to the front end. When we calculate symmetry, array, can we turn it into OK? When we calculate symmetry, array, can we turn it into one number? How is current decision being made out of the array considering we should have a single value for each input waveform? Yes, essentially what I don't understand is currently we have the algorithm searching for certain waveforms through overtime. But we need a single response. It's actually calculating symmetry measures for each point in the signal. Yeah, that's not what we want to do. This is not what we want to do. Yeah, I think we need to get up what is to already place the flask first. In the current code, I haven't made any changes. Why are we calculating sharpness and symmetry for each data point in the code instead of for the whole input waveform? Yeah, so that's wrong. Generating super slowly might take a break while it's generating. Yes, that's wrong. But I don't want to force it on it. Just let this get upset. How is it possible to calculate symmetry for a single data point that you need at least two? Yeah, it does sound too complicated. The input wave is a dropdown menu to select a waveform of a specific shape. Now, the fuzzy logic algorithm should then look at the entire wave. And in the output wave, make a decision what the waveform is or which group the waveform belongs to. Can you double check the code and suggest how to fix this issue? We also have an option to add noise to the signal. Can we somehow make sure that sharpness is not affected by the noise too much? The noise is much higher frequency than the changes in the whole waveform. It should be somehow embedded into the sharpness calculation. Yeah, so we don't want to use low pass filtering because, yes, it will be getting rid of the noise. But we want to feed the noisy signal into the fuzzy logic and just see how it's able to deal with it. Or not, that's OK if it's not. We want to see at what threshold of noise it starts making mistakes. Yeah, I want to ignore this for now. That's OK. I want to try something I haven't tried before. I want to generate prompts. I potentially generate prompts from GPT-4 and actually ask the co-pilot to do the code changes that work any better. And let's see, is it calculate waveform symmetry? Let's check if there's anything. So before, yeah, before we had an array, right, because it was calculating for each data point, let's just have it in the code. Let's try this. Let's call it this. And now we have calculate waveform symmetry function to assess the symmetry of the entire waveform. It sounds better this function should take the entire signal input, split it in half and compare the two halves, calculate the symmetry as an average difference between corresponding points and the two halves also include handling odd number of points. What? It's already like hallucinating, I just said. Calculate waveform symmetry function. So I'm just taking it from the code above. OK, midpoint, right half, left half, there are three, giving three different options. On this stage, 54 and again, 1. Yeah, return symmetry is OK. Turning symmetry, just 1 minus symmetry measure or 0 if that lands. So is it handling? Well, yeah, it's returning as 0. It's kind of handling it, but yeah. So I like that the front is nice and clear. But why is this something weird? Everything like a keyboard thing, when I go control, I might have a function, find peaks, find vectors, features.  Peaks, find peaks, drops, find drops. Again, suggesting a couple of options that are actually quite different. Returning sharpness. This is what the file finds the logic function. Develop find peaks. Five drops, I should take peaks and throws and wait for. Join this function and revise it to noise. I really ended up finding significant peaks and throws. With symmetry array, we don't need to calculate symmetry array anymore, hopefully, because we also need to modify the fuzzy logic function. Do it in the chat. OK, now it's going places, isn't it? But we're really doing that. Again, always refating to use triangular membership functions instead of trapezoidal ones. Please check bodykills.com if you haven't done so already. Provide your feedback. This is what we're doing this live streams. So don't forget to comment, subscribe, so you don't miss the next live stream. And I'll see you in a bit. Bye.