Hello. I'm shocked to see so many survivors of yesterday's lecture.  So I'm happy to see you here. Today we are going to discuss a very sensitive topic.  It has social costs, it has relational costs in relationships, it has job opportunities costs.  If it is difficult enough to do with adults, imagine how difficult it is to do with children and adolescents. There is even a tendency to deny.  No such thing as an insane adolescent. It's a phase. It will pass. You don't need to impact the child's record or the adolescent's record. Close your eyes, look away.  Today we are going to discuss a specific subset of mental illness known as personality disorders. Most notably cluster B personality disorders. Which include borderline personality disorder, narcissistic personality disorder, histrionic personality disorder and antisocial personality disorder. Mistakenly known as psychopathy. There are other personality disorders of course. Paranoid personality disorder, schizoid personality disorder etc. But they are very rarely diagnosed in children and adolescents so there's no point to waste time on them. Which is what I said in English. You have to repeat everything I'm saying. By the way yesterday I made a faux pas. I did not thank this gentleman for his selfless efforts in translating. I think he deserves thanks on behalf of all of us. This is Rado and he is valiantly attempting to translate the untranslatable. Before we start it is always a good idea to define your subject matter. And the subject matter happens to be children and adolescents. There has been a sea change. There has been a tectonic shift in how we define adolescents. Following the studies by Twinge Campbell and others, but mainly Twinge. Following her studies we now define adolescents. We now define adolescents as up until age 25. And the reason is that one third of people under age 35 continue to live with their parents. All urban children under age 25, almost all of them continue into higher education. People begin to drink alcohol two to three years later than in the 1980s. People receive driving licenses or sick driving licenses two to five years depending on the country later than in the 1980s.  And that's not a joke.  It was called in the 1970s, it was called the Peter Pan syndrome. People get married of course, I don't need to tell you. Much, much later. And they begin to have children much, much later. And about one third of people never have a relationship. 31% to be precise.  And they remain eternal adolescents. And in the 1960s and 1970s in psychoanalytic literature, this phenomenon was called puerre a eternus. It's in Latin. Eternal adolescents. So we have adolescents age 22 and 25 and 24 and 23. But the classic definition of adolescence now extends into the mid-20s. A very interesting trend happens with children. You remember, our subject matter is children and adolescents. Until the end of the 19th century, there was no such thing as a child. People who were 6 years old or 7 years old, they were called little women and little men. If you look at the book, the famous book by Luisa May Olcott. It's not called little girls. It's called little women. There was no such thing as a child. It's a modern invention. And because it's a highly modern invention, it was actually a fad, a fashion. And now we are going back essentially to the 19th century. We are gradually eliminating childhood. Children are hyper-sexualized. For example, in advertising, in show business, children engage in adult activities like modeling. About one-third of high-tech and high-technology entrepreneurs are under the age of 10. Approximately one-third of entrepreneurs from IT are children. So we are seeing an elimination of childhood and an extension of adolescence. These two trends are very important. Because they mean that mental health disorders, mental health issues, that were once the preserve of adults now appear in childhood and adolescence. You can even say that popular culture, definitely in the West, encourages mental illness, certain types of mental illness. Among young people. So for example, the amount of explicit sex and violence in products consumed by children and adolescents, is dramatically up. The rating of movies, for example, has now shifted. So that movies that once were considered adult only are now PG, family consumption. So the rating of movies, when they are rated, if you want children to be rated, has changed. And so the movies that now, in the age of 80, were considered seniority, are now with the police. Before I get to business, and we start to deal with diagnoses and so on and so forth. There is an important observation to make. Do you hear me there in the back? My apologies. So you could have children raised in the same environment by the same parents. Even identical twins. One of them becomes mentally ill, the others don't. For example, children who had been exposed to abuse. We have a questionnaire in psychology called ACE. ACE is Adverse Childhood Experiences. So when we administer ACE, we find that people with the same number of experiences, bad experiences, only a relatively small percentage develop mental disorders or mental illness. This indicates very strongly that there is a genetic predisposition to mental illness. Even among identical twins, there are differences in gene expressions. Not the genes, the genes are identical, but the way genes express are different among identical twins. So what can you do about genetics? Nothing. Don't feel bad. Actually, as opposed or as distinct from adult mental illness in children and adolescents, the genetic contribution is much higher. When you're coping with children and with adolescents and with the manifestations of their mental illness, keep reminding yourself, you're not gods. I'm the only god here. Please, let's make it clear. And there's nothing you can do in many of these cases. They are genetically determined, not all of them, but in a big number of cases. The lecture is divided into two parts. The first part I will deal with the mental health diagnosis that are specific to childhood and adolescence. And these mental health diagnoses are related to personality disorders. And then the second part of the lecture, I will give you 10 tools, 10 tests, 10 warning signs. Yes, observations. You observe these signs and if they exist, or a big number of them exist, it is almost safe to say that this child or adolescent either is mentally ill or about to develop mental illness. You broke my heart. Listen guys, this is very tough material, very boring, and so we need to laugh a lot, so feel free to laugh. There are four diagnoses that lead directly and are connected to personality disorders. There are many diagnoses in childhood and adolescence, but only these four result in later personality disorders. A methodological comment. These diagnoses are borrowed, taken from the Diagnostic and Statistical Manual. You are much more mentally healthy than the rest of the world. You are mentally healthy, you don't need this. Addition 5 published in 2013. So these are borrowed from there, but of course as you all know there is a major difference between the Diagnostic and Statistical Manual and the ICD, the International Classification of Diseases. The 11th edition of the ICD will be released formally this year or next, but it's already available widely, and the 11th edition contradicts the DSM sometimes dramatically on many issues, disagrees with the DSM. One example, important example, the ICD 11 does not recognize multiple personality disorders. Only one personality disorder with different emphasis. So you would have personality disorder with no cystic emphasis. Which is what I've been advocating since 1995, I think that's the right thing, I think they did the right thing. But if I go according to the ICD I will not be able to make a living. So I'm going with the DSM, it's good for business. There are four diagnoses in the DSM that in children and adolescents that lead to personality disorders later in life. Reactive attachment disorder, these are children who are unable to attach to other people. Most notably mother. They are withdrawn, they are emotionless, they are not emotional, they are reticent, they refuse contact, especially physical contact. And so reactive attachment disorder, if it is left untreated, in adolescents already translates into a personality disorder. If RAD is not treated it becomes psychopathy. Or more precisely antisocial personality disorder. Okay, time to explain the difference between psychopathy and antisocial personality disorder, because it's very confusing. Let's start with the word that is not a clinical term and should not be used by any serious professional, sociopathy. It's a hype, it's a media hype. There's no such thing, there's no such clinical entity, there's no such diagnosis. In the 19th century there was something called like character disorder. In the 19th century there was something called character disorder. And this is more or less sociopathy, but it's not a diagnosis. Antisocial personality disorder is the tendency to disregard and confront the rules of society, essentially. Extreme forms of antisocial personality disorder are known as psychopaths. The vast majority of people with antisocial personality disorder are not psychopaths. Similarly, in narcissism we have narcissistic personality disorder and when it is taken to extreme we have malignant narcissists. The vast majority of people with narcissistic personality disorder are not malignant narcissists. Finally, this guy, Sperry, suggested that there is something called style, psychopathic style, narcissistic style. That is not exactly narcissists, but has a lot of behaviors and traits of a narcissist. Sperry suggested that there is some kind of style in the liberal class. We use the word type of personality. No, style. It's a style. Like he has a narcissistic style. He's someone who is not a pleasant person, arrogant, etc. But he's not a narcissist. He's almost narcissistic but not.  The clinical term for this is subclinical, subclinical narcissism, subclinical psychopathism. When we put the subclinical types together we get dark personality, the dark personality. So when we take for example subclinical narcissists who is also subclinical psychopath and put them together we get dark triad personality. So when we combine a person who has subclinical narcissistic personality and subclinical psychopathic personality, then... Dark triad personality. Triad personality. You can read about it online. Triad Antonecata. Okay, this is... How do you frame childhood delinquency? We'll come to it. So RAD, reactive attachment disorder, becomes antisocial personality. And again, the reactive child refuses to bond, refuses to get close to you, recoils if you try to touch him. Never makes eye contact. Never turns his head towards his mother, which is an important test. Mother is there, he's ignoring her like she's not there.  The next one is conduct disorder. Conduct disorder is a diagnosis in the diagnostic and statistical manual. And these are juvenile delinquents. Most of them have conduct disorder. Conduct disorder is a set of behaviors which the police would appreciate. A set of behaviors which are essentially subcriminal, almost criminal. Example, torturing animals. Inflicting bodily harm on other peers, on same age peers. Stealing property. Violent altercations or arguments. Deceit, lying, lying almost compulsively. Very often without reason. Extreme manipulativeness. Early precocious sexuality. Very early and very inappropriate sexuality. Very often directed at adults. And of course delinquency in the extreme cases. The vast majority of children with conduct disorder become diagnosable psychopaths. And so we call this psychopathy for children. In conduct disorder and in antisocial personality disorder, we don't have yet sufficient brain studies. We don't have anything insufficient material in terms of brain studies. But when it comes to psychopaths, we have a lot of brain studies. Neurological brain. Brain imaging. Neurological study. Fmrm mostly and so on. So we know and this is a fact that the brains of psychopaths are different to the brains of everyone else including narcissists. In extreme cases dramatically different. The amount of white matter, connectivity through ganglions, everything is very very different to the psychopath. We used to think that the psychopath is fearless, has no fear. Because when we tested the psychopath's skin, there was no skin conductivity when there were situations that should have been frightening. So there was no reaction to the polygraph. Yes, like polygraph, it's not polygraph but yes. So the psychopath did not sweat when he was exposed to frightening situations. He did not sweat. The electricity in his skin remained the same. Brain centers that should have lit up did not light up. Amygdala, for example, did not light up. So we thought mistakenly that psychopaths don't experience fear. They're fearless. The last 10 years we have revised our view and we understand that psychopathy usually goes hand in hand with severe anxiety disorder. Which connects it to RAD. Reactive attachment disorder is a form of anxiety. The child is anxious about contact. Children with RAD do not develop contact disorder. These are two pathways to psychopathy. They are separate. They don't lead to each other. So these two are the psychopathic group. And we used to think that borderline personality disorder has nothing to do with psychopathy. Until again in the last 10 years. So the information I'm giving you now, this is the latest of the latest. That's the cutting edge. That's the absolute latest in research. It's not in textbooks. In many universities they are not teaching it yet. So it's really the latest. So we used to think that borderline has nothing to do with psychopathy. But now we change our mind. And then following studies by Sprague and Yadvani. We now know that borderline personality disorder, when the patient is exposed to stress, for example rejection or abandonment, she actually becomes a psychopath. A special type of psychopath because there are two types of psychopaths. There is facto one psychopath and facto two psychopaths. Primary and secondary. The secondary psychopath has all the traits of the facto one psychopath, but also empathy and emotions. So there are psychopaths with empathy and emotion. So the borderline, when she is exposed to extreme stress, she becomes a secondary psychopath. Psychopath with empathy and emotions. We are beginning to see something very interesting. It seems to be that many of these disorders in childhood are somehow connected to psychopathy. It seems that psychopathy is essentially a childhood problem, not an adult problem. At any rate, we diagnose safely borderline personality disorder starting at age 11. All the signs of borderlines, all the symptoms of borderline personality disorder exist already in early adolescence, age 11, 12, 13, it's very common. Emotional dysregulation, hypersexuality, reckless behavior, comportment, reckless. Moodlability, all these exist at age 11, 12, 13. So borderline personality disorder can and should be safely diagnosed at age 11, 12, 13 and you will be doing the child a favor. Because if you diagnose it early, the interventions are much more effective. The cumulative life experiences, they cement the borderline, they make it rigid. You catch the borderline at age 11, still stand a chance. Not a big chance, mind you, but a chance. You deal with a borderline at age 25, it's a serious doubt. Even the most effective therapy we have for borderline personality disorder is only 50% successful. And that's DBT, dialectical behavior therapy. My Romanian is not what it used to be. Okay, last diagnosis and we get to the warning sign. Yes, remember I promised, I threatened you with two pints. Last diagnosis is ODD, oppositional defined disorder. Oppositional defined disorder, defined in your face. Don't you guys have Google translate or something?  Oppositional defined disorder, you can look it up online, okay? This is an example of oppositional defined disorder.  Provocatore, 50% of children diagnosed with oppositional defined disorder also have ADHD, attention deficit hyperactivity disorder. It seems there is some connection, it could be genetic, it could be brain abnormality, I'm saying it could be because we have no idea why. Now we used to define oppositional defined disorder, we used to define it in a wrong way. If you have the fourth edition of the diagnostic and statistical manual, including the text revision, it defines oppositional defined, it defines this ODD wrongly. Do not use this definition, the only correct definition is in the DSM-5, it was corrected. Now ODD in the DSM-5 is defined as extreme irritability, the correct definition is extreme irritability.  Now crazy, sounds like some of your husbands. Only one, okay. ODD which is coupled with ADHD we don't know why. It also leads to psychopathy. All four major childhood diagnosis, five actually, lead ultimately to psychopathy. It's one of the reasons we think that psychopathy is actually genetic, it's actually something in the brain. But of course psychopathy is only one personality disorder, the others. I mentioned borderline, borderline becomes a psychopath, but when she is not a psychopath, she is borderline. Here there was a movie with Charlie Chaplin, he was playing Adolf Hitler. Hitler was talking like half an hour, and the secretary pushed one button, and then he said punked, and the secretary typed for half an hour. It reminds him of the same, I'm saying something short, you talk for two hours, I'm saying something wrong, you talk for... Okay, punked. So now borderline is the perfect Christmas gift. You get borderline and side dish of psychopath, so it's a perfect Christmas gift. Nice, no? Okay. This was the first part of the lecture, it was like a menu to alert you which mental health diagnosis presents risk, prognosticative risk for personality disorders. Now let's get to the interesting part of the lecture. The ten signs. I'm going to describe to you ten warning signs, ten red flags. If you work with young people, if you work with children, with adolescents, you should monitor for these ten signs. These are not exactly symptoms, they are not signs in the clinical sense, they are like observations, you should be alert, you should be observed.  We start with attachment disorders. Again, we have attachment styles, you heard of attachment styles, so we have attachment styles, and we have secure attachment styles and insecure attachment styles, multiple. I never met someone with secure attachment style, but I heard they exist together with unicorns somewhere. We all came across many people with insecure attachment styles. Now, you can't really diagnose insecure attachment styles, but you can see insecure attachment behaviors. You can't really diagnose insecure attachment styles, but you can see insecure attachment behaviors. There are two big groups, clinging and neediness. These are children who pick up adults as replacement parents, parent substitutes. So these children can pick up a teacher, counselor, and they cling to that substitute parental figure. They become extremely anxious when this substitute parental figure is absent or paying attention to someone else. They are very possessive and jealous, almost romantically jealous, if you wish. They are very needy. So they will on purpose, they will pretend that they are helpless or incompetent and they would ask the adult to do something for them. You didn't catch this? Excellent! Let's go on. These children, they have something called learned helplessness. Learned helplessness.  She doesn't know how to do something. These are, they seek attention all the time, but not like narcissists. They don't want to be the center of attention. They just want to be seen, to be noticed. Okay, so this is one group of attachment disorders. An attachment disorder behavior disorder. We have the exact opposite. These are the children who reject any attempt to get close to them. These are children, if you show them any interest, attention, compassion, love, they become aggressive. Or they withdraw and avoid. They can become even the kind of pseudo-catatonic. They can suddenly freeze and not react. They may run away physically. So we have these two types of attachment disorder behaviors. Attachment disorder behaviors are indication of disrupted separation individuation. You remember yesterday? Those of you who are awake? Separation individuation problems. Separation individuation problems. The mother, usually it's the mother. I'm sorry, but it's the mother. Before you asked me, what about the father? What about the father? Totally irrelevant. So the mother does not allow the child to separate properly and to become an individual. So the child reacts in one of two ways.  Or the child feels aggression, is very angry, and he runs away from mother. So these are the two behaviors. If you see such behaviors, there is a serious problem with the mother. You can safely assume this. And you need to interview the mother. And to try to observe a family dynamic. In clinical setting. Can I have coffee? My kingdom for an office. She has a husband and she's still kind. Not into miracles. Okay guys, don't relax. You're still in the lecture. I will fail anyone who doesn't pay attention. Okay, next. The next lecture is about mental illness in coffee machines. Okay, let's proceed. Guys, let's proceed. I'm only one. I cannot fight all of you. What do you want? You want coffee break? You want to make coffee? I hope we are safe here. When it explodes, I hope you are safe. There's only one way out. The next sign is when the child is dysregulated. When the child's emotions overwhelm the child. Adolescent, doesn't matter. Adolescent child. I'm very nervous about this. Overwhelmed. And so we have dysregulation. Emotional dysregulation. Thank you. I appreciate it. Similarly, when the child has mood-lability. When the child's moods go up and down. When you witness dysregulation of emotions, when the child, for example, suddenly starts to cry. Without any external stimulus, not reactively. Or when the child is very, very depressed, falls asleep on the table, very, very depressed, and then the next day very, very happy or elated. This is one of the most powerful signs, one of the most powerful warnings, that the child is developing borderline personality disorder. This is called, this is a problem in self-regulation. Essentially borderline personality disorder is a problem in self-regulation. Indeed, we're going to change the name of the disorder in the DSM-6 and it's going to be called Emotional Dysregulation Disorder. A child who starts to cry suddenly, for no reason, definitely suffers from this disorder. This disorder is called Emotional Dysregulation Disorder. A child who starts to cry suddenly, for no reason, definitely suffers from depression. But be very careful. We often use diagnostic labels which apply to adults and we use them with children and with adolescents. It's wrong.  So when we say that a child is depressed, it is not the same like saying that I am depressed. It is not the same phenomenon. It is not experienced in a similar way. The etiology is totally different. We must be very careful with it. But it does mean that the child is unable to regulate his moods and his emotions internally. This means that the child is unable to regulate his emotions. The loss of internal regulation of emotions is a severe mental health pathology. Equivalent to cancer. This is really a serious issue because self-regulation is the foundation for all mental health. If you can't regulate from inside, you have two choices. Regulate from outside. So you become dependent on other people and you become dependent on other people or not regulate. And then your life falls apart. And you become a politician. You did not hear this. You did not hear this. I did not say this. It's not me. Okay, sir. Now a methodical break in which I am going to show your cartoon with Tom and Jerry. Before we proceed into the other eight signs. So you remember two signs already, yes? Two signs. Problems in separation, individuation, attachment, problems in attachment and lack of self-regulation. These are two signs already. There are eight more. There are eight more. So don't be optimistic. But before we go, guys, I really cannot compete with you. If you talk among yourselves, I will begin to cry, I will become disregulated and you will have to treat me. See what I mean? I spoke for two minutes. Two to 27 minutes to translate it. I'm very ridiculous. Okay. Why? Okay. Before we go into the other eight signs, there is something very important which many, many professionals, even scholars fail. Make a mistake. There are three elements of adolescence, of puberty. There are three elements. There are many elements. Puberty is a total transformation. So in puberty we have peer interactions. We have parental interactions. There are many, many. Puberty is an earthquake. It's a tectonic shift. There are three elements in puberty that can be easily confused with personality disorders. And they are not. They are not a personality disorder. There are typical elements of healthy puberty. There are typical elements of healthy puberty. We have two phases of separation, individuation. The first one, when we are 18 months old to 24 months old. And the second phase is in adolescence. The adolescence goes through separation from the parental figures this time for good. And the finishing touches on individuation. It becomes finally an individual. But separation, individuation is an infantile process. So the adolescent regresses to infancy. He has strong emphasized infantile elements. Any mother of an adolescent will confirm this. That sometimes adolescents are very infantile. And this is healthy. They need to regress to infancy to complete the separation individuation. This is a healthy process. Now you remember from yesterday that separation individuation involves grandiosity. For the baby for the baby to live mommy and to take on the world the baby needs to feel godlike. Jung called it narcissistic introversion. Everyone has a name. But it's a fact that But it's a fact. The baby separates from mommy because the baby has a misperception of itself as godlike. It's like the baby is saying I don't need you anymore mommy I can take on the world all by myself. Which is a sentence we often hear in divorce proceedings. So the same happens to the adolescent. As the adolescent separates individuals he infantilizes he becomes an infant and he becomes grandiose. And exactly like the baby the grandiosity is compensatory. The baby is insecure when he lives mommy. He's terrified. So he says I'm god it's compensatory. Same with the adolescent. Exactly the same with the adolescent. He feels insecure but he pretends to be godlike. This is easily confused with narcissistic personality disorder. It is not. It's healthy. Therefore narcissistic personality disorder cannot be diagnosed safely before the age of 21. Any diagnosis of narcissistic personality disorder before age 21 is suspect. 21 is suspect. Second thing in puberty that is easily confused with personality disorder. So this is confusion with narcissism. Second one is what we call negative identity formation. The adolescent defines herself in opposition in contra distinction to her parents and actually to adults, not only her parents. The unspoken the unspoken monologue is I'm going to be different I'm not going to be the same like Even when the adolescent says I'm going to be like my father a famous doctor and so on and so forth that is not the internal monologue. This is usually instrumentalizing the parents force the child to realize their fantasies and dreams. Negative identity formation is a crucial phase of adolescence. The child the adolescent defines herself as unique. It's known as idiosyncrasy. So this is easily confused with borderline personality disorder. Or with antisocial personality disorder. It is not. It is healthy. You must be very careful with this. You must investigate thoroughly. There's a huge difference between this type of grandiosity which is a positive grandiosity healthy narcissism. I'm going to take on the world which is accomplished. And grandiosity which is a falsification of reality and of who you are. Finally in adolescence we have something called reactance. In adolescence reactance has four elements. Lack of impulse control or reduced impulse control. Adolescents have reduced impulse control. In general a reduced impulse control defines in your face. I'm not going to do it, you know. Defines recklessness and conchumaciousness or control aversion. Hatred of authority. It's called control aversion. These four together are called reactants. In adolescence in puberty reactants is healthy. In adulthood reactants is a major sign of psychopathy. You could say if you want to be funny that adolescence are part narcissists and part psychopaths. In a healthy way. But you need to be very careful because the question you need to ask is preclinical. The question you need to ask does this promote an agenda of growth? Agenda of growth. Does this promote self-development? Do these lead to adulthood? And if the answer is yes, the child is healthy or the adolescent is healthy. It's not easy. You need to be very attuned. The differences are minute, these are nuances. It's extremely difficult to diagnose personality disorders in adolescence because of this. There are many elements of personality disorders. Ok, we continue to the next signs. The next sign is the need to control and externalized aggression. This sounds easy but it's not. We start with aggression. Aggression can be internalized or externalized. Aggression that is all the time externalized is a sign of developing personality disorder. So if you see a child that sometimes internalizes aggression becomes for example very self-critical or even depressed. And then as a fight a fight at school with another kid this is normal. It means that the aggression is both internalized and externalized. But if you see a child that only externalizes aggression only beats up other students and his teachers and destroys property only externalizes aggression never internalizes only externalizes. Then it's a warning sign. Similar with the need to control Self-control is healthy and the need to control other people is healthy actually. Because we need to create an environment that is safe for us and within this environment we need to control the behavior of other people to some extent. However exclusive focus on control is not any goal it's not like the child or the adolescent is trying to control someone else in order to achieve something. Or even he is trying to control other students for example who are much weaker than him and do not constitute a threat. When the control has no goal is actually not manipulative it's just obsession with control it's a sign of emerging personality disorder. And within this family we have two additional behaviors hyper vigilance hyper vigilance is when the adolescent or child is all the time scanning it's like a scanning machine all the time scanning, expecting threats expecting something bad to happen expecting to be translated expecting the worst So this is hyper vigilance this constant scanning you can see it on specific children and adolescents And the other member of this family is what we call external locus of control It's the belief the child's belief or the adolescent's belief that he is not in control of his life someone else is in control of his life everything that happens to him is not his fault not his responsibility nothing to do with him it came from outside Everything comes from outside everything bad that happens every defeat, every failure everything is never his fault This is called alloplastic defense So children with alloplastic defenses children who have external locus of control are probably in the process of developing a personality disorder much later in life including narcissistic personalities in the process of developing a personality disorder and probably in the future in life personality disorder in this system We must make an important distinction again all teenagers myself included we have identity diffusion Identity diffusion is not identity disturbance although it looks identical Identity diffusion is a healthy process in adolescence where the adolescent is experimenting with different identities including sexual identities So identity diffusion is a healthy process identity disturbance is something completely different It's when the values and beliefs of the adolescent change dramatically sometimes overnight It's when the beliefs and values of the adolescent change dramatically sometimes overnight And that includes emotional statements So the adolescent can say I love my parents a lot and the next day he can say I hate my parents completely I believe I believe that I should have sex only after marriage or I believe in promiscuity I believe that I should have sex now with everyone overnight So it's not experimentation with different identities It's something happening to the identity to the content of the identity that is unexplainable that is like several people are there, not one Identity disturbance is a major sign of borderline personality disorder And we can observe it in behaviors pervasive ambivalence that means holding two emotions and two beliefs that contradict each other pervasive or two beliefs two attitudes So in other words dissonance is no attempt to resolve the dissonance The dissonance exists and the child is accepted Identity diffusion which is a healthy process is about resolving dissonance The adolescent says I don't feel comfortable with this let me try something else he is trying to resolve the dissonance Identity disturbance is when the child accepts the dissonance and doesn't see anything wrong with it doesn't feel uncomfortable It's very reminiscent of multiple personalities It's very shocking to observe It's very shocking to observe The next sign is disrupted or disturbed object relations Object relations relationship with other people especially with peers Now here is a nasty surprise for all of you who are parents Peers are much more important to adolescents than mothers and fathers Adolescents derive well over 80% of the decision making processes from peers They derive almost all sexual education from peers almost all sexual information from peers Peers are critical Here if you see abnormal object relations with peers it's a really really disturbing sign But what is abnormal What is abnormal relationship with peers? The refugees have arrived Abnormal relationship with peers for example if the adolescent ignores peers completely, avoids them, ignores them For example if the adolescent ignores or avoids the age group does not allow peers to give him any input or any regulation Another example of abnormality is when the child prefers the company of adults or the company of peers Another example is what we call precocious sexuality when the adolescent prefers to have initial sexual relations and generally sexual relations with much older people This is very important These are all abnormalities in peer interactions and harbingers of personality disorders Next Reality testing and ego boundary functions The limit of the average I don't need to use these words I'm using these words to torture you She told me to do it None of these words is necessary It's just Ok Can you repeat the last Good thinking When the child or the adolescent prefers fantasy to reality When the fantasy defense mechanism goes alright takes over When the child or the adolescent perception of reality is evidently manifestly wrong For example, if the child confuses causation it's not that A causes B B causes A If the child has long and protracted transitional objects if he is attached to an imaginary friend or even a physical object If the child dissociates massively in reaction to any type of stress If the child refers to other people including his peers but not only his peers refers to other people in order to regulate himself in order to regulate his sense of self and sense of self-worth In all these cases we are beginning to witness the emergence of what we call dramatic or erratic personality disorders for example narcissism Hysterionic is a personality disorder that most probably will be abolished because we are again a hystionic personality disorder as a mild form of psychopathy so probably in DSM6 there will be no hystionic personality disorders I personally am heartbroken I love hystionics but you know you can't have everything in life It's a poor world without hystionics Next If you see an imbalance between libido and destudo you are not alone libido is not not the sex drive that's errors libido is the force of life that is achieved to eros eros is part of libido eros is part of libido and then there's the opposite opposite force it's the tannatic force of Thanatos and you have destudo is the object of that force so destudo is opposite of libido No one had a conversation with a destudo and no one had lunch with a libido So these are of course metaphors just words to describe the life force and the death force Children and adolescents who are morbid who are obsessed with death with weapons with blood with artistic expressions and manifestations of these Children who are depressed and glamorized idealized their depression This is called passive-aggressive personality disorder I can do better No it's okay Go to break from time to time Go to break Go to break time Oh my God You're an angel My colleagues said do you want a coffee? You're an angel What about us? I feel so privileged When a child let's go back to seriously sick adolescents I know it's your favorite topic When When an adolescent when an adolescent is morbid obsessed with death with blood and when the adolescent glamorizes his depression When a child is obsessed with death with blood and when the adolescent glamorizes his depression We have a disorder We have a disorder in control That is seriously bad news You heard of all the kids that shoot and so on In literally all these cases we have a history of obsession with death obsession with weapons This is a serious warning Never ignore this Next Cognitive distortions When you come across a child or an adolescent these things are more rare in childhood they're more common in adolescence When you come across a child or adolescent whose perception of reality or of himself is constricted like this, limited tunnel vision We call this constriction The clinical term is constriction Constriction I'm sure it's constriction Romanian is English It's your constriction or perjury How do you say ambition? Ambitia What did I tell you? It's English Constriction is when there is a narrowing narrowing of the world You could have life constriction For example people who are very anxious with anxiety disorders they limit the possible triggers and their life becomes very narrow Same with depression People who are depressed Constriction is a typical reaction in many many mental health disorders So when you have cognitive distortions which is a form of cognitive constriction It is usually an indication of emerging narcissistic disorders some kind of narcissistic disorder What do I mean when I say constriction? I have no idea What I mean is when you confront the child or the adolescent with facts that negate his perception he will ignore the facts He will reject them This is known as confirmation bias who reject feedback or input from reality in this way they constrict themselves they are not open to any change they are not open to transformation they never grow up they never evolve and in this way they limit the experience but they do not understand the experience So if you sit with such an adolescent and the adolescent says I don't know, I'm ugly I'm ugly Now like in cognitive behavioural therapy this is a negative automatic thought Normally what you would say if you are so ugly how come so many girls are interested in you Normally what you would say if you are so ugly how come so many girls are interested in you Normally it is said if you are so ugly why do you need to be interested in them In a typical healthy relatively healthy adolescent after, you know session or two sessions you can modify this self-perception say ok, maybe I'm not that ugly if the adolescent reacts aggressively to what you are saying what are you talking about this is total nonsense, you don't know what you are talking about this is confirmation bias this means confirmation bias this is a strong indication of pathology which leads me to the next sign self-perception negative self-perception now all adolescents have a mix of negative and positive self-perception a mix of positive and negative self-perception the positive side is a bit grandiose and the negative side is a bit morbid this mix is ok because it motivates the adolescent to experiment but if you come across an adolescent whose self-perception is 100% negative it's a pathology there is a big literature for example effects of trauma and abuse in early childhood and how they change negative bias in self-perception 100% negative self-perception is a pathology not typical adolescent and the last thing the last sign is self-efficacy if the adolescent perceives himself or herself as unable to secure favourable outcomes it's an indication of an emerging pathology such an adolescent will say I never succeed I always fail and will not be open to try will not be open to try and to experiment and that's a sign of pathology as well that's when there is no self-efficacy these are the 10 signs that you should be looking for they are all alarm bells they all lead to lifelong pathologies they all lead to pathologies that resist the pathology now as the last paragraph what can you do about it once you have spotted all this if the intervention if the intervention is relatively early and when I say relatively early it's before age 12 in women before age 14 in men men are 2 years behind women as anything the intervention is made in time which means until the age of 12 in women and until the age of 14 in women well now I don't need to say anything further so even if the intervention is prior to this interest research studies show that interventions could be relatively effective for example cognitive behavior therapy administered before the age of 12 to girls with emerging for example psychotherapy with a computer with girls who have signs of bulging in borderline is about 5 times more effective than after age 12 it's 5 times more effective than if you do the intervention so the age is critical all these signs emerge after age 6 generally speaking the formative years are 6 months to 6 years psychologically we are relatively determined by age 6 so why do we continue to change because our brain continues to change the brain continues to change for those people who have brains the brains continue to change until age 25 and only at age 25 there is termination of the process of brain growth so for example risk assessment in adolescence is literally non-existent literally these centers develop much later so certain skills are on take time but the foundations of age 6 you can begin to apply this list already at age 6 you catch this at age 6 chances are excellent you catch it at age 9 a little less you catch it at age 17 largely it's hopeless chances of success are bigger remember this lecture is about personality disorders personality disorders are intractable and they are all pervasive in other words they are metastasized they are like cancer they cannot disappear beyond a certain stage it's phase 4 it's cancer stage 4 the metastasizing is total and the person becomes the disorder it is your obligation moral and professional to monitor for these signs to come as early as you can ironically your biggest enemies would be the parents because they would perceive any intervention as criticism of their own parenting perfect parents why would anyone need to intervene what's wrong with my child you are crazy the council is crazy there is huge resistance from parents and this is something you will have to overcome with politics and diplomacy if you can in most countries in the world regrettably parents have too much legal power over their children I don't know how it is in Romania but in most countries in the world the parents can't stop you from intervening even when you see a clear need for intervention if the child is suicidal between ages 12 and 18 a girl with borderline personality disorder will there is a 40% chance she will self harm usually cut or burn a person in a minute if you want to apologize there is a 40% chance there is a shocking 20% chance she will attempt suicide and there is way over 50% chance that she will have inappropriate sex and reckless sex digitally or in real life which is a form of self-harm with men so cutting and burning but with men this is not it's not about cosmetics it's not about you should use this eyeliner this eyeliner it's about life and death superficial in life and death 11% of these children will die of suicide because you did not intervene in such circumstances the signs are there in school your counselor or you don't intervene there is one intention this child will commit suicide this child will mutilate so so are you willing to have this on your conscience it's a huge responsibility to work with young people huge responsibility you are your partners in the process exactly like the parents are just one comment about self-harming because it's fascinating topic it's not going to do this lecture but it's fascinating and I don't care if you're interested I'm going to say it I'm going to say it self-harming is a very interesting behavior in borderline it has two apparently contradictory roles contradictory ideologies contradictory psychological issues self-methylation on the one hand makes the borderline feel alive it's like she's in a lethargic state like she's a zombie and she cuts herself like she's in a lethargic state like she's a zombie and she cuts herself and she cuts herself this is one function there is another function for cutting, burning the very creative the pain, the physical pain takes away their minds from the emotional pain the emotional pain when they are physically in pain they come think for a minute about their inner turmoil their inner tumult the mess inside the chaos self-harming therefore has an anxiolytic effect it reduces anxiety on the one hand and on the other hand it makes the borderline feel very good there is no clinical connection between self-methylation self-harming and suicide it's not that suicide is extremely self-harming in most cases suicide happens after the borderline stops self-harming because it doesn't work anymore and of course all these disorders are diagnosed with other disorders like substance abuse these children and adolescents start to abuse substances such as alcohol and drugs earlier than their peers and also more egregiously in a worse way everything is around self-harming they self-harm with cigarettes they self-harm with substances they self-harm with men it's all about self-harm feeling alive and drowning the mess inside with the test with men everything is resolved in such a way in which the internal duration and after a while it feels alive these children and adolescents are in extreme distress and they are signaling to you any adult would listen and some adults are predatory to take advantage of this has been today's lecture tomorrow I think I'm not sure I think it's high school students or something tomorrow I'm giving a lecture on what is abnormal where's the line dividing normal from abnormal which is the most sophisticated question than anything we dealt with until now so I hope the high school students will get it if any of you has any question don't ask because you will make the other people very angry depends borderline personality disorder actually has very good prognosis that borderline first of all by age 45 81% of people with borderline personality disorder lose the diagnosis spontaneously


Tonight we are celebrating excellence. Apprentices, trainees, wonderful trainers and teachers, businesses, training organisations from right across Queensland and it is such an exciting night to just value and recognise vocational education and training and what it means to so many people and how it touches so many lives. It's really important because we pride ourselves on having a quality training system in Queensland and when you come together on nights like tonight and you see the high profile organisations and outstanding people who have completed qualifications and they set those standards for other organisations and people to follow and so I think having those benchmarks in place that we celebrate and acknowledge really makes for a much better vet system right through Queensland and continues to promote the high end outcomes that we get. I love these awards and I love the fact that it's packed. There's a huge amount of noise which means a huge amount of excitement so once we get in there and get going then we're just celebrating the best that Queensland has in training and vocational studies and you know and young people. It's important for Newscorp to stand behind those who pursue vocational careers and support those who choose that as a career path so for us it's about getting behind whether it's students who are leaving school through to those career changes making a career choice late in life. Busy at Work has been a sponsor for many years, long before me and we're very passionate about apprentices and traineeships. We're all about getting young people into work and more broadly getting people into work you know and we see apprenticeships and traineeships as a long-term sustainable pathway and a career for people. Collaboration award is CQ University and Logic Apps. Look I think that if you've got an initiative which is really about improving the quality outcomes for students then I think have a go at applying because you might just be surprised at how well received that is and certainly I think this initiative is born out of passion and and certainly something that was really about a better outcome for students and I think that was really the secret to the success so yeah, good to go. We're delighted to give some encouragement to those young people to develop their skills develop their develop and tone the appropriate quals and accept themselves ready for the challenges that I'm sure lie ahead in their careers. Well they have a go there's nothing to lose it actually helps you focus on what you do and gives you a chance to improve you know iron sharpens iron we see other great businesses doing things and it just gives you that more incentive to go along so I think it's well worth the exercise helps you have a bit of a check on how your business is going in the training sector and yeah have a crack. My background is teaching so these awards are really meaningful for me so I want to make sure that we get the very best that we can out of the training system both the staff and the systems that they use. It means the world to me it means the world to my school to my teachers to my business that I did my training in it's just an extra bonus that I did not expect from an undertaking school based traineeship. My careers santo teacher offered the opportunity my brother in the past had taken it up and he'd been successful and you know I knew that if I wanted to get in front with other students or get a pathway this opportunity is The Bob Marshman trainee of the year award is Ben Nedwidge. Certainly yep it looks really really good on Rose Mayne. Employers will see that and none of this person is dedicated they're committed and they can do the job properly so yeah it's very beneficial. They're studying full time working full time balancing family you know friend commitments and all that stuff I guess it feels this feels like a pretty amazing way of you know saying that I was doing the right thing and feeling confident in my choices I guess to take this pathway. And the winner of the Harry Horne's Child Apprentice of the Year award is Ashleigh Brown. Congratulations it's an honour and I'm very humbled to be standing up here with you. We know each and every one of these organisations truly value training and that's why they support these events so we we truly do thank them tonight we could not do this without their sponsorship and it's just as important that we we recognise them and we thank them so much for their support.


All right, everybody, thanks for coming. This is Dev. Oops. Lessons learned from a cloud network architect. I'm James Denton. I'm a principal architect for Rackspace. My name is Jonathan Almalley. I work with James. I am a network architect. Perfect. So after the presentation, we're going to throw the slides up on SlideShare. If you want to grab the link, don't feel like you have to take notes or anything. Big pictures of slides. We'll have them all for you. Yeah. Great. Rackspace, we are a hosting provider, right? One of the earliest contributors and really creators of OpenStack Project. As architects and engineers on the Rackspace private cloud team, we support a wide range of OpenStack clouds from Folsom to Newton. So we've seen a lot. I've been on the team since 2013, been working since 2012. Johnny joined me in 2014. So what we're here to talk about is as we've worked on these clouds and implemented various configurations throughout the year, some of the lessons that we've learned and some observations that we'd like to share. So as James mentioned, we've got hundreds of clouds that we support. All of them varying in size, complexity, scale, purpose, and each one is unique. So when we work with our customers to design the cloud and to figure out the proper configurations for that cloud, be it a actual whiteboard session or just James and I talking, we're taking into consideration the community options that are available, the customer scale, the performance require of that customer, and again, they're all going to be different. Most of the time, we're right on. Most of the time, everything goes as planned, but there are some occasions when things don't go as we intended, when we get hit in the mouth, so to speak. And it's up to James and me and our team to kind of roll with the punches and figure out how we're going to move forward, get past this particular issue without having to repave the entire network, without having to repave the entire cloud. So what we're not here to do is start a flame ore for various technologies that are available to you with OpenStack. We don't want to necessarily advocate one method or another. What works for one type of cloud may not work for another. But knowing what your options are and where the limits are of particular options is very important. And you're going to see in one case, like James mentioned, we're not here to discourage or to say don't use one method over the other. There's going to be a case where we start with A and we move a customer to B and another example, we'll start with B and we'll move the customer to A. So we do go back and forth. Right. It doesn't matter what's good for this particular cloud. Yeah. And as Johnny mentioned earlier, you start out with a set of requirements when you're building a cloud. And over time, those requirements change. As more users start adopting your cloud, we have found that their requirements may not have fit in the initial design. And so you have to either work around and tack on features to your existing cloud or maybe you have to repay, but that's not always an option for folks. The first thing we want to talk about is the battle of the switches, right? Open B switch versus Linux bridge. Like I said, we're not here to start a flame war.  Let me go back a little bit and talk about our journey to Neutron. So as I mentioned, I've been involved since 2012 and then Nova Network was what you had and Nova Network utilized Linux bridges to provide connectivity to instances. When we adopted Quantum and then Neutron, what you had there was this community-driven idea to use Open B switch rather than Linux bridges. One of the lessons that we learned was that community documentation really helps drive adoption. So at the time, especially all the documentation guided folks towards Open B switch, and that's kind of the direction that we went. One of the appealing features of Neutron at the time was tenant-managed networking. We got to leverage overlay networking technologies, which was primarily GRE at the time, later VXLAN. And we knew that the community was moving in the direction of Neutron. Nova Network was going to be deprecated eventually, but nobody knew exactly how long it was going to be. I think everybody's very optimistic at the time. It would be, you know, six months to a year, but I think as we found out, you know, there are still folks using Nova Network probably not doing deployments, but definitely feeling the pain of having held on to that technology for a little bit longer than they needed to. So some of the issues that we encountered in that initial phase of our private cloud was the immaturity of Open B switch at the time and the immaturity of Neutron itself, right? So with Open B switch, we initially, version one, especially, witnessed a lot of packet loss, packet corruption, especially when there was a lot of traffic being pushed through a box. Enhancements to Open B switch included the use of mega flows versus micro flows or wild card flows. We experienced some kernel panics. And as far as the agents are concerned, you know, we ended up submitting a lot of bugs to fix issues with the agents because maybe they didn't manipulate the flows they needed. Or in this case, if you were to restart Open B switch, the Neutron agent wouldn't program new flows in time and you ended up with bridging loops, which in a physical environment is bad enough, or virtual environment, it's just compounded even more. So at the bottom, we have a couple of bugs that we opened that have since been resolved. Open B switch is an awesome technology, two or three years more mature than it used to be, and same can be said for Neutron and its Open B switch agents as well. So at the time, a couple of things prohibited us from upgrading to OBS, right? Kernel incompatibilities with new Open B switch versions, DKMS to compile kernel modules, a reluctance to believe that that version of Open B switch was going to be the one that solved all of our problems. At the time, you saw a lot of transition in the community going from the core plugin technology to a, trying to think of the term here. Anyway, to ML2, right? So at the time you had OBS or you had LinuxBridge, with ML2 you had the possibility of both. And what ML2 provided us was the ability to easily leverage the same database schema and change the core plugin behind it, right? So for this customer in particular, running Open B switch and having a lot of problems, we decided to first upgrade from Grizzly to Havana so that we could leverage that new ML2 technology. At that point, we had a consistent database schema and we could more or less change the underlying plugin, update a few fields in the database, pull a few virtual interfaces out of their bridges, restart the agents, and all of a sudden your LinuxBridge agent was now building out the virtual networking infrastructure using LinuxBridges. Where that's important is that at the time, your other alternative may have been to redeploy a new cloud leveraging LinuxBridge. That's real painful for users, right? Nobody wants to have to snapshot instances and migrate them to a new cloud. Maybe they are also feeling that the instability of the cloud really makes them shy away from OpenStack in general. And those are things we wanted to avoid. So where we went to from that was making LinuxBridge's standard driver for our RPC release based on IceHouse. And ever since the IceHouse release, LinuxBridge continues to be our standard driver, even though OBS is still an option in upstream OpenStack Ansible and will soon be adopted. As I mentioned, OpenVswitch and Neutron has continued to mature, so a lot of the issues that we had in the early days aren't really issues anymore. Now some of the features that the Neutron community has released over the last couple of release cycles, things like Tap as a Service or OVN, Distributed Virtual Routing, those are features that you're only going to get with OpenVswitch. So if those features are important to you, then by all means, stick with that deployment strategy. But for us, we focus on keeping things fairly simple and don't yet require those features. So LinuxBridge is a good option for us. The next example we're going to give is a change in the way that we performed our tenant network segmentation, meaning segmenting traffic for multiple tenants or even different networks within the same tenant. The two options that we are going to look at today are VXLAN and VLAN, VXLAN being the standard overlay technology that allows tenant networks to be encapsulated in a shared network across the physical hosts. Standard VLAN being traditional networking 802.1 Q tags. So here are a couple of examples or key points of each before we go into our transition from one to the next. VXLAN started off as our standard for network segmentation. The VXLAN is the overlay technology used between hosts. Again, it runs over standard UDP. So it's very familiar with most administrators. It allows for over 16 million unique segmentation IDs. So 16 million VNIs, which in essence is unlimited to the user. So the user can spin up, tear down, create as many networks as they want. They've got 16 million of them. VLAN, however, is also an option. It's a little more traditional. You're limited to the standard 4096. Segmentation IDs likely a lot lower due to limitations of spanning tree on your physical infrastructure. So the 4096 is probably more like a 500. So again, VXLAN was our standard. So we deployed this cloud with the standard VXLAN. And the first thing we noticed was that due to the overhead of VXLAN, SSH stopped working. Actually never worked. So we could ping the instance once it was spun up. We could tell it to port 22. But the SSH handshake failed every time. So our solution was simply to lower the MTU on the instance. SSH passed. Now at that point, we've got an instance with a 1450 MTU, which is fine for the most part. Other considerations were to actually address that at the infrastructure level by raising the MTU across all the hosts, across all the nicks, across all the switch ports. But we worked with that one. Do you want to go into LGPot? Yeah, sure. So one of the other dependencies of using VXLAN as an overlay technology is the need for some sort of mechanism to program the forwarding tables on all of the hosts involved for the community. There were two options. And we'll get into those in more detail later on. But our default option was to use the L2 Population Mechanism Driver to allow Neutron to program all of that stuff dynamically across the hosts. What we found, especially in the early days, Juno was the, or sorry, Icehouse was the first release where the L2 Pop Driver was available. Even up through Liberty, we've experienced issues with, as a cloud, scales in terms of networks, reports, specifically, you might find that the agents on nodes are slow to update their bridge forwarding tables and ARP tables. And what that translates to is the inability for an instance to maybe get its IP address from DHCP, or especially the inability for that instance to be able to communicate with its gateway or other hosts in the environment. How this manifests itself is a customer saying that, hey, I can reach my instance, but I can't hit some other host in this network, or I can console to my instance and I can hit that host, but I can't hit the internet. And what you'll find when you start troubleshooting this is that the bridge forwarding table on your network node is missing the MAC address and the VTEP address, and maybe even the ARP for that instance. Now, that's something that won't eventually show up, but your first instinct is to think that something's wrong, you start restarting agents, and before you know it, things start compounding and you're having a few hour troubleshooting stuff. And also interferes with workflow. I mean, if you spin up an instance and it takes 10 minutes for the instance to get its IP address, that impacts production. Absolutely. So troubleshooting became an issue because we have to make sure that the database and the ARP table are correct on both sides. Excited? Yep. Another issue was simply with performance. This was a few years ago, and the NICs that we were using showed a significant decrease on a 10 gig network down to roughly three and a half gig using VXLAN compared to just about line speed at about 9.8 gigabits per second on 10 gig network using VLAN. Huge performance increase. We performed similar tests on different NICs, newer hardware that had the VXLAN offloading enabled, and we got closer to VLAN. I was thinking 9, 2, 9, 3, maybe 9, 5. Yeah, close enough to make it worthwhile, right? Where we find this common is when users or deployers repurpose existing hardware. You'll find that a lot of the hardware they're repurposing for this cloud, while it makes sense to try and leverage that and to the fullest extent, some of the hardware in those devices is admittedly old, especially when it comes to network cards. The Intel X520, 540 are very common cards that are out there in the wild. They're based on the 82599 chip set, and it works with, you know, supports SIRLV and some of these other networking technologies, but can't handle VXLAN offloading. And so that's where you start to see some of this performance issues. So taking into consideration troubleshooting, and this is where the fun begins. Let me go to the next slide. So as James mentioned, there needs to be some form of population for both the forwarding database on the, sorry, the bridge forwarding database as well as the R table. We saw bugs, not necessarily with Neutron, but with Linux kernel that made troubleshooting near impossible. We give one example here where we have the flooding entry, and the flooding entry is akin to a broadcast. So if a entry cannot be found for a particular MAC address, go ahead and send it to everyone in the network, any host that has a member that requires that particular VXLAN network. So we're supposed to see one flooding entry per host per VXLAN network. So in this case, we have VXLAN 15, and we have a particular host with all zeros for its MAC address. We're supposed to see one for that host. We were seeing over 28,000 of them. If we would reboot the host, we'd go ahead and we'd see the proper number. And usually it's the same number of nodes in your infrastructure that require that entry. So in this case, it was 55. We thought everything was good. We'd go to bed, come home the next morning, or come back to work the next morning. That number was at 1.5 million. All right, and it wasn't consistent either, right?  It was an actual kernel issue. Meanwhile, this impacts the Linux bridge agent up through a few releases because the agents sometimes perform screen scraping after performing certain actions. If this action to get those 28,000 entries takes 15 seconds to occur rather than half a second, that's going to impact that agent's operation, resulting in possible downtime for the user. The user doesn't care that there's 1.5 million entries and it takes a lot longer. They care about the time to reach their instance. So we had a decision to make. And the decision was to take them off of VXLAN and try to put them on standard VLAN networks without impacting their production, or with minimal impact to their production. So here's the process that we took. So we know that there's 16 million possible VNIs with VXLAN. This customer's obviously not using 16 million, but they were using a fair amount. We had to at least provision that in many VLANs, plus enough maybe for future growth. So we tried to do a one-to-one alignment between VXLAN that we had and VLANs that we needed. Set the default tenant type to VLAN, as opposed to VXLAN, so as they create new networks, VLANs are added, not VXLAN networks. And then another database hack, which wasn't as difficult as you thought, because if I can hack the database, any of y'all can. Modify the database, restart some of the agents, and watch the magic happen. So here's an example of one of those networks. On the left, you can see a standard VXLAN network with V99, notice the segment, sorry, the VLAN or network ID is CB3. After the conversion, the same network is now a provider network type of VLAN with segmentation ID 1109. The best part about it, the instances had no idea that it happened. Yeah, and these may seem like drastic steps, right? Nobody wants to have to get into the Neutron database to make changes, restart agents, and develop that work, that process. The reason why we have to take those steps is because there is no API hook to perform this sort of modification, right? The idea is that you create a network, you use it, if you don't need it, you destroy it, but you can't go from one provider network type to another, right? The ML2 driver and the database schema really enabled us to make this change really quickly. And we're talking three seconds of downtime as the Linux project agent rebuilt these interfaces. So moving forward, having learned the lessons and being burned by early VXLAN use, that VLAN tenant networks may still have a place after all. I know that everybody, the emphasis is cloud scale, VXLAN is going to enable that, but for some of our customers, maybe they only have five networks or 50 networks. And sure, it may be a lot of VLANs that they need to provision for this environment, but sometimes stability and consistency trumps the scalability there. So with VLAN tenant networks, there's a lot less work for the neutron agents to do because you no longer have to rely on the L2POP mechanism driver to program all of the bridge tables. And you get better performance there in the eyes of the user, right? Their instance is available much quicker and it's consistently available. What you'll see moving forward, I think, VXLAN moving away from the host altogether and being performed at the top of the rack switch. So then you're still looking at VLANs between the compute node and the top of the rack switch. And it's real important that if you do want to leverage VXLAN, which is great, that you maybe make the investment into newer hardware that can help offer better performance than some of the older gen stuff. So the next thing, Johnny? The next thing, the nursing migration that we performed was a difference between to use the L3 agent or simply not use the L3 agent, meaning are we gonna put our instances behind routers or are we gonna put them directly behind some type of physical network device? One is gonna offer us flexibility, perhaps one is gonna offer us performance. So the benefit of having the L3 agent, it gives the power to the user. Users can create routers, users can create floating IPs, they can manipulate those floating IPs however they need to. Some other key points? Sorry. No, that's fine. So when you leverage neutron routers, you're putting the hands of network creation and architecture into the hands of the user. So with tenant networks, with VXLAN tenant networks, those networks are effectively isolated. Those aren't being terminated on some physical network device. The neutron router is where you would connect to that VXLAN network to provide inbound and outbound connectivity. So if you go with VXLAN, you absolutely need to go with the L3 agent and neutron routers. Multiple tenant networks should be attached to a router. You're able to route east-west between networks behind the same router, no problem. Your inbound and outbound connectivity from an instance is handled by some sort of NAT on that neutron router typically. So source NAT for outbound traffic or floating IPs provided in and out unique address. With neutron routers, there's little to no change for the physical infrastructure. So one of the benefits of overlay networking is that it all rides on a single network. Users can create thousands of networks and you don't have to modify the physical infrastructure at all. You get overlapping subnets and you're able to leverage new technologies like VPN as a service or firewall as a service. When you talk about moving instances into provider networks which effectively use physical hardware gateways, now you're talking about having to interface with a network administrator to trunk VLANs to compute nodes or use a mechanism driver like the Arista driver or Cisco driver to program those switches. The great part about going this route is that your compute node now is the path to the physical network. You're no longer having to hit a network node or an inferno where that neutron router may live. Now a downside is potentially if you do require some sort of NAT that has to be handled upstream and chances are there's no API interaction with neutron to make that happen. So some of the issues that we ran into with this particular situation was obviously the router became the single point of failure. We had some issues with HA routers at the time. This was again a couple, at least a year ago where we were having issues with HA routers both becoming active or non becoming active. Moving over to a hardware device allowed us to utilize the HA feature of the hardware. Possibly a little more reliable at the time than HA routers. No network congestion because like James mentioned, the compute node can send traffic directly to the hardware gateway. And of course, we noticed that in case a router did fail over to a different. Or if a router was rescheduled to a different agent. Programming that router took 10, 15, 20 minutes depending on the number of floating IPs that were on that router. Just to program the IP tables that required to make those translations. And it could take minutes to restore connectivity. So one of, and I apologize, this may be a little difficult to see, but one of the tests we performed was a scale test for loading up a single neutron router with 1,000 VMs behind it and 1,000 floating IPs and performing what we call a time-to-ping test. How long did it take for that instance to be accessible via its floating IP as soon as I booted it? And you'll see that across these 1,000 VMs, boot time was pretty consistent. That instance went active between six to 10 seconds. Now you'll see that the increase of the time-to-ping is sort of linear as I increase my number of instances. And what we learned about that was that as the number of ports associated with that router, that message got larger and larger and the actions that that router had to perform when setting up the networks took longer. So if the neutron router was applying IP tables, it's not only applying the IP tables rule for that one instance, it's actually possibly reapplying all of the existing rules as sort of a, just part of its operation. Safety mechanism. Yeah, an auto-heal sort of functionality. One thing we'll mention is that drop in time there in the green box, that's a result of us finding a bug in the way the Neutron L3 agent handled the application of those IP tables rules. When the upstream community patched the bug, we immediately saw a drop and then as we worked out that increase. Chances are you're not going to have a single router with 1,000 VMs behind it, but you never know how your users are going to use the cloud, all right. Some of the other issues we experienced with L3 is that by having to require the use of NAT for inbound or outbound connectivity, sometimes that had a negative impact on applications. We have a customer that uses Windows instances and relies on WMI, just like FTP, the real IP may be required for connectivity and the use of NAT kind of broke their application. Active directory. And sometimes you have use cases where you want users to be able to reach your instance via their fixed IP externally but also require the use of NAT. So to make that work, we had to statically route tenant networks to Neutron routers and that doesn't scale well either, right. The idea is to leverage a Neutron API to do everything. When you start interfacing with external teams, you really take a lot of the flexibility of the cloud out of the equation. So again, another pretty big decision. Do we take them off L3? Are they really using the features required that L3 provides to them? Or would it be simpler to put them in a standard provider network? So we decided to ditch L3. They weren't using floating IPs the way that they needed to, they weren't really utilizing firewalls of service, VPNs of service, any of those other options. So we decided to simplify the network. The process was pretty simple. Detach the routers from the gateway, detach the routers from the tenant network and reconfigure the physical infrastructure to address what the router was doing. So here's a quick side-by-side of what the tenant networks look like before and after the switch. You can see on the left, you've got multiple, that's weird. Well, on the left, we have three Neutron routers connected to a single provider network and the VMs behind those networks and the transition was to basically move those tenant networks up to physical hardware. Again, at that point, you lose a lot of the flexibility that Neutron provides you, but for this use case, you know, the user was sticking to a single router behind a single, or a single network behind a single router and didn't really scale out. So having maybe gone with provider networks initially, gathering those requirements from the user early on could have helped avoid those problems later on. We're getting minimal downtime for this migration. It has had no idea that their gateway changed. Quick clearing of their ARP cache and everything was good. Yeah, we got it. In the future, you know, even today in Mataka, BGP speaker functionality enables us to advertise tenant networks to external gateways and not have to rely on static routing. DVR addresses the network bottleneck of the network node and allows compute nodes to forward traffic directly out. And L3HA presides that router resiliency, right? Significant increases in stability for HA routers. Yep. So last but not least, we'll just kind of talk real quickly about VXLan VTEP learning, your two options, L2Population or Multicast. As Johnny mentioned earlier, everything across the cloud needs to know how to reach the other with VXLan. Your two options, L2Pop and Multicast, both are VTEP learning processes. L2Population is a more dynamic learning, I'm sorry, a very static programming learning process because the Neutron agents, Neutron server work together to program the bridge table and the ARP table on the compute nodes. L2Pop was developed by the Neutron community, or at least in Juneau, has undergone a lot of work, but in some cases is still widely inefficient. The alternative being Multicast, which has been around for a long time. It's not managed by the Neutron agents. A lot of the learning mechanisms is handled by the data plane itself and it works through the OVS and VXLan kernel modules, depending on which one you go with. One of the downsizes is it does require some programming on the physical switches for it to operate properly. As you can see in the Multicast demonstration, traffic as it leaves one VTEP will send traffic to the Multicast address and the switch takes over and handles the forwarding of that traffic to the respective nodes. You don't see the animation, but it's there. Oh, that's a bummer. That's a bummer. With L2Population, we also have an animation and basically shows Neutron server as a port is bound to a node. Neutron server sends notifications to the appropriate agents and those agents are responsible for programming their own tables. As the number of ports in a network grows, that message for those updates gets larger and we have observed that those updates in the agents take longer and it's very linear. Some of the issues with L2Pop we mentioned earlier is that the agents are slow to build their bridge and ARP tables. How that manifests itself is, again, is the inability to reach an instance or for an instance to reach its gateway. As a result of some of these issues we've had with L2Pop, there have been numerous bugs submitted. OpenSec Ansible, the upstream community that we leverage, migrated, or changed the default from L2Pop to multicast. Now, yeah, go ahead. Now we're running multicast, thinking that this is the greatest thing since sliced bread because we don't have to worry about L2Pop anymore. The first thing that we realized is in a couple of our upgrades, the network infrastructure that it was on wasn't ready for multicast, which means everything came to a screeching halt. The physical network does require, first of all, that the hardware does support multicast and then there's some configuration involved with the IGNP snooping and the querier. Both of those need to be configured in order for multicast to properly function. So again, as a result, when we did this upgrade, nothing worked. So we fixed it. Right, how did we fix it? Back to L2Pop. Back to L2Pop. Now there's nothing wrong with it for this cloud. It wasn't gonna see the same scaling issues as it manifested itself in our earlier example. This is a much smaller cloud, a much smaller scale. So L2Pop was gonna be just fine. It required no interaction from the network guys. We were able to leverage Neutron to do all the programming for us. Yep, and again, kind of harping back on, it's not a one size fits all solution, right? Gather your requirements, determine what the best method is going to be for you, implement that, but you know that in a lot of these cases as we've shown that you can change and it doesn't necessarily require a repave. So we'll wrap this up. We've gone over a little bit, but to recap some of the lessons, if you're gonna live on the bleeding edge and adopt a technology early in its infancy, be prepared for that to be painful, especially as an operator and even more so as a user, right? These clouds, a lot of these clouds are in production, thousands of these clouds are in production. And if you're leveraging technology and infancy, you're gonna cause problems for your users and that may have a negative impact on their adoption of OpenStack in general, right? We learned that short-term pain is sometimes needed for long-term gain, right? I'm gonna contradict what I just said, but our adoption of those technologies early on gave us the operational experience to know how we wanted to move forward in the future. We feel that we understand OpenB switch a lot better now. Had we adopted it now, it's much more complex than it was even then. So it may have taken a lot longer for us to get on board. Be sure that your hardware meets your network requirements, upgrading to NuNix to leverage these technologies is probably the way to go. So you'll wanna make sure that you make investments in the hardware accordingly. And users are gonna lose faith in the product and your cloud and maybe look elsewhere, public clouds or lose faith in OpenStack in general if what you're providing doesn't provide reasonable access time, stability and consistency, right? And we've shown that by keeping things simple when you don't need the complexity, it's gonna save operational time and pain and provide a better experience. Meet the cloud more functional. Yeah. Well, that's all we've got, guys. I'm not sure we have time for questions. We went with the other group to come up, but if you wanna hit us up, we'll be up front. So. Could you figure out a second slide? Yeah, absolutely. Second slide, I think. All right, well, thank you, everyone. Thank you.