Cool, thanks. Yeah, it's a little early on Sunday. Yeah, we're going to be rolling old school today with some ARP. So I know hacking ARP has been around for a bit. We're going to kind of go over some of the classic attacks and then a little bit of a twist on some of them. A little bit more effective here and there. Some of the tools that are out there that do things like ARP cache poisoning and stuff like that don't really take advantage of some of these techniques, so I'm going to go over that. So first we're going to start with kind of a background on ARP. For most of you, this is probably going to be pretty basic, but it's kind of essential to build what really ARP is and what it does and how we can attack it. So obviously network systems like in a network need a way to talk to each other. A lot of times we think of them talking to each other via protocol address like IP addresses, but on a local area network or physical network they actually have to talk via physical addresses and so we need a way to translate from our protocol address like our IP address to the physical addresses like MAC addresses. ARP in this particular talk, we're in reference in this talk, we're talking about ARP over Ethernet and in reference to IPv4. So ARP can work in other environments, but we're specifically talking about that particular environment right now. So the address resolution protocol allows us to resolve a hardware address from given a protocol address. So if we have an IP address like <IP_ADDRESS> and we want to talk to it, we can send an ARP request packet out to the broadcast of the network. It's kind of like a who has <IP_ADDRESS>. And every host on the network since it's sent out to the broadcast gets this particular request packet and if their protocol address matches the protocol address in the field for the target protocol address in the ARP request packet, they send out a response to the sender saying I'm at blah, blah, blah. So here <IP_ADDRESS> sends out that they are at the hardware address 00DF1A9CA378. So, okay, so now we have a way of translating between protocol addresses or IP addresses and hardware addresses. But obviously there'd be a lot of chatter on a network, unnecessary chatter on a network. If for every packet or every frame that has to go out on a physical network, we have to send out an ARP request and receive an ARP reply. So hosts in order to overcome this overhead have local caches of MAC address and IP pairs. So it's the ARP cache. What this does is it just once we've resolved an IP and MAC pair, we cache it for a certain period of time locally so that when we go to communicate to another host again, we look in our table and if the ARP entry exists, then we know where to go. We don't have to send out an ARP request again. So this is where really part of the weaknesses in ARP kind of starts out is that particular table. So go over a little bit of a background and anatomy of an ARP packet to begin with. So this is kind of a typical ARP packet. One of the first field is hardware type field. And so this specifies what the underlying type of hardware that we're sending our frames on is. Typically, and in our environment that we're talking about today, this is going to be set to the code for Ethernet. Next we have the protocol type, which again specifies what protocol we're using. So this will be filled with the code for IPv4. Then the next two fields are hardware length and protocol length. Because we can use different protocols and different hardware mediums in order to send ARPs over, obviously the associated addresses can vary the length of those addresses. So we need a place to specify how long each field should be as far as the protocol length and the hardware length. So that's done in these two fields. We'll go over actual examples of ARP packets in a little bit. And what values go in there. The next is going to be the opcode. And this is typically going to be either a request or reply. So this is where in the packet we specify what kind of packet we're sending. If we're sending an ARP request or if we're sending an ARP reply. And that's how the associated hosts translate that packet when they receive it. The sender hardware address is pretty self-explanatory. This is the hardware address or MAC address in our case of the sender's Ethernet card or interface card. So whoever's sending out an ARP request or an ARP reply, they put their own hardware address of the interface it's going out into this field. Same thing with the sender protocol address. This is of course how in your typical or standard conversation, we're going to abuse these fields a little bit in order to get what we want out of it. So then you have the target hardware address, which is pretty self-explanatory again. It's the hardware address or MAC address of the target we're sending our packet to. And target protocol address, which would be the IP address of that target. So as an example, if <IP_ADDRESS> wants to speak with <IP_ADDRESS>, they send 1.20 will send an ARP request packet out to the local network broadcast. And this is what the packet will look like. We see that the first field, the hardware type is set to 01, which is the code for Ethernet. The protocol type is set to IP. The Ethernet length is set to 6 because it's 6 bytes for an Ethernet address. And the protocol length is 4 because it's an IPv4 or 4 byte address. We also see the opcode is 1, which is the code for an ARP request. And then we have all the different, the sender hardware address, which is the requesters hardware address and their IP address in the protocol, the sender's protocol address. And then target hardware address, which here is set to null because that's what we're trying to do. We're trying to resolve what the hardware address for the IP address that we have. So that's set to null and sent out on the wire. And then we have the IP address that we're trying to resolve in the target protocol address. So the response looks like this. <IP_ADDRESS> replies, sends out an ARP reply with its hardware address, 00AABBCCDDFF. And it's specifically sent to 1.20 and to its, the target, you can see that the target hardware address and target protocol address are both filled out correctly. And the sender hardware address and sender protocol address are filled out with the host that's answering. This then, in turn, the host, <IP_ADDRESS> will take that and enter it into its ARP cache, or update its ARP cache for 1.100. So now it knows who belongs to 1.100 and doesn't have to send out more requests until a time out occurs. So traditional ARP attacks. One of the most common ARP attacks for taking over really any local area network is ARP cache poisoning. ARP cache poisoning is, since ARP is completely unauthenticated, you might have noticed as we were talking about, even if you're not familiar with ARP cache poisoning, the dangers as we were talking about, a host sends out an ARP request and it receives, somebody else sends out an ARP reply and when it receives that ARP reply, it updates its cache. It has no sort of authentication to verify who actually sent the ARP reply, so it doesn't really know who it's talking to. And that's what ARP cache poisoning is really about. You basically, since it's completely unauthenticated, whoever sends a reply to the requester first wins and gets their information, whether it's legitimate or spoofed, input into the ARP cache. We have another condition though where sometimes the ARP cache can be updated with gratuitous ARP replies. So even if the host didn't send out an ARP request and it's just humming along and receives an ARP reply, then it'll still update its cache because it's dumb. So basically that's really what most of the ARP cache poisoning tools rely on. Instead of waiting for an ARP request to go out and trying to race with the actual owner, it just sends out gratuitous ARP replies in order to try to update the cache. This isn't effective on all operating systems, but many operating systems, this is the case. So basically in order to exploit this, you just send out forged ARP reply packet to a victim. You put in the legitimate sender protocol address, whatever you want to hijack the connection of, and your MAC address or some other MAC address, and effectively poison the ARP cache so that the victim is now talking to you when it thinks it's talking to Joe Blow Gateway. So the results of this, as you can see, are probably the most common is man in the middle. If we poison an ARP cache entry with our own MAC address information, our own hardware information for say the gateway, then all the hosts or all the traffic between the host and the gateway or obviously any traffic going to host on the other side of the gateway are going to go through us first. So we can look at it, we can modify it, we can sniff it, whatever we want to do, classic man in the middle attack, and then pass it on to the gateway as if it were legitimate traffic, sorry. Another condition with this would be denial of service. So if we put in, instead of putting in our own MAC address or a legitimate MAC address in order to hijack the connection, we can just put in a bogus or non-existent random MAC address and now that host can't communicate with that the other host. So you can sever connections between hosts. Obviously the benefits of that can either be just simply profan or malicious or if it's used in conjunction with other attacks, like say we're attacking or attempting to exploit a vulnerable server but we know that we're already on the local network and we know that the server is logging to some central syslog server or reporting to some central intrusion detection sensor, then we can sever that connection, deny service between those two hosts and now prevent that external logging as we carry out the rest of our attack. So an example of man in the middle attack would be client sends an ARP request for 1.1 and we can see that it's a standard ARP request packet. So we have the sender hardware address and protocol address which are our victim host and then target hardware address again is null and we're looking up <IP_ADDRESS> and it's a request packet as you can see in the opcode field. Now before 1.1 responds the attacker now sends another ARP an ARP packet directly to 1.20 at 00AABBCCDDEE and says hey I'm 1.1 and it gives it its MAC address so 00AABBCC01AA. So now the attacker is actually the victim 1.20 is talking to the attacker where it thinks it's talking to the gateway 1.1 so the attacker can do anything it wants with that data stream inject things in, sniff on it, gather usernames and passwords anything that's relevant. Again an example of denial of service would be that <IP_ADDRESS> requests the hardware address of the gateway again same packet and the attacker instead of replying with his credentials in order to perform a man in the middle replies with bogus a bogus MAC address of 00AABBCCDDEE 01. So now the victim goes to try to talk to the gateway and can't the communications channel is severed because it doesn't really know the hardware address even though it thinks it knows the hardware address of 1.1 so it sends packets out and it never receives or 1.1 never receives them. Another ARP attack, classic ARP attack is a CAM table overflow and this has been around for a long time but the reason for this specific attack is that back in the day when anybody used hubs a hub is just a dumb piece of network equipment so two hosts communicating over a hub all of their traffic is forwarded to all of ports on that hub so if you were plugged in anywhere on that hub or that physical network you can intercept or sniff eavesdrop on any of that traffic and that conversation and even potentially inject things into stream as well and things like that so switches though are different as we probably all know that switches maintain a table this is actually called a CAM table or content addressable memory table and what this table holds is a matrix of pairs between port numbers and MAC addresses that are discovered on those port numbers along with some other information but what's relevant to our discussion right now is that MAC address and port number pair so the CAM table says that switch port 23 has these MAC addresses associated with it so when an Ethernet frame arrives at the switch instead of broadcasting that frame out to all ports it instead looks it up in the CAM table and only forwards it to the port where that MAC address actually exists so that kind of severs our ability to eavesdrop on conversations because now we're not getting that traffic even if we're in promiscuous mode or whatever that traffic just never received ends up on our network port so a CAM table overflow what it does is no matter how big your switch is no matter what kind of enterprise switch you have it's going to have a size limit to the CAM table I mean it's not going to be infinitely sized so there's going to be some point at which it can't it has to overflow or purge other information out of the table if it receives too much information so basically what you do to perform a CAM table overflow is you send hundreds or thousands of spoofed Ethernet frames with spoofed MAC addresses to the network and overflow the internal CAM table of the network switch so here the network switch gets filled up starts purging out legitimate data and now when legitimate traffic or legitimate frames enter the switch it doesn't have a pairing in that CAM table for a legitimate MAC address so it ends up broadcasting it to all of the ports on the switch so effectively turning the switch into a hub just like we're able to do before so now we can sniff again on we can now sniff again on traffic on the local network just like we were able to with the hub there are weaknesses though with these different ARP attacks ARP cache poisoning in particular most all of the current methods of ARP cache poisoning in the tools that perform this particular attack as well as different papers that identify how to do ARP cache poisoning utilize ARP reply packets as a way to inject the falsified information into a host ARP cache table but as we said before not all OSs most will update when it just receives a gratuitous ARP reply packet even though it didn't send out a request but not all OSs will some tools have overcome this by sniffing the network and so when it sees the first ARP request it races to respond faster than the legitimate host in order to inject its entry into the ARP cache a CAM table overflow obviously also has weaknesses and drawbacks CAM table overflow requires hundreds or sometimes many thousands of spoofed frames, spoofed MAC addresses in order to actually overflow depending on the switch that you're actually using so obviously if you're a savvy network engineer and you've got ethereal running then you can probably detect that an ARP cache or a CAM table overflow or something funky is happening on your network it's very identifiable, very noisy lots and lots of crap packets on your network and we also can prevent the traditional CAM table overflow with technologies like port security, Cisco's port security and other related types of technologies that actually can just limit the number of MAC addresses that are allowed to be identified on a given port so if we plug in to port 34 and we send out thousands of bogus frames then port security says oh well there's only ten allowed on this particular port and so then can either turn off the port or ignore traffic after that or whatever so we're not able to effectively overflow the CAM table because we can't get that many frames passed so this really kind of mitigates this is kind of the default answer for mitigating the risk of a CAM table overflow again really can't, the whole idea of a switch a switch is not a security device relying on that you have a switched network to prevent people from sniffing on your network is kind of retarded but people do and people that they rely on using port security or they had to add port security because this was kind of an issue along with other issues in switch networks so we're going to go over some new, kind of not completely new but attacks on ARP and kind of take a different approach than the traditional attacks to do this I wrote a tool called ARPcraft which basically just allows us to put together ARP packets and send them on the wire with whatever information we want put into the different fields of the ARP packet so this is kind of the different options that are available with ARPcraft we have, we can specify the interface we specify the source hardware address the source protocol address the target hardware address and protocol address whether what the opcode is whether it's a request or a plie packet and we can also specify the Ethernet source and Ethernet destination so if we want, by default the Ethernet source and destination match what the target hardware address and protocol address or sorry, target hardware address and source hardware address fields are but if we for some reason want to put a different MAC address in the Ethernet frame than we have in our ARP packet then we can do that with those flags again we can also set the interval so in seconds how often we want to send this packet out onto the wire by default I think it's at 5 seconds so every 5 seconds, whatever ARP packet we've built we send that out onto the wire every 5 seconds and then account, we can set how many we want to send out so if we just want to send out 1 or if we want to send out 5,000 we can set that without having to re-run the tool this is a pretty slide not quite sure what the point with that was anyway here's an example of using ARPcraft to send out an ARP request to the destination protocol address of <IP_ADDRESS> which has a hardware address of 00.00AABBCCDDFF and we want it to say that it's from <IP_ADDRESS> at the hardware address of 00AABBCCDDEE so we use ARPcraft and we specify the interface with the dash i dash sha we just put in our source hardware address in there, the MAC address that we want the packet to say it came from and the SPA, the source protocol address the IP address we want it to say it came from and then the target hardware address and target protocol address respectively and then the dash o flag we want to send out a request packet so here you'll see the tool kind of prints out a snapshot of what our packet looks like kind of a layout of what the different fields in the ARP packet are going to look like so that if something looks wrong you can cancel it and maybe you made a mistake in the options or whatever and then it just goes ahead and injects the ARP request to the wire same thing with this, just another example of let's see, hmm, anyway okay, so another approach to ARP cache poisoning, instead of basically instead of using ARP reply packets we went over the weaknesses already to a certain extent of ARP cache poisoning or the traditional methods of ARP cache poisoning so again, some OS's don't update their ARP cache just when they receive a gratuitous ARP reply most OS's, if not all OS's according to RFC, won't just add an ARP entry into the cache if it doesn't already exist in the cache when it receives a reply, so that's a little convoluted as far as that sentence, but basically what that means is if I'm a host and I receive a gratuitous ARP reply because I didn't send out an ARP request and then I just receive an ARP reply saying <IP_ADDRESS>, the gateway is at, you know, blah if 1.1 is in my cache and I'm a retarded host then I will update my cache and say okay, 1.1 is at blah MAC address but I'm not going to add it to my cache if it doesn't already exist there I'll update it if it's already there but I'm not going to add a new host to my cache an ARP reply that I never sent out a request for then another weakness is like along the same lines, some OS's specifically Solaris, Solaris has kind of traditionally been kind of harder to perform ARP cache poisoning on because the problem is that Solaris doesn't rely, they don't really conform to the RFC specification as far as what to do when you receive an ARP request or reply if it has an entry in its table in its local cache and it receives either a reply or request or whatever it doesn't update it, if it differs from what it already has in its table it does nothing but instead it just goes on a timeout so it waits for that entry to timeout then it sends out a new ARP request and resolves it in that way so in order to poison you're basically stuck in this condition as far as you have to wait for Solaris to timeout its entry then send out the first request packet and respond with a reply faster than the legitimate host in order to poison a Solaris machine in a way that has, if you can do it correctly it has a certain benefit because then that host that entry, your forged entry is not going to be updated by even the legitimate server or legitimate machine, it's stuck in there until it times out we notice though that RFC 826 which specifies the ARP specification says that if instead of an ARP reply if a host receives an ARP request so if I am sitting along as JoBlo host and I receive a request for my information so my MAC address according to my IP then the target protocol address of course because it's sent out to broadcast if it matches the information that I have if it's my protocol address that it's looking for to resolve the MAC address then before responding first the host updates or adds the source protocol address and hardware address pair to the local cache so again if somebody asks me for my information whether if I have that information if I have their information in my cache or even if I don't first of all what I do is I check if it's in my cache if it is then I'll update it if it's not I actually add their information so basically it's for performance reasons so that if you don't have to both exchange and send out ARP requests only one request initiation will update the cache on both sides if you send out a request to a victim or to a host they'll update their cache with your information as well so that they have the cache now in order to speak with you further the actual verbiage from RFC 826 you can see there it's pretty straight forward it basically just says what I just said so instead of using an ARP reply packet we can use an ARP request packet to inject our information the information we want into an ARP cache I mean in order to poison their ARP cache so all we need is a single packet we don't have to wait for an ARP request to come out from them and try to race with a response all we need to do is send out a request with our information and most hosts will just update if that host already exists in the cache otherwise you can actually add new entries where with a reply packet it's not going to add a new entry into the cache but we can actually inject new entries into the cache using a request packet so here the attacker without being initiated by the victim 1.20 the attacker just sends a request packet to 1.20 saying it's from 1.1 but it's with the attacker's MAC address so we see that the opcode on this packet is 1 or a request so we're sending a request packet to 1.20 and saying the sender hardware address is 00AABBCC01AA which is the attacker's hardware address and then saying our protocol address is the gateways and then sending it to the victim their target hardware address and protocol address sorry? yes sorry? oh I'm sorry he said is it Unicast? yeah sorry I'm bad at that so throw things at me if I don't repeat the question so I'm going to kind of demo that so I'm going to send say here we have our victim here it's a free BSD box and I'm going to just enter a random MAC address and IP pair into its cache so here we have the current ARP cache which has an entry for 1.1 and 1.157 okay so we're just injecting <IP_ADDRESS>.163 an ARP request packet from 1.2 saying that 1.2 is at 00AABBCC01AA so now we'll go over to the victim and look at the ARP cache and we have an entry for 1.2 at 00AABBCC01 so we can just arbitrarily enter entries into the ARP cache using request as opposed to just gratuitous reply packets I'll demo a little further that we can overwrite 1.1 our gateway with 00AABBCC01AA by using request packet 2 so here 1.1 now now we've overwritten the gateway address with 00AABBCC01AA so it's fairly straightforward ARP cache poisoning technique but it's just using a different packet type so it's a little bit more reliable on different hosts so again we talked about the weaknesses of some of the ARP poisoning techniques CAM table overflows they can be prevented with port security they can be very easily identified by an intrusion detection system or an administrator running TCP dump it takes thousands of packets usually in order to perform a successful CAM table overflow do you have a question static CAM entries static entries are usually a fairly acceptable defense for any of the even for ARP cache poisoning as well static ARP entries are probably the best way to go as far as defense in your average enterprise network you can't really create static entries for all of your hosts so that's obviously a mitigating problem so we went over those problems often usually we don't really need in a real targeted attack we don't really need to sniff the entire network for something I mean it might be nice sometimes but usually we're going after one machine or more targeted approach especially if stealth is in order at all so there's a couple of ways that we could already do that we can already inject into poison the ARP cache of a civic host so a man in the middle attack essentially allows us to sniff as well because traffic is going through us so it's kind of a targeted sniffing approach that's how most people get by sniffing on a switch network without using a CAM table overflow you just poison the ARP cache and perform a man in the middle attack and then you can sniff on that traffic but obviously that's not always appropriate because now your MAC address is the CAM or the ARP cache table of the victim so you can forensically and further it's just easier to identify who's actually perpetrating an attack but a little bit back before as far as the whole CAM table scenario if a switch receives a frame and checks its CAM and doesn't have that pair an entry that matches that frame it again it floods it to the entire network so we can accomplish the same thing as opposed to flooding and overflowing the entire CAM table we can accomplish this type of attack by just again utilizing the ARP cache poisoning technique instead of poisoning and performing a man in the middle attack we just poison the target with a null MAC address and so basically when the target sends it out onto the network the switch doesn't have an entry in its CAM table so it floods it to all ports again but it still gets through the gateway, the traffic is not going to be interrupted so even if you don't, if you're in a man in the middle attack you actually have to route the traffic back to the legitimate host here it gets to all the ports and the legitimate host is still going to pick it up because it's got a null destination on the frame so so we can kind of we can perform targeted sniffing or eavesdropping on a switched network by using this technique and this works on every switch that is out there because it's really the underlying principle is that it looks in the CAM table and since that pair, the null MAC address pair doesn't exist in the CAM table then it floods it to all the ports this doesn't require hundreds or thousands of packets it requires a single packet in order to inject or poison the ARP table of our victim host so port security is not going to stop it even if we're sending it to multiple hosts we're not sending spraying thousands of random MAC address or frames with random MAC addresses out to the network in order to overflow a CAM table it's only a single MAC address and so we're not using multiple entries in the allowable entries from port security etc and obviously it's less identifiable a single packet it's a lot less identifiable on your network than thousands of bogus packets few other fun little things with ARP some OSs can actually be poisoned with their own MAC address for the destination so here we can actually poison say we want to sever a connection or denial of service connection between a host and a logging server all we have to do is send a request packet again with the sender hardware address which equals the host that we're poisoning and the target hardware address equaling the host that we're poisoning and then the target protocol address and target sender protocol address with the hosts that were the target would be the host were poisoning and the sender would be the host that we're masquerading as and now we can completely it doesn't even send it out to the network because it thinks it's local and so the traffic never ends up on the switch so it can't communicate with the log server et cetera yeah windows will let you do it Solaris will let you do it I I don't think if I remember correctly FreeBSD I think doesn't do that it actually does check if it's already one of the local interfaces so just the tool Artcraft is going to be released so play around with it there's other network testing tools like Scapi and things like that that can do similar things so here obviously tries to log to a network syslog server the attacks that you've done after poisoning and cache so nobody's going to see anything other than on the local host so you pop whatever vulnerable service and drop the logs there another thing that's kind of cool or kind of fun silly is that if a host receives an ARP request or reply with the same protocol address as its own or one of its own interfaces but a different MAC address so some other host on the network is saying that it has that IP address then most OS's Windows Nix's things like that will complain to the user whether it's via syslog or console log or in case of Windows it actually pops up a dialogue there's duplicate IP address on the network so you can play games with Windows users by sending them or popping up this nice dialogue or a bunch of times there's no real engineering attempts actually because if you do this a bunch of times in a row or just do it in a loop it actually burns up quite a bit of clock cycles I've had Windows machines just crash if you just kind of keep sending them but or if you just do it for a little amount of time and you call up as tech support and say that apparently they've been having conflict of IP addresses and ask for their username and password most people actually do it it's kind of fun other fun with ARP the Kaminsky factor got to throw in a covert channel over any protocol like DNS or ARP or whatever so just like any protocol that has optional fields or fields that you can play with you can throw other data in it and get it across so we can use ARP secret information over a local area network basically I had a demo but it's the other hardware not working so but I do have a better demo actually so we're actually in this case just using a sender hardware address field which is just four bytes or six bytes of bandwidth per packet like I said four I had to rewrite this stupid slide deck last night because I only brought the PDF version stupidly so excuse any typos please because I wasn't not partying either so anyway we get six bytes of bandwidth per packet somebody's saying something and then basically in order to just kind of simply obfuscate the message over the wire we just threw in a little bit of XOR encryption with a shared key between the client and server and can receive secret messages we could increase the bandwidth per packet by using more than one field or even more simply since like we went over we can specify the length of the address fields we can specify whatever length we want for the hardware address field or the protocol address field and just stuff as much data as we want a length of 1,024 and stuff a kilobyte of data into that hardware address field or the protocol address field and put one packet on the network and get all the data we want another kind of kind of extra thing instead of just passing messages over the network I kind of went a step further through together ARP SH I'm going to show you just a fun little proof of concept remote so called encrypted shell over ARP so fun for back doors kind of just proof of concept it's totally buggy right now but basically it consists of two parts ARP SHD and ARP SH and again we just obfuscate the data so dumb network administrators can't just see our complete traffic via XOR encryption and a simple shared key so I'll demo that here's our victim so somehow we've popped this machine with whatever vulnerability or whatever so we're going to start ARP SHD and over here actually over here we'll just start a network sniffer so we can see what traffic is actually being passed it's not actually wrapping it through town that or some crap like that so put that up here and we so there's no ports listening on the victim server or anything like that it's just monitoring ARP traffic and detecting our command executing it and sending it back all over ARP you can see all the traffic here so fun stuff the moral as far as that goes is just you can't really trust any protocol to be what it really says it is what we're doing there is again just sending the data via the sender hardware address sending a little bit what two minutes oh sorry well I think we're so ARP Venom is a tool that it kind of automates these attacks check did drive.org for release and updates on that it should be up pretty soon I don't think it's I got it posted yet so again traditional ARP attacks work well and they're good standbys they have certain weaknesses so there's certain cases where you can use some of the techniques that I showed today that would be a little bit more effective targeted sniffing can be again accomplished by poisoning with Null MAC addresses for the intended destination a lot less noisy than cam table overflow can still do kind of the same thing so a lot more reliable too for switches that have port security and things built in so any questions I'm sorry yeah the question was if you poison a victim with a Null MAC address in order to do sniffing does the destination host while you get the data and are able to sniff the data is the transmission interrupted? does the destination actually still get and process the data and yes in most every case it does actually accept and process that packet anyone else? well thank you thanks for your time


Good morning, John. After college, I got a job working all by myself in a fungicide quality control laboratory. I know, so it's super exciting. It was actually pretty exciting though, because I was the only person there, and so I managed the lab all by myself. I ordered things, I designed SOPs, I did all the tests, I listened to lots of punk rock. But also, it was awful, because I would go to work, and I would work all day, and I would not see a single living thing that wasn't a mold. It was extremely boring and lonely, as evidenced by these pictures of me wearing produce bags on my head. I'd just gotten my first digital camera, and I was out to make some content. But then, some days I did see other living things that weren't mold, because it was Florida, and I might see a black racer, or a frog, or get stung by a yellow jacket. And then one day, I saw outside of my window, this little group of armadillos looking real cute, and I thought, I'll take my new digital camera and I'll take a bunch of pictures of them. Now we are aware these days that you can get diseases from animals, and you can get leprosy from armadillos. The official advice is, do not handle them unnecessarily, and I did not.  I think because they thought maybe the used or seven seconds was actually like a little bug crawling around, as they do use their rabbit-like ears to listen for prey. Good fact, actually, the Aztec word for armadillo translates to turtle rabbit. I did not get leprosy from these armadillos, but even if I had, it's fairly treatable now, so that's good. Also, sometimes diseases cross from animals to humans, and we hear a lot about that, but leprosy actually jumped from humans to armadillos, so this is not their fault. I took so many pictures of these armadillos.  Armadillos are most closely related to anteaters, and there have been and are lots of species of armadillos. Pink fairy armadillos, three-banded, nine-banded, giant armadillos. And then of course, in the past, there were the gliptodons, now extinct, probably because of, guess who, us. But this video is about the nine-banded armadillo, the only armadillo native to the US. And this species also lives other places in North, Central, and South America, but the subspecies that lives in the US, interestingly, are all very genetically similar, suggesting that only a few made it this far north before establishing a population. These armadillos also always have litters of identical quadruplets, so that roll I was hanging out with, and yes, roll is the collective noun for armadillos, were probably brothers or sisters all genetically identical. Other awesome things about armadillos, they live in places where there's a lot of water, so they have two different ways of getting across water, and they can choose which one they do. They can either walk under the water because their keratin plates make them so heavy that they sink, or, or, they can inflate their digestive systems and swim on top of the water. And they have lots of choices in their lives. For example, mommy armadillos can decide after mating whether she wants to have those babies now, or postpone it. If she's stressed out, she can push it for up to two years before she starts developing the embryos. Also, when they're threatened, they jump really high up in the air, which is a cool strategy to scare away a predator. It's not great. It's scaring away cars, which is why you might see lots of armadillos on the side of the road that have had bad outcomes. And that is sad, but the good news is that nine-minute armadillos are great at surviving in the human-created landscape, even of an office park outside of Orlando, Florida. They are abundant as a species they are doing very well. And I love them, and I loved going back and looking through my old pictures from 2003. And if you are a member of the Bizarrebius Pin Club, yes, you will be getting an armadillo in your mailbox sometime soon. John, I'll see you on Tuesday.


Hello Brian Thompson yeah and so we are where this weekend and what are we doing here okay now in case the in case the camera didn't pick it up we are we're promoting skepticism to Geeks is that what you said okay Geeks in a good way. Not the kind of people that will eat anything that you want at a circus site show. People who enjoy science and skepticism and science fiction and weird costumes. So we have all sorts of educational materials here that JR produces and you can see over there we have our do you have ESP educational module. We have bumper stickers, flim flan, all sorts of skeptical topics, UFOs, psychics, Atlantis. Right. We have million dollar challenge checks as you can see. Now is that a real check Brian? It's semi-real. I mean it's physically here. You can't cash it for a million dollars but you can learn more information about a million dollar challenge on the map. And for new members to the JRAT if anybody pledges a membership to our organization we can get away free TAM DVD sets. We have James Brandy's books. We have t-shirts as you can see in the front here. Oh t-shirts are sort of Mortal Kombat inspired debunked t-shirts. You said Mortal Kombat inspired? A little bit I think. And so that will appeal to the DragonCon crowd right? Yeah I think it will appeal to anybody who likes graphic buy. So who's on the t-shirt? Oh it's me. We have. Who's the monster on the left? It looks like some sort of crazy swamp, maybe the thing from the Blackwood. Ah Sylvia Brown. Oh Sylvia Brown. Yeah that's right. We have Randy and then we have Erie Geller looking very dapper actually. Yeah dapper and... And ready to... Marshall artist with his spoon and fork. Sure. Yeah. Okay Brian well we will check in later on in the weekend.


In this video, we're gonna provide the solution for question three on the final exam for math 12-20. And in this question, we're asked to determine the convergence of the series where N ranges from one to infinity and we add together the sequence two over five to the N. If the sum turns out to be convergent, let's actually find out the number it adds up to B. And if we think it's divergent, then we can select divergent as option F. Now, in this one, the key is to recognize that we have a geometric sequence. We're adding together a geometric sequence so we get a geometric series here. And so when it comes to a geometric series, we do a very quick convergence test. The convergence, we have to look at the constant ratio. What is the number? That's gonna repeat it over and over and over again as we progress to the sequence. And we get this from the exponential expression. We get this one over five to the N. So that means our constant ratio will be one fifth. And we're looking for the base of our exponential growth in this situation. So that's a small ratio, right? The ratio is less than one. So this tells us that we are convergent. So by that information right there, we've already determined that F is not the correct answer. We have a convergent geometric series. Well, what does it add up to B? Well, what we get here for these geometric series, these things will always add up to be A over one minus R where in this situation, the R is the constant ratio, so you get one minus one fifth in the denominator. And then A is just the first term of the sequence. Take the bottom number right here and plug it in. So when you plug in one, you're gonna get two fifths. And so now we just have to simplify this fraction. We get two fifths divided by, well, one takeaway of fifth is going to be four fifths. If you're struggling with that, just multiply by the reciprocal, two fifths times five over four. The fives cancel, two goes into four, two times. And so we should be left with one half, which is option D. And so for this question, as long as we know the geometric series formula, we could apply that and be able to answer something of a similar type.


Okay, so I'm ready. Welcome. My name is Yoko Shiro. I work for the networking services team like the last presenter And today I would like to talk about actually the title is quite nice. It says Kenobi has to be further optimized But if you read the description, it's more a little bit more about Finding a good baseline and then tune the performance So we get steady results So what is open V-Suite actually about so open V-Suite is a general purpose Virtual switch that use open flow rules to make the switching decisions And I think what I want to emphasize here is the general part Because it means it should work in all scenarios and it's not really optimized for a specific scenario To do the best performance. So if you would like to increase the performance a very easy way It's just to add more CPU resources to it And then you can increase the performance for probably all the scenarios that it's running running on So what is the performance for OBS DPDK? What is it based on? So the data path for OBS DPDK is basically it's a dedicated threat or a number of dedicated threats on a dedicated Set of CPUs which are only used for packet forwarding And what it does it gets at most 32 packets from a specific driver Reads those 32 packets and then tries to classify them with specific flows that are configured And then when all the flows are all the 32 up to 32 packets are classified They will be grouped by flow and then all the actions are taken So they're basically they put if you have 32 packets come in there for two different set of flows We will put them together process all the actions for once and process all the actions for the other The idea behind is that your cache is nicely hot. So you would do the same packet processing of all those packets And then once all the actions are done based on the group the packets are sent out. So that means that packets get reordered Per flow enough per flow, but per Set of flows so you might see packet reordering in that scenario So what is really influencing the packet performance in general is one of the main things is the flow lookup that takes most of the time So there is a different set of actions that's taken when the packet comes in to figure out what the flow is On the DPVK data pad it first tries to do an exact match. So would calculate the hash over the five tuples of the packet And once those five tuples are known, it will try to see if it's in the cache This cache is limited. I think about 8k on default If it hits the cache the packet is forwarded directly and we're good to go If it misses there is a secondary. Well, there's a new up lookup, which is the signature match as MC This is newly introduced in OBS, and it's still an experimental phases So it's disabled by default, but it adds another layer of caching And then you have the data pad classifier as the next level if it finds the flow there It will go back into the tree So it will program the MC cache or SMC cache if you have that enabled and you will go back and the packet gets If you even miss the data pad classifier you go to the open flow protocol classifier And I marked it as red because if you look at the kernel data path The first three items the blue ones are actually the ones that happen inside of the kernel So that's the data path part. There's different caches, but it's the same principle And then if you hit the red type that basically means you go to user space So the kernel module is calling user space and just look up And this is the part that the handler threads are taking care of So if you see a lot of CPU utilization in your kernel data path on the handler threads That's probably because you have a lot of packets going to a slow path because there is no no flow In the data path What else influences the performance for OBS DPDK? I think one thing is the the mutexes and the locks that are in the code in several places There are very limited places in the data path that have locks, but there are some like bonding for example has one known And then the other thing that I think is probably one of the biggest one is the the syscalls So they try to make the data path for DPDK as syscall less as possible But there are still syscalls being taken due to the existing infrastructure Of the legacy or legacy the kernel data path of OBS. So the slow catalogs One of them. I think that takes the most syscalls. Maybe not the most CPU, but the most syscalls Is the The locking And the ledges the ledges you see here, which is the use for the rcu a lot because they use a lot of their own rcu library within OBS And that actually takes care by waking up the threat by using the right call You see quite a lot of them. I have a nice example later on And then the cross-NUMA Communications also if you have two virtual machines both in a different NUMA node Their memory transfer is going to be at least I know has to cross the interconnect of the two CPUs So what can we do as a developer? So There's things you can change Inside the code that might make it faster for for a specific use case One of the things that's recently be added is the partial hardware upload which basically There's a nice block from cloudy on that as well on our blog page But what it does it takes the package that come in It tries to match up the the flow and then put the marker in the hardware saying that if you see this flow again Let me know what the flow ID sort flow marker flow identifier is So you don't have to actually go up and do all the lookups and do the cache you Sorry the hashing algorithm, so you directly know which flow to pick out of your tail Um, of course full hardware upload. It's being worked on currently upstream That will actually take off all the cpu load or at least most of the cpu load load of the packets You can disable the emc cache if you have a lot of Traffic streams flowing at the same time and you will be trashing your emc cache It doesn't really make sense to have it enabled because you still have the overhead of calculating the hash And trying to find it so you can rid of that part Maybe you can come up with better hashing algorithms to use SMC is one of the examples that's recently been added Another thing is if you have multiple threads that actually pull your packet drivers Some interface might be very busy and a couple of other interface might be very You know relaxed you have a couple of packets coming in you can do a rebalancing of the queues through different different course If you have a very busy core that's doing three queues And you have another core that's only doing one queue you might be able to shift Some of the workload to a different core So you have you know more balance within your processing You can try to see if you can remove locks within the system It's going to be a tough thing because a lot of the code is shared between the kernel data path And the dbtk data path and maybe additional data paths coming up in the future So it might be hard to change because it's you know, it's an embedded thing within the entire infrastructure And then we can see we can remove syscalls Some ideas that I was looking at and it's like maybe we can offload some of the syscalls that take a lot of time to a separate threat Into the system it requires probably another dedicated core, but I think there's other Features that actually also move into having an additional core in the system So maybe we can you know move stuff out an example is for if you have configured a external controller And you have an unknown packet that needs to be sent to the controller Currently what what happens is it the udp? Transmission in the kernel data path happens inside the pnd threat.  You're probably going to drop some so that's a could be a nice enhancement So even if we do all that work, I mean the main question is will we increase the performance and I think the The answer is that it all depends on your environment Like we like I've seen in the past is that everybody has a different environment And people test like different environments as well So if you look at people that are doing like upstream development on obs They tend to try to optimize a specific use case or their specific use case And they don't Test with all the other possibilities of people Whether you're using obs because obs is general sometimes you might miss a test case for someone else So you don't really get the performance increase. You might even get a decrease in your specific scenario While other people will get an increase in their scenario So what are the dependencies for your environment? I think the number of pnd threats you have might be an issue Why why you get a better or worse performance? For example, if you have 15 virtual machines with all one queue you need to pull 15 virtual machines queues constantly If you have one threat and you pull all those 14 15 queues on one threat If you make a performance optimization in your your driver For that V host user you might get the performance increase because you're pulling like the 15 ones But if you Have some of the parts that you have a hardware driver pulling You know if you make V host optimizations, and you only have hardware drivers. It doesn't really help you in that scenario So it's pretty important. What kind of Drivers you have how many queues you have assigned to it because you might be pulling 15 queues on one hardware device driver So that if you make an optimization into hardware advice, then it might help you there Um Something that's very important is is the The open flow rules that you program and how often you change the open flow rules because if you have your data path Rules programmed your open flow rules are there and then you make a decision to remove all your open flow rules and insert a new set That basically means you're going to flush your caches and every packet that comes in from a new flow needs to be relearned So if you like every second change your open flow rules That means that you might get a lot of flushes and you get a lot of packets to your To your learning to the learning phase going all the way up in the cache diagram that I showed earlier Then of course also the data path rules that are are active in your system So let's say that you have a million flows going into your system In theory you could have a hundred data a million data path flows in your system But what the system does is that it times them out. So after three seconds no traffic Your flow gets removed if a new someone else opens a web browser gets a new website that flow needs to get added So if you have short-lived sessions or a long list session that also influences the performance Of your system because you need to refresh your your cache or not. You need to do the additional lookups or not So it's not only the volume of the traffic the type of the traffic But it's also like how many sessions are you tearing down up and down a second? Do you have long list sessions short list sessions stuff like that? Is it only tcp because you have different you have a complete flow set Is it like a completely different protocol that you're using or a custom protocol that you're using? so I think From an upstream perspective what we really need is a bunch of reference architectures where we can say, you know in the field people using xyz a set of users are using Another setup setup system. So maybe some people use it like Maybe only a couple of virtual machines and that's it other people might be running 100 virtual machines But with low latency traffic and other people might run it with high latency traffic or a million flows or only 10k flows um That way if you can test it If someone makes a change upstream you can maybe run your baseline Tests like maybe the five or six whatever baseline tests or setups you have And then you can see for which specific use case you have an increased performance And you can see for what specific use case you have maybe have a decreased performance And then it's it's easier to make a decision You know, are we going to apply the patch or are we going to enact the patch and say, you know At least a bit more optimization for a specific use case um So how do we get that data and i'm i'm looking at you guys that i think if there are people that are willing to share some of the data um Then that that would be at least a good start to create a use case um what I currently Do is I Test like my scenario normally with what do we call a pvp test and i have a link later on If you want to take a look at it But basically you send a bunch of traffic in you look it back in the virtual machine and then you you send it back out And based on the number of flows You please close the door So what i've done is um What will be nice to get so I I put a list up here with some stuff that would be nice to get Dumping some of the flows dumping some of the ports. So we have an idea what actually Is used in the system And we can probably come up with the reference architecture for that when we were testing Our scopes quickly go over it. I it's in the slides that are online So you can if you are willing to share your data You can look it up the other thing that I have is the sys calls So I've been I'm able to get whatever sys call I want In my setup and I but it's not clear how to optimize for what sys call Because in some scenarios or at least in all my scenarios It's in the common scenarios I'm not getting a better performance if I get rid of the sys calls But it would be nice to see what kind of additional sys calls are actually in Customer environments or test environments that you have and then we can probably optimize for specifics What I've done to get an idea is What I do as I run a perf script for a couple of minutes Capturing all the sys calls that the pmd threads generate And then what I've done I have a small python script that actually It tells me what sys calls are called for which pmd thread It's just the overview screen. So it doesn't really tell you much only that you get a lot of a lot of them But then what it also does it analyzes the callbacks for all the specific sets and it gives you a callback For every sys call and then collapse them. So in this case, you see you see that you have like Was it 56k of callbacks for this specific code path? So we can try to see what would be the best one to optimize if we ever get time to optimize it So what's next? I think if you were willing to share it, you could send me an email and then my statement would be that I would try to You know, collect them all try to make some general use cases out of them share them upstream and then For me, the ultimate goal would then be to actually add them to the link that you see here the bottom link Sorry the top link That is the script for running the pvp test and then if I could incorporate some of those use test cases It will be easy for me to run it against whatever, you know set of data or patches that are available And then the other link is for the Python script that if you would like to do some analysis of the sys calls So that's the data I have so hopefully there are some people that are willing to share some other data Maybe have a better casting upstream That's it. Any questions? Okay, if I have the open nv testing, this is the vsperf one, right? Yeah. Have you ever tried to set it up? Okay, I think that's the answer. So so yeah It's possible to use that as well It has similar features that's what I have But it's really hard to set up because it requires you to have a defined setup and it will do everything for you It will configure everything download the virtual machines and in the development environment It's not really friendly because you have your own machine You really want to run a test and with this I just have one command line I run I get the graph or whatever I want and it's done So yeah, but it does the the performance testing for you as well. It has the same features as this I just walk around the lines but if you work with this If everyone is doing his own side Yeah, I mean that will be yeah, but the thing is with the open the that test suite It only does like we send wire speed traffic. See what the performance is we do rfc 2455 test and that's it and there is no environment out there that That that mimics that environment right Tell me like one customer that has the rfc 2455 type environment, right? And that's the problem because you can opt the thing is you can optimize To your likings for that specific test scenario, but the performance for a real life scenario might be really bad Yeah, yeah, I think the automatic optimization is outside of b-switch It's outside of space. Oh, sorry. Yeah, so the question was Is there any Work in progress to optimize the flow set? So if you configure the rules to optimize them That's the question, right? So from an ovs Open flow perspective if for rule optimization We rely on the open flow controller to do that to get the most You know the best set of open flow rules and then the data path will do its own optimization So if you look at the slides a couple of you see the smc Those will do try to do some optimization on the given flow to be faster to look it up So there is some optimization there no more questions


If you're like me growing up, you've had a month that I always told you to make your bed and if you're like me You don't never understood the reason why she said this Why would you make your bed when you have to freaking make it again later on in the day? You're gonna mess it up and have to redo it. This is pure insanity. Why would you waste your time? I mean sure when you make your bed it looks nice, but it's not practical Or is it it's much easier just leaving it as it is and then hopping back in the sheets at night time Well, this was my thought for many years until I watch a video by a Navy Seals Admiral Now this guy he said the reason you make your bed isn't Just cuz it looks nice. The main reason is because it creates discipline There's a hidden wisdom behind making your bed. The first thing you do when you wake up is you make your bed It's a simple task. It's nice and easy But you complete it and you can tick the first box off for the day It creates a bit of momentum throughout the day the first task is completed You made your bed now you can move on to the next thing and the next thing and the next thing after that Do you see? It's the small things that don't seem significant in the moment that add up the small things that don't Have any real urgency that add up These are the things that you do in the background and over the years they compound And that's when you get great results See whenever someone has a big success, we always see the event will see them Make the millions of dollars will see them get the movie role Score the winning Super Bowl goal or whatever But we never look at the small seemingly mundane toss they did day in and day out that led them to get there Making your bed is one of those tasks It creates that discipline that you need So next time you wake up make your fucking bed


What is up guys and welcome back to the John Q channel. Thanks so much for watching. I'm pumped about today's video because we get to review the Sandmark action gear lenses. Today's choice of lens is the telephoto lens. This video is going to answer three different things. Number one, is this a good lens? Two, is this lens beneficial for you as a photographer? And three, who is this lens for? So stick around. But I think Sandmark is trying to do here in the world of photography and video. And when everyone has a mobile device, what I think they're trying to do is create a more convenient and better way to help people create better content and get better photos and better video. But really, let's like, hear me out. The fact that I can unscrew this that acts like a holder to my lens is just mind boggled. This is an incredible piece of gear and technology for that reason. I can literally put this in my pocket. And be done. Oh wow. Look at that, there's a squirrel on the ground. I really want to take a photo of that. All I have to do is screw this thing on there and I'm, boom, I'm ready to go. Like it's that simple. It really is that easy and for that, I think Sandmark really nailed it on the head. We live in a world where it's all about convenience. Right now, I want it right this second, like instant gratification and what better way for a photographer, a creator, or videographer, like the small and simple, but yet very effective lens for your iPhone. That's why I love Sandmark and what they're doing. They call themselves action gear because they want you to take action. Feels like whenever I put these lenses on my camera, like I have to go take action. This type of gear is for the people who really want to step up and elevate their photography game, period. Do you get it? Do you get what I'm saying? I don't think just anyone's gonna go on and try to buy a telephoto mobile lens. Like it's just not going to happen.  The game has totally completely changed. It's done a 180. Photography is now done on our phones. It's amazing the quality you can get from iPhones, but the fact that you can elevate your game with such a simple device for very, very cheap, it's very affordable. There's no reason why your IG game should be like, boom, 100%. All your photos should be looking like stellar shark, stellar like everything. There's no reason. If you're serious about your photo game, if you're serious about your video game, the Samurai lenses, they're gonna further help you in your game by elevating all your content. That's it. That's all I have to say. Like I could go home right now. That's all I gotta say. Nothing else, there's nothing else I should say because you should just take my word for it because I've been doing this for a long time. I sound like a crappy salesman right now. I'm not trying to, but I'm just really passionate about creating content and when companies make it easier for me to create content, I'm all for it. Like I rave about that stuff. I get pumped. I love it.


It's gonna be um There's the z move We'll get stacks in Hey everyone and welcome back to another episode of our road round VGC 2020 battle series. My name is Lee also known as Osiris and today on the channel We're gonna be starting with a brand new team. It is on the screen in front of you right now There is a raw pissed and a poker pissed down in the description below If you guys to check out and try out if you like to I can't take any credit for this team Because this team belongs to a good friend of mine and a patron of the channel who won the flinch squad Invitational championship over the past weekend. So this past weekend if you didn't catch it. It is on twitch I will be uploading it to the channel and featuring those matches there the commentary the whole evening And you'll be able to catch up with it there But will played throughout the whole flinch squad circuit last season the Sun the moon Ultra qualified top seed for the Invitational and then went on to win it with this team here So absolutely incredible run a massive Congratulations to will once again and to all of our other players that competed in the Invitational It was just a pleasure to do the event. There's a lot of fun Obviously had Ben here co-commentating with us and it was a really nice evening And I hope for you that that did catch it or go back and view it now That you enjoy the event on a haul and any feedback from the event would be great to hear Obviously, I will link the twitch channel down in the description and I will be starting streaming and a proper schedule coming up very soon So stay in tune well stay tuned for that I guess so I hope you all had a weekend a good weekend We're back a little bit later this week because of the invitation I didn't have really much of a chance to record any content from Monday Tuesday So here we are Wednesday content is here and we'll play this team We'll probably play it on Monday as well because I'm away at a double MSS this weekend in all-pinton Cannot wait got to get some points on the board starting this weekend So hopefully I do we'll play this team on Monday, and then we'll come back and I'll play my MSS team All teams next week on the channel. So Without further ado my friends, let's get into this one today as always if you do enjoy this sort of content Please remember to drop a like on the video do subscribe to the channel for more pokemon content And as always leave your comments down in the description below Because I do love hearing from you and even though I can't always reply because of time constraints I will always read them leave a little heart and like when I can So don't feel like I'm ignoring you. We'll kick off with ultra recon squad. We've got a rating of 16 20 not too good I think the the last week's team Didn't go so well, but we had a lot of fun with it Of course, and that is one of the things and we found a lot out about the team that we were playing Um, but it's nice to move on to something else and something that we know is very successful I'm really looking forward to playing this core. I mean we saw will and the invitation will do so well with it And just it's got so many different modes to it and so many Explosive elements to it that make it very hard to kind of come back from hopefully it doesn't take too long to find our first opponent here today And I think I'll make the conscious effort now of just cutting it right now And we'll come back when we find our first opponent of the episode And we have our first opponent of the episode Japanese player 16 or 3 rated player. So we'll hope straight in the team preview Okay, so first opponent day playing a team of Ray Quasar, Kyogre, Tapa Coco, Incinero, Cortana and Stack Attacker It is going to be that infamous Ryogre call a very popular at the moment and for very good reasons very explosive team You've got supporting cast you got the intimidate support there from the incinero You've got a trick room check and a trick room setter and stack attacker Explosive lead again between the Cortana and the Tapa Coco and a very common call that you're kind of seeing in these teams And other teams at the minute with Kyogre is that firewater grass call between the incinero, Cortana and Kyogre Right, what do we need to do here? I've watched will so um I should know what I'm doing, but what I think what we need to do We need intimidate support for the opposing Ray Quasar, Cortana and Stack Attacker It's always going to be very helpful here. Um Or do we want to go with Tapa Coco first I mean one of the things we could potentially do is go Tapa Coco And Lunala was a lead that we did see will take advantage of quite a lot. Um in the circuit Um, do we want stacks here? I don't know if we do. We definitely need Ray Quasar though. Um And maybe Maybe incinero Hmm Maybe our own stack attack or our moongas could be good. I think incinero is probably going to be the better one of the The three that we had left so we'll go with this to kick us off today I feel like I need to adjust to the team to get used to it, but um I should have really asked will a bit more about it But I'm feeling like from watching and play I've got a good idea of how the team is meant to work And we'll um, we'll get through that this week on the channel as we're playing it So opponent is going to send out Ray Quasar and Tapa Coco as a lead Um, and we'll send out Lunala and Tapa Coco So Gotta watch out for Bandit Ray, I guess with the the crunch. Um, that could be a bit problematic Earth power as well could be an issue for us Um, now we could go for a wall switch dazzling gleam We are choice specs. So dazzling gleam going to do a lot of damage. Um, and maybe preserve our lunala Uh for later on switching to incinero at least then we get an intimidate onto this requires a Requires us tending to be More I would say on the physical side rather than the special side at the minute So if I'm guessing anything the contest count that it could also have earth power Which would we would lose Tapa Coco if it does have but I mean We'll get a good chunk of damage with the dazzling gleam on to to both targets here Um a threat from Tapa Coco speed tire Guess if it's got twinkle tackle and it goes for for that into our cocoa could potentially pick up the knock out there I'm hoping it doesn't I'm hoping it wants to break the shadow shield on the lunala And then the Ray Quasar wants to double tap into that slot Which you would imagine is the kind of the thing that you want to do in most situations because Um, we threaten trick room set up there and if that goes up It makes life a little bit more difficult for my opponent to utilize their restricteds at least I'm going to see Ray Quasar mega revolve activate that delta stream. Uh, we are going to See a dazzling gleam from the opposing. Oh, no from us. So we win. We do some nice damage Get a critical hit. Uh, voltage coming out from the opposing cocoa into our incinero Trying to break that shadow shield like I say Um, um kind of indicating that this is a sold vest Ray Quasar Which isn't so good for us because if it goes for an earth power, then we are knackered knackered. I tell you Um I thought we're gonna hit the field. Which isn't the worst thing we've got fake out pressure on this next turn So we can at least Wash that for at least one more turn. It's just about what this ray goes for And primarily you'll see all the writing that Um Crunch, okay, so that's that's fine. I mean like out of everything that kind of works out pretty well for us Um, okay, so we are locked into dazzling gleam. Whether or not we want to stay in that or not Another thing I think what we'll probably do is switch into our Ray Quasar and we will go for a Vick out into the Kyoga Just to prevent it getting a water spout off. Um, because we don't want to lose incinero too early in this game I think they intimidate support Fake out support was going to be quite important for late game for us. So, um, we'll see the opposing ray Switch out as well in incinero coming It's a bit of a shame because you kind of want to get your your requiser on the field After the intimidate to come out, um, which is a little bit of a problem, but it's not the worst Um Because we can mega evolve. I think you have to fake out our ray here. That's the thing. Um It's just what do we bring in? I don't really want to bring in coco on a full power water spout Which my opponent's going to be able to get off now. Um We could bring in lunala Because I don't think there's any threat of a dark type attack coming out from my opponents incinero Into our lunala this turn. I think it's more important to go for the fake out into the ray and possibly water spout here All right, we get them delta stream up. We'll just protect Well, the shadow shield that gives us a little bit of leeway as well. There's the water spout. Unfortunately coming out So don't want not going for a fake out Which is interesting kind of calling that bluff there going for the u-turn into Uh, lunala probably going to be able to pivot back into um either their type of coco or requiser here Maybe the the type of coco because if it's got the farium Um, no it's requiser. Okay. I don't mind this too much Um, we are berry requiser So, um, we're gonna see an ice beam. I mean is it a good time for us to go for a salt dance I'm kind of tempted to go salt stance switch into incinero here But I feel like we probably get doubled into from Um, yeah the kayoga Requiser I'd like to reset our intimidate drop as well. That's one thing I would like to do We could bring an incinero here. Um, and then we could go for just to protect I think with lunala and just try and pivot round. I want to reset the intimidate drop Um, we don't want to leave lunala open right now because a crunch if it comes into that slot We'll take us down even intimidated. So we don't want to lose lunala. Um, and I don't really Think the kayoga is going to go for a water spot here unless they suspect us switching out And they've got to worry about wide guard as well as an option. Um, there's a crunch Yeah, and ice beam. Yeah, that's kind of what I expected Could have got away with a salt stance potentially there, but we don't need to rush it. I don't think um Right, let's fake out and Oh, did we fake out the ray of the kayoga? I mean the ray probably is more likely to We could fake out the kayoga. We could double into the kayoga here because I think the ray might switch out It's just if it doesn't then I think the other thing is we could probably get tap a cocoa onto the field Uh, fake out the kayoga. The only problem is if incinero comes in now Yeah, then we're in a little bit of a sticky spot because We would have maybe been better going for a u-turn into the ray quasi and then we could pivot in something else Because now we've got that active fake out on my opponent's side of the field that is going to be able to fake out tap a cocoa Yeah, and there's the protect that's the only thing I was worried about and why I wanted fake out there I didn't want to take a water spot if it didn't protect Um, but it does unfortunately Uh, okay Now we're in a bit of a sticky situation I think we're gonna have to lose something and it's quite possibly going to be the lunala And uh, I'll bring him ray I'd have to pull a double switch. I think yeah So I don't want to lose incinero We've got ourselves into a bit of a bad spot here. Um, so we need to try and alleviate it Uh, the best we can requires are coming in. It will be able to take a water spout, uh, lunala I'm not too sure. Um, but we're not really Utilizing lunala very much in this match Is not feeling like it's a key element to winning this game at the minute. So if anything can come in and and maybe Go down it would be the lunala. There's the water spot. So, um, that if it does go down Which it doesn't wow, okay Okay, um So I think what we'll do is I really need to get Hmm I want to get some damage onto the um the kayoga to be honest, but is it likely to protect here? Because one thing I could potentially do is go moon guys beam into the kayoga Um and just protect rikwaza Just I want that fake out support next to rikwaza I want to go for the sword stance before I start throwing out attacks Because I want to be able to guarantee Knockouts on things like kayoga because I don't want to be taking a nice beam from this this range Okay, we're going to see protect maybe we see A u turn out onto the lunala Oh, it goes for that. Okay Not ideal not ideal. Um, I think we're gonna have to just double the kayoga now I mean we could go y god, but it's likely gonna go for Um, it's likely gonna go for an ice beam And that means we will lose Ray Okay, let's try it Okay, kaios are gonna go out like I don't mind this too much type of cocoa coming in now We should get a moon guys beam Oh into incineroar, which is not ideal. Okay. Well, we'll definitely see the u turn here We maybe could have predicted there and went for a sword stance You know But I mean getting rid of the cocoa is pretty nice for us. I think the next thing that we need to do is just get around um The incineroar's fake out, which is gonna come in You can guarantee Okay. Well we do a little bit of damage there. It's not the worst. It's not the best either. We are gonna lose lunala now. Um I don't think we bring in type of cocoa just yet with specs I think we just keep it back because we'll be in that same situation again If the incineroar comes in with anything like kayoga on this next turn where it can fake us out pretty freely We can't protect so kayoga are gonna come back onto the field. We're likely gonna see the incineroar come out as well And I'm hoping I need to refresh myself about this speed Tears, but it'd be nice if we were the faster incineroar I don't know if we will be because it means that we can switch into type of cocoa And reset our intimidate drop Farewell looks as though we are The faster one so yeah faking out Kayoga's probably the best thing we can do here. Um and get cocoa onto the field So we'll do that fake out kayoga switch out right into cocoa Because we're just going to trade fake outs. Otherwise, that's the thing um Which I'd like to try and avoid um There's an argument we could stand and try and go for a sword stance But I think there's more leverage in us resetting that intimidate drop that we've hired onto our outside of the field and then the next thing what we can try and do to keep ourselves ahead is go for um The switch into requiser now. This is what my opponent's doing getting ahead of us here because um We had to fake out the kayoga. Otherwise we lose incineroar Now they kind of take advantage of that making a really nice play getting their requiser onto the field Um meaning that we've got a little bit. It makes it way more difficult for us to um to cycle our intimidate again And we can't really bring in our own requiser right now But we can probably get the kayoga I will go for you turn into the requiser to try and get that off there. Um, I could discharge But I think a speck standard bolt is a as a better option onto the the kayoga here The kayoga could protect as well. That's the other option that we could see I could take an uh, which wouldn't be good So maybe the discharge would have been better because that would probably proc the berry on incineroar. Oh, we're actually gonna see ray um Okay I don't mind that we might see kayoga protect now. Yeah But I don't mind if at all because we get ray quasi in They haven't got the intimidate now Um onto our ray and they can only fake. I want all that so they're gonna take big damage from something I really wish I knew my ray quasi cuts because um I would love to go for a salt stance right now. I think that would be A big player for us salt stance Can we take an ice beam from this range? Probably I would say probably but I don't want to um I don't want to risk fake out ice beam because then it kind of really limits our requiser's ability. I mean I say that though if they fake they're gonna have to fake out coco I think we'll salt stance we'll salt stance and we'll go for a thunderbolt I'm just gonna do it There's a fake out into coco. Okay Now things start to get a little bit heated ice beam. We need to take this though. That's the big thing Ray quasi the beast. Okay. We take it Now we should be able to close this one up because Specs thunderbolt the kayoga we're going to incineroar with a dragon ascent We've got our intimidate in the back So we kind of cover the the dragon ascent drop this turn Um to make sure that extremes be the next turn from the the ray when it comes in It's fine specs coco picking up the knockout there Poof this one's been a bit of a slog to get around but I think uh, we did make a little bit of a mistake earlier on But I think we've got ourselves out of it letting the lunala go down And then taking that opportunity there to get that salt stance up And that's how quick a match like this can flip on its head Now we've got the the ray quasi to come onto the field for my opponent And there's not really too much they can do we pivot out the coco get the intimidate cycle onto the opposing ray And just extreme speed and plus two extreme speed from Is it gonna I don't know if we want to risk it probably Do we just go dragon ascent because we've got coco anyway, so it's fine. We'll just go dragon ascent Um, I don't know if extreme speed will get it from that range I'd be yeah a bit surprised, but there we see a full fit and we pick up a victory Do you proud will and show the team has got those mods to it? I I'm a bit suspect to whether the lunala was the right pick there We maybe would have been better off bringing something else But I still think lunala give us a little bit of a cushion when we needed it to so it wasn't I don't think the wrong choice in all all aspects, but I don't think it was completely the right choice either. Um, so A nice one for us to kick off with today a bit of a longer one, but like I say sometimes the better matches are a bit of a slog and It's it's mad to think though. It's like that one turn can flip and that's that's totally this format, isn't it? All right, we'll pick some music Let's go with Not battle royale. I'm not a fan of battle royale. Let's go on a cross my version one As we like to cross my version two, but we we don't tend to go on to that one very much We will keep that for special occasions Because I spam it way too much Um, but yeah, I think that match there shows like you can slog away You've got it. It's it's all about In this format really identifying and taking that little turn that can just twist it around for you And um, you've got to be patient. I think that's another thing to kind of Translate onto onto you guys's players new players even even uh more experienced players It's all about a lot of the time patience not taking risks I mean look at wolf right wolf is a perfect example of someone that is He's got like the patience of like i've never like he will just keep going keep going safe safe safe And then that moment where he knows Like he can identify a moment a bold position a moment where he thinks if I get this up now It's safe for me to do. I'm not going to lose anything by doing it Then I will win this match and it's all about that momentum being very patient methodical And then just waiting for that one maybe you know, you're not going to get just one moment per match There is multiple moments, but it's identifying the right Environment the right situation at the time for you to to do that There's not many people on battle spot today Um, but we will continue to search I'll cut it now and then we'll come back when we find our our first our second opponent of the episode So we'll be right back my friends We've got our next opponent so ethoks I didn't catch where from 1599 rate of play Or playing a nice looking team Oh nasty depending on how you look at it, but we've got a velto ground on gengar tapu finny incinero and shed ninja Okay, so we've got the Evelto ground on combination restricted pairing Very strong covers each other nicely, especially because of the fire typing on the ground on primal ground on now Then you've got the mega gengar going to be the mega of the team wants to trap in Our pokemon so give him given us less option to switch out less synergy here And punishing us where they can she ninja going to be a bit of a pain to deal with as well Especially because combined with the tapu finny you've got to be aware of the potential sock Scenario, so we've got plenty on our team to kind of cover that though Um, one of the things it would say is looking on face value at my opponent's team trick room will do pretty well If we can get the trick room setup. It's just about covering Um our basis. So I'm going to go lunala tapu coco Um, do we want incinero here or do we want stacks stacks could do some damage if we can get the trick room setup And we've got wide guard as well. So we don't need to worry too much about that And uh, I think we always want to bring requiser to these matches to be honest. Um, I feel a bit weirdly even incinero Um, especially because there's two dark types, but um, yeah, we'll go with this And we'll see how we get on And moongas could have been a good one as well because I think If We do see the sock onto the shinninger Then tapu coco comes becomes way more important for us. So we need to be Very very sure in ourselves that we're not allowing tapu coco to go down very freely here Oh, this looks lovely, especially when you know that the tapu coco has got this charge We can do some real work Or we could just spex thunderbolt the beltel couldn't we in trick room I don't know what to do spex thunderbolt Are we gonna get the beltel spex thunderbolt not in terrain? Depends what build it is of course If it's a salt vest then Well, if it's a salt vest, then we've got an easier route to get in our trick room up If it's the move then I think the thunderbolt would get it um We could be a little bit Uh, well, hmm do we want to do do we want to just get the trick room up and get stacks in? I think we'll just try that um And go for a vault switch I don't think evelta is going to be able to take down lunaula here because I think it has to hit after the tapu finny And I don't think it's going to be able to the worst situation here for us is going to be um This this is a move We'll get stacks in Of course, we should have just thunderbolted it Well, why haven't you got the call blueberry on call blueberry and the casseves 100 better?  Well Icy wind It's not the worst. We'll get cocoa back onto the field at least. Um We get electric terrain up kind of Feels like ground on will come onto the field now though. Um So whether we keep stack attack are out or We could go for the continental crush to be honest Just where is the ground on going to come in? Um I want to get rid of the finny if I can so I'll thunderbolt there Um We could trick room again, but I think at this point it's not really going to do us any huge favors We could substitute as well um That stuff might be nice to get up to be honest Uh But we could just go for the rockium into the valto I'm gonna go into the valto because I feel like the ground might come in there Yeah, and if we catch it with the yeah The continental crush still gonna do a ton of damage. No, we're like not intimidated We should get rid of the finny as well with the specs thunderbolt, which hopefully catches my opponent a little bit off-guard Um Thunderbolt come on specs Show your power excellent Okay, be interested to see how much damage we can do to this ground on and if what my opponent's like fourth pokemon is if it's such a ninja um Then we need to preserve koko, but we've got we got ray in the back. So it's not like the worst the valto is in extreme speed range and I think after this Dragon Ascent is probably likely to pick up the knockout on to ground on so ray could potentially come in and clean up Yeah, dragon ascent will get after this. Okay See I don't expect the valto to come in now But if it is she ninja it is okay, that makes things a bit more tricky for us because We might have to lose We might have to lose koko here because I don't think we've got wide god. Have we on stacks? um And I can only thunderbolt I've got to get ray quasi in because otherwise we've got no way to hit the she ninja other than stack attacker So stack attacker now without the soul because obviously a big a big a big thing to keep Keep safe, um And we don't have protect so we can't leave it in front of a ground on unfortunately We'll have to switch out into ray Well, I mean ray deals with she ninja as well But you know we want to try and preserve two things if we can stack attack coming back in as well um Yeah press displays It does it At least we've got two options now against the she ninja and I don't think it goes for a toxic It goes for a toxic. Okay predicting the switch. I'm gonna say because otherwise you're toxicking into a um In a stack attacker, which is never gonna be a thing to do is it because of the steel tech now?  I think we're gonna be all right though. Now there's no Worry about us taking down the ground on with a dragon ascent. Um, and we can just go for a stone edge into the she ninja um mega roll Dragonson from this range would definitely get the ground on Because it's just ridiculous and a ridiculous attack Now I'm worrying now. I'm like is it gonna take it Is it is it gonna take it? Hopefully hopefully hopefully we're all right. I don't imagine we will be No Okay, well, it's not the worst.   I mean we do have the berries.  I mean the ground has probably not got really a way to hit us to be honest other than fire punch I'm gonna go for the dragon ascent into the she ninja If we can just remove that from the field and make things a lot easier Um It's gonna shatter It's gonna be very very close very close. Depends if the velta has suck a punch and decides to go for it Depends how much this does as well prokina berry Probably gonna see some double protecting shenanigans going here I don't think we can do it because I think the toxic tick plus a fire punch will get us Um, all my opponent really needs to do is fire punch with ground on Um, like double attack here And then they've got us Oh, this is this is just All we can hope for is the ground on protects the velta goes for an attack into us We I'm gonna extreme speed because I've got to hope the ground on protects here if the ground on protects them We could win this still Leave out to protect so I think we lost because the ground on probably protects as well Yeah, the toxic tick And I don't think there's nothing we can do to get around the foul play Um or fire punch and then the toxic will get us this next turn My opponents played it really well. Uh, we've just got trapped in by she ninja and the ally switch kind of caught us off a little bit there Um Let's drag in the same ground on I don't know if the velta goes for a sucker punch. No it goes foul play so There we go my friends I'm a bit sad about losing this last one But I think it was one that we could have like a best of three will make that so much easier That's the thing like best of one. We know we've got so much information about the team But I think getting caught our best of one obviously They're the ones that I want to go into a best of three with because I think if that's a one We can easily manage with all the information that we've got and my opponent might come back and say the same thing about us But I think knowing that the z moves on the eval to makes things a lot easier and it makes Our decision making a lot better. We wouldn't lose lunala so early on which I think gives us a better Match up against other things late game. Um, but we'll end it there. Thank you so much for tuning in It's been a bit of a longer one today, but I hope you've enjoyed it. Thank you so much again to will for the team We'll be back tomorrow with more from this team. So stay tuned for that. Have a great day. Whatever you're up to Thanks again for tuning in and I'll see you for the next one. So until then my friends take care of yourselves and bye. Bye