This is day two of the Speaker Workshop stand. Of course, they're here, ultimately here at DEF CON, and let me tell you, I think first and foremost on a very personal note, we were just talking about it. I think this is a lot of people here, you know, joining us so early on a Saturday morning because I'm pretty sure a lot of you folks here, I think a lot of people may have had a few late nights. Did anyone go to a concert last night? Yeah. Did anyone go to a concert? I heard it was really good. First up last from the past, you know, from the 2000s as well. Who here? This is your first DEF CON. This is your, wow, it never seems to amaze me, it never seems to amaze me, the number of people who attend DEF CON for the first time here, and looking at the room, it's usually like at least a good 50, 60, 70% is like first time here. On a personal note, my first DEF CON was in 2006 or DEF CON 14, and you know, like then, I knew nothing, and I absolutely knew absolutely nothing, and you know, what I learned from that first DEF CON was, it really, really makes a big difference when you work with other people, collaborate, learn as much, just try to eat up and learn from the experience. I know it's very hard to do now. I know it's very hard to do now, because I've heard, I saw in the social media pictures that it's an absolute, I don't even know what the right word is, zoo, getting into the tracks, and I know it's harder to do here at the main DEF CON, but you know, you definitely have spent your day wisely already here at the Packard Hacking Village, because it's a little more intimate, and plus although it's a little far out, it's definitely a lot intimate. If you don't believe this, this is what a DEF CON track was like 10 years ago. It was nice and small and intimate. Now it's like a stadium, I mean that's the biggest difference, and this is the reason why I still come to DEF CON as the Packard Hacking Village, and I'm not sure if some of you heard that I said. The reason why I still come to DEF CON is because my first experience, you know, at DEF CON was working, it was what they call the Table of Noom, the Wall of Sheep, and working with the people at the Wall of Sheep when I had my first DEF CON gave me the networking and security foundation I never got out of school.  The only big difference now between the Packard Hacking Village then in 2006 and versus as it is now, I mean it was just a user name and password posted on paper plates in 2006. Now what we have here, we have the speaker workshops, we have the Wall of Sheep. We also have a bunch of learning opportunities as well. If you are new to network and packet analysis, there is Packard Detective all the way in Neapolitan 1. It's like to my left. There is, if you're really, really hungry for this stuff and you think you're really good at dissecting networks and PCAPs, there is Capture to Packard, which is traditionally a Black Badge event. We also have the Wife by Sheep Hunt. We have Honey Pots, and we also have Sheep City, which has returned, and Sheep City what it is, it's just a bunch of, you might have seen a little train track that is out there. You may see a little train track, and there's a big bottle of booze that has an IOTs thing to it. There's a whole bunch of routers that were donated by 360.cn that were from China. As far as I know, if you can break into them, I think you can take one home. We don't know how any of that stuff works. We had trouble trying to get the manual because no one can read Mandarin here. I think some people, we finally figured it out. I don't know. It's all on display there, but knock yourself out. Just knock yourself out over there. With that said, actually, with that said, just mentioning about 360.cn, I want to take a brief opportunity to also say, if you take a look around the village, you take a look around even here, it's a core for this room and for this village, none of the stuff comes cheap at all. We are very grateful for the number of sponsors that we have that have made this year's packet hacking village possible with all the free swag and all that for the attendees. The Wallachieft title sponsor is Flunk, packet detective sponsor Fidelis, Capture the Packet title sponsor Packet Slid, Capture the Packet Platinum sponsor Talos, Sheep City title sponsor Dark Matter, Sheep City sponsor 360.cn, and the Honeypot title sponsor 802 Secure. Those are our sponsors. Thank them, but most importantly, I want to thank you for spending the morning here. In a few minutes at 10.10, what we're going to do is we're going to introduce two to kick off this morning's speaker workshop. We have two old friends and two DEF CON veterans, Vivek, Thomas, and they'll talk about making your own 802.11 AC monitoring gadget. You won't be disappointed, believe me, because they've come quite early, this isn't your first time, and we always welcome your back. In a few minutes I'll just give you the intro, but does anyone have a, oh, one keynote, one note here. If you have any questions, thoughts for any of the talks, the mic is right there, you know, at the, you know, when it's time for a question and answer, please feel free to use the mic here. So, also, very important, we have a lot of people ask us, each and every, almost like each and every talk, each and every talk, you know, what will these talks be made publicly available? The answer is yes, and this is how it works. We have a video, we have a video and AV recorder over there. Thank you so much, by the way, for everything that you've done for us, for so far at DEF CON. So, all the talks for the speaker workshops are video recorded. The videos for all of our talks, for each and every one of our talks, will be made available at the same time as the DEF CON video. That usually takes two to three months, however, even better than that. What about the notes and PDF slides? Thanks for all, almost all, if not all, of our speaker workshops, unless it's like into serious intellectual property and corporate matters, they will be made available within the next two weeks on the Wallachiep website, wallachiep.com. So, talks, all of our talks, this talk, will be not only video recorded, but your slides will be made, and slides will be also be made publicly on the Wallachiep website. Okay? So, yeah, all the content is there for free for the taking for future use and future reference. One last keynote, one last note before I make the introduction to Vivek and to Tomas. Want to start the morning off also to give each and every one a public service announcement. This is something that I've made over every so often, is a public service announcement which is a serious problem that is affecting cybersecurity and tech community and that is sexual harassment. I mean, just, this is absolutely not tolerated here at the packet hacking village with us. It's a no-no.  This matter is really, really affecting the community. I just want to make everyone aware of it. It's absolutely not tolerated, absolutely not tolerated. Definitely also take a look at the code of conduct. Don't do it. Don't go there.  So now with that said, I've rambled enough for 10, for almost 10 minutes, you know. So why don't we might as well just kick it off, day two of the speaker workshops at the packet hacking village. And I said earlier, you know, we're going to start this speaker workshop with a bang because we have two old friends and two DEF CON veterans with us today.  And these two need no introduction, we've got security tube and air crack NG. Vivek Tomas is all yours, ladies and gentlemen. Thank you so much for the introduction. It's always a pleasure and an honor to be invited to the packet hacking village. Thank you all for coming early in the morning. You know, we were always worried 10, 10, nobody shows up, but thank you so much. So we are going to be talking about making your own 802.11 AC monitoring hacker gadget. My name is Vivek and I have Tomas along with me. I'm just going to run through our introductions real quick. I've been hacking for the last 15, 16 years, started my career as a low level engineer, spoke first in DC 15, so it's been 10 years for me, broke web cloaking, discovered a couple of attacks, the cafe latte, won a couple of competitions. Tomas and I speak and train at multiple conferences. We've been running the Wi-Fi training at Black Hat for the past five years. I also run security tube and pentester academy. So you probably already know me, well, those of you who have used air crack NG are any of the GUI tools like Fern Wi-Fi, J-Rex and all those ones that are using underneath air crack NG. I also created a long time ago the offensive security course, waifu, which has been renamed to wireless attacks. And I speak and train at multiple conventions. I'm now self-employed, so I do infosec trainings, links consulting, and software development. This was supposed to be back, I authored a couple of books. I think we're playing with the keyboard, it probably, this is good, okay. The agenda, so we have a lot of exciting things today. We are going to be looking at 802.11 basics, understand the current challenges at trying to monitor 11AC, look at different commodity hardware we could use to get started, and then see how we can create our own custom open WRT solution. So we could pretty much run tools like AeroDump, Air Crack, Horst, even Python on some of these commodity hardware routers and create your monitoring attack defense platform. After we cover that, Thomas will show you how to go ahead, capture the packets, analyze them using a little tool he's created called the Wi-Fi Beat. Okay, so let's step back if you remember the last 10 golden years of Wi-Fi monitoring, right, when we had just A, B, and G networks, typically a single input, single output system, extremely easy, right? We had our alpha cards, the directional antennas, set the card on the same channel as the access point, start monitoring, you get to see all the packets, right? It was wonderful, it was paradise. And then N and 11AC came along and started making matters bad for us. So what is so complicated about N and AC that requires us to create a custom solution? And why using a USB-based adapter which we're all used to does not scale or work properly as we move along 11AC speeds? So the very first feature with N and AC have is channel bonding. Now, putting it simply with A, B, and G what we really had was 20 megahertz channels, right? N and AC said, hey, why not combine both of these channels to adjacent ones, there are other variations as well, and create a 40 megahertz channel? From our perspective, if you want to monitor a network using 40 megahertz, using channel bonding, you need to ensure that your card supports channel bonding as well. A very common question which I get from pen testers in the field is, hey, I am monitoring this network, I see nothing. Well, that is because either you have a 20 megahertz only card or you have a card which can operate on 40 but you set it on 20. One of the most common mistakes I've seen people do. So channel bonding requires you to have compatible hardware and to make sure that you set the channel appropriately. Then we have five gigahertz channels, right?  So on these channels, there could be radar or other communication happening and what access points are required to do is sense those channels and if they see that there is any form of radar or any other communication, then to back off and not use them. Now, this is great. Unfortunately, the bad guys, if you're monitoring a network, don't play by the rules. So I've even seen a lot of million dollar 11 AC monitoring products actually back off from channels where there is radar communication happening but attackers can very easily create backdoor APs, rogue APs on these channels even though there is probably something happening there. So our monitoring solution also requires that we sense and monitor all channels regardless of other transmissions which might, depending on the jurisdiction you're in, mean you need permission. So from an attacker or a defender's perspective, we need to make sure that the regulatory domains which we are setting on the monitoring platform is coherent with what we want to do. Again, one of the most common mistakes I've seen people do, they start monitoring, don't see any traffic from some channels, they just assume nothing is happening there. In all probability, your card is probably not even going on those channels. Okay, if that wasn't enough, NNAC has MIMO, right? Multiple input, multiple output. Very simply put, this is really multiple transmission and receiving antennas, all of them sending out the signal. The DSP on the receiver side is going to pick up these signals from these different receiving antennas and combine them intelligently so you have a much more powerful stable signal. Now, with NNAC, they actually brought in an additional complexity. So the ideal case is if you want higher reliability, you would want to transmit the same signal, let's say from both the antennas, right? Now, in NNAC, you have what are called spatial streams. So this is really trying to go ahead and get higher throughput at the cost of reliability. So what they do is we have a high bit rate signal and they split that signal up and every antenna is actually going to transmit part of that signal. So now each antenna is really sending a part of that data stream. On the receiver side, they have a lot of DSP going on which can intelligently combine that together. So essentially, now we have multiple spatial streams which send data independently of each other. In the case of N, we can have four streams. That is the maximum. I've seen most commercial equipment go up to three streams, but you can do four streams. With AC, we can go all the way up to eight streams which is quite a lot. Just to give you an example, all your phones or rather most of your phones which even are 11AC compatible are probably single stream. Most of your laptops probably are two stream. The last I checked only the MacBook Pro was three stream. So keep that in mind. From our perspective, if you're monitoring a network which is four stream or eight stream and you do not have compatible hardware, you're probably not going to see most of the data being sent, right? Again, very, very important. So pen testers buy equipment. Again, I've seen that teaching WiFi security now for 10 years. They go to the field, start monitoring, don't see anything. And then you realize they have a single stream adapter while the network is operating completely in four streams. So this is important. Keep this in mind. You have to purchase equipment which is compatible with the number of streams of the network you're trying to monitor. Okay, if that wasn't enough. They also came out with Siu and MuMimo. So what is this all about? SiuMimo is really 11N and AC way one. Now, we talked about the fact that we have multiple streams, right? Four streams, eight streams. That's what these APs can do. But the clients themselves, unfortunately can be one, two stream. In general. So with SiuMimo or single user MIMO, the access point time division multiplexes between these devices. So let's say we have a laptop which is four stream and two mobile phones which are single stream. The access point is going to multiplex between them. So it talks four stream to the four stream laptop. It talks single stream to the single stream mobile phones. As you can clearly see, that is not optimal, right? It's more like a hub model where when an AP is talking to a device, it's essentially just occupying the channel with just that device. So with MuMimo, which is really bleeding edge, 11AC wave two, what they try to do is actually simultaneously talk to multiple devices. So in that figure which we have, let's say the laptop has two streams and we have two mobile phones, single stream each, the access point can simultaneously talk to the two stream laptop and the two single stream mobile phones, right? There are some limitations, there are some cases of how grouping and all of that happens, but this is the overall view. Another example, a four stream AP on the left can talk to four single stream clients or the same four stream AP can talk to two single stream clients and one two stream client, okay? Okay, more challenges. And as you can clearly see how vastly ABG versus NNAC differs, especially as we move towards wave two. So additionally, what we have with AC is also beam forming. So what is beam forming? Now, previously in the good old days, we used to have an access point, typically omnidirectional, sending out power in all directions, right? So which means if the AP is communicating with a client here, an attacker is located in the other direction, he might still be able to pick it up. Unfortunately, what they decided to do, and this is unfortunate for us, good for of course, the larger consumer market, is now they actually try to detect the direction in which the client or the device, either party is communicating with and they try to channelize the energy in that direction. So this way, it is more directed, which means you get more range and of course this is an optimal solution. From our perspective, location matters, right? You just can't get away now with just having, I mean the physics is against you. Unless you're Neo from Matrix, you are probably going to have to have more sensors or an optimal location. Okay, so to summarize, NNAC actually bring about a lot of additional features, which is going to make monitoring more and more difficult. Couple of them as I mentioned, channel width, you know we have 2040, with AC that can be 80 and even 160. The 160 megahertz equipment, I've not seen too many enterprises use, but the adoption is increasing. Probably a year, year and a half from now, you should see more and more 160 megahertz, 11AC networks. We are packing more bits per megahertz, so the quam or the quadrature amplitude modulation, that is increasing as well, all the way to 256 quam for 11AC. Spatial streams increase, beamforming, MIMO and all the stuff we talked about. Of course, with all of this new technology coming in, you have the monster APs invading, right? You may have seen a lot of these photographs with 6, 10, 12, you know how many ever antennas, and with of course every antenna getting added, the price gets bummed as well. Some of these are pretty powerful platforms. And many of them are actually based off open WRT and other Linux platforms. The sad part, not all vendors acknowledge that publicly, but if you just try to log into the box and do a little bit of digging, you'll actually find almost 50% of these APs are just running Linux based on open WRT, DDWRT or one of the other variants. Interestingly, when I bought the ASUS one for one of the trainings we were conducting, I even saw this little home assessment kind of banner ad. I don't know if you've seen it. So now you can actually invite a wireless expert to your home so he can lay everything out for you in an optimal way. And of course, then your neighbor in the next apartment decides to change his AP's locations. And then you have to call him back again. Okay, this is just a diagram of how you could go ahead and use multiple radios and chain together more and more bandwidth. So to summarize, these are the challenges we are looking at. Beamforming, challenge of course, location matters, spatial stream count. We have to ensure that our capturing and monitoring platform has equal number of spatial streams as the network we are lying to monitor. High speed. Now, this is really where I'm gonna disappoint many of you because as these networks are really fast, unfortunately you'll find that USB based solutions aren't going to work anymore. So I'm sorry if I have to break the bad news, but we really cannot use USB anymore unless all you're interested in is just macro statistics. If you wanna do deep packet inspection, look at what is happening at a much more micro level, detect threats and all of that, anomaly time correlation or spatial correlation, you do require a much more robust solution, which is what we're gonna talk about. Multiple channels, channel bonding, again compatible hardware. Okay, so as I mentioned, I'm gonna go a bit fast, we have a lot to cover, I'll take call questions at the end and even outside. Okay, so as I mentioned, the Wi-Fi adapters, especially the USB ones, aren't going to be very useful. So what we want to do is AP based monitoring. Now there are many commercial APs available, which are based on open source. I've tested probably over a hundred, and I'm not kidding you, over a hundred. The ones which I've found really good, reasonably priced is the Ubiquiti range. I don't work for them. And I don't have a referral code anywhere there, so just so you know. So Ubiquiti actually has a series of Unify APs. Some of you might have already bought it. These are based out of open WRT. I don't see that acknowledged anywhere on their website or maybe my cert skills are bad, but after digging a little deep, what I've found is it's just open WRT. So what we are going to do is pick up one of these access points and see if we can do something with them. First with whatever manufacturer firmware is in it, and then see how we can load our own customized firmware so we can port attack tools and all of that in it, okay? So the USC AC Pro. Now these little access points are supposed to be either cloud-based or to be controlled by a local embedded controller. Now when you buy them, my recommendation, if you want to use it for monitoring, do not connect and provision them. Rolling back all of the stuff the provisioning scripts do is a couple of hours of work. So just buy them, take it out of the box, power it up and just wait for two to three minutes. What happens is the AC Pro tries to get a DHCP address so it can connect to a cloud system. When it fails, the entire Unify series goes ahead and assumes a static IP address which is <IP_ADDRESS>, right? It's a predictable single IP which the entire range of APs take. The good news, SSH is enabled because SSH is what is used to provision these APs. Do we have to reverse engineer the firmware? You know, user NIDA, do something to get the default username and password? No. It's someone posted that on the forums. The default username is UBNT and the password is? UBNT. So what I've done is this is an access point which I've bought, contains the manufacturer firmware, no modification made. I've just powered it up, it uses PoE and now I'm going to go ahead and log into the AP. So it is going to be difficult to type with one hand. I'll try. Okay, so the IP address, as I mentioned, was <IP_ADDRESS> and the password is UBNT. As soon as you log in, people who've worked with embedded systems or routers, that must be a familiar prompt, right? Busy box. Is this visible at the back? Okay. Now the first thing which I like to do and I'm kind of running you through how I experiment with newer platforms which I look at is just hit that twice and look at all the built-in utilities available. A lot of times manufacturers may have, most utilities you would require, which is the case for the Ubiquiti series. So if I were to just scroll up, I always love to see IW config because this allows me to quickly look at interfaces without having to go around in circles. And then I actually find that there is a WLAN config, which is fantastic, come to that. We have WPA supplicant, host APD and a couple of other utilities. So let's actually run IW config and look at what interfaces are available on this system. So we have at zero and at one. And if you notice, at zero is currently in master mode. So when it says mode master, it just means it's an access point, okay? We can see this is the 2.4 gigahertz radio. So this actually has two radios in it. One for 2.4, the other for five, fantastic. So we don't require two APs, we can just use one platform to monitor both the bands. Then you have at one. Interestingly, this seems to be managed mode and at one, of course, is the five gigahertz radio, great. Unfortunately, can't do anything with these interfaces. So what I'd like to do is destroy these interfaces and go ahead and create monitor mode interfaces in turn, which we can use, right? Again, a lot of hit and trial and what I've actually found is even though you should be able to destroy these interfaces directly, it's always a good idea to kind of bring them down before you destroy it, okay? So let me bring these down, I'm gonna bring these down at zero down and then at one down. Now, to destroy them, we are going to use the WLAN config utility. Again, let me retrait every single utility right now is built in with the manufacturer firmware, right? These are not my additions. We'll come to my additions later. So the usage to destroy an interface is as simple as it can get. WLAN config at zero, destroy and then WLAN config at one, destroy. Now, if we look at the list of interfaces, we see that at zero and at one have been destroyed, right? Now, keep in mind, this is the running config. I haven't saved this in a persistent way and I'll talk about that later when we look at our customizations, right? So now that we've destroyed both of these, we'd like to create monitor mode interfaces which we can use. Again, WLAN config comes to our rescue. I mean, unbelievably simple. All you have to do is WLAN config. Let's name the monitor mode interface. So let's actually call this mon zero, the first monitor mode interface. I'm going to say create and again, all I'm doing is copying this command out, WLAN dev. Now, you want to create this virtual monitor mode interface on top of one of the cards. So I'm going to be using Wifi zero, right? The first card. And then the WLAN mode, I am typing with one hand, so. And of course, the option is monitor. Okay, so what this is going to do is create a new interface mon zero as a virtual adapter on top of Wifi zero and this will be a monitor mode interface, right? So I hit an enter, it goes ahead and echoes back mon zero, which means everything went well. Similarly, I'm going to go ahead and create mon one on top of Wifi one. Fantastic. Now we have two monitor mode interfaces. Let's bring them up. So if config mon zero up and then mon one up. Let's type in IW config and there we are, right? So what we've done so far, if I were to summarize is we've removed the interfaces the manufacturer had by default and we've created monitor mode interfaces on the box. So now let's actually set this to a channel. So I'm going to go ahead and say IW config mon zero channel six. Now, we'd like to look at the packets. Good news, TCP dump is also in there. So TCP dump dash I mon zero and there you go. So we are now monitoring 2.4 gigahertz, channel six. Where's the clapping? Thank you, thank you. I haven't slept the whole night because I had to kind of flash firmware so you guys had to keep me awake. We have a booth and just trying to flash firmware for it. Okay, so this is good. This is great. Bad news, right? The device does not have storage capacity. It probably has around 10 megabit or something like that. Well, what they did is they've kind of removed some functionality here or there but I'll show you how to find the disk size in just a bit. But we can't do anything on this device. Well, we can look at the packets using TCP dump and that's great from a research standpoint but what more? So what we can do is stream packets from this device using SSH back to a central server where we can analyze them as a pcap file or actually even just have Wireshark receive that stream and look at it live. So let's do that. This is the command. Let's explain the command in a bit. Okay, so what this command does and now I'm running this on my host machine, right? Which is connected to this box. Now keep in mind that you could connect this to even your local network in your enterprise and still stream it to any server. This doesn't necessarily have to be connected physically to the collection, you know, station, right? So all I'm doing is logging in using SSH. The username is UBNT. The IP address is 1.20. I'm just gonna be a bit fast. You don't have too much time. And then I'm going to invoke TCP dump, give it mon zero, tell it to snap the entire packet length and then write it to, you know, SGD out which comes back over SSH and gets piped into Wireshark. K is start immediately. I is interface which is the input, right? So once I go ahead and run this, Wireshark pops up assuming you have that stored locally. Now the moment I log in, packets will get automatically streamed into Wireshark. Isn't that cool? And you can go ahead and write your own channel hopper, you know, simple bash script or, you know, something similar and that work as well. So this is how you can go ahead, get the packets from the device to a remote collection server. You could even just go ahead, redirect this into a file and then have multiple utilities read from it. Great. Now, this isn't enough, right? We want to run Thomas' tool. I mean, he's been a good friend for 10 years is the least I could do. So we want to run arrow dump and G on it. We want to run, you know, Python on it. We want to run pretty much whatever we want, right? So that we can convert this into a fully customized platform. So there are a lot of steps. What I'm going to be doing is I've shot videos of every step which you guys can look at later of how to install the firmware. It's pretty straightforward. We don't have enough time. So I'm just going to go through it in the slides and at the end I'm going to give you a link which you can use. So all we do is download a compatible open WRT and basically write that onto the device using MTD. Once we do that, we can restart the device extremely straightforward, nothing complex. Restart the device. You get a familiar open WRT prompt. If you haven't used it, open WRT is an embedded Linux used by a lot of commercial routers, both home as well as enterprise grade. Extremely flexible, has a lot of package management and support from a security perspective, AircrackNG, MDK3, SKP, a lot of these tools are supported in the package manager itself. So you don't have to do any of the cross-compiling exercise. The next thing of course, which we notice is we only have around 10 megabit. So we are going to use a technique called EXT Root which allows us to extend the root onto an external storage device which is a USB key. So this is the modified one and if you notice I have a USB key connected to it, right? It's a 16 gig one though, you can pretty much go as high as you'd like. So you could have that external storage and dump everything in it or load the US and other things from it, a lot of possibilities. Okay, we have to install the AT-10K drivers. Again, everything is there, no cross-compiling required. Now, what I'm going to do is I have gone ahead and put all of this on that device and I'm going to now connect to that device and show you how it looks like, right? The entire customization process is very simple. Just you have to follow the steps. I'm going to give you videos for that. Just a second. Okay, the demo gods are with me so far. Let's see if a simple SSH works or if that is what is okay. Hopefully this will work. So the OpenWRT system, I'm root on that unlike UBNT. I had to check what privileges UBNT was but I'm probably sure it's close to root. I didn't try installing anything. And the IP address of my customized device now running OpenWRT is 50.150. I'm going to SSH into it and there you go. You have to change the welcome message, right? Why mon? That's all the customization I did. So with the manufacturer firmware, of course we had to go through all the pains of creating the monitor mode interface and all of that. With the customized one, okay. Looks like the USB key. So this does take roughly, I think a minute or two to start. Just give me a second. Okay, I'm waiting for an IP address. I should have shortly. Okay, there we go. Okay, so now that I have the USB key connected with all my customizations, as soon as we log in you see we see WLAN zero and WLAN one, do you see that? So what I've done is I've changed the init scripts and these automatically are set to monitor mode. So we don't have to do anything, it's just plug and play. I'm going to quickly just demo three tools. The videos have a lot more and then I'm going to give it to Otthama. So the first tool we all love and we have the creator here with us is of course AeroDumpNG. And there you go. Collapse. Yeah. I'm going to remind you that. So here is AeroDumpNG. And Thomas has a little plug there which says contact the author. This is a trick so that he gets fan mail. So along with that, what I'm going to do is run another tool called horse. Now this is actually quite an underappreciated tool in my opinion. Horse allows you to do scanning on five gigahertz and is aware of channel bonding and all of that. There you go. I use this actually to hop channels, do other interesting things, they have an API. I would highly recommend looking at this tool. Now right now if you notice at the bottom right, we are on channel 60. At the rate 80 means 80 megahertz, right? Right here at the bottom, might not be too visible. C8 036 at 80. So channel 36, 80 megahertz. I can go ahead and tell it to scan by selecting S and this now starts scanning all the channels. And you can even set it for HD 20, 40, 80, 160, whatever combinations you want. It has a config file which you can change and modify as well, okay? The videos have more detailed information. The last thing I want to quickly show is, and by the way you can run MDK3, you can run all your attack tools on this, right? Air replay, injection attacks, everything. The last thing I want to show is for people who love Python. Scapey. Scapey, right? So extremely simple code is just the POC just to show you that we can run Scapey very easily. So this is like the simplest Scapey code ever. All it does is monitors the interface, takes a number of packets and just prints the summary. Now on the other side, there you go. So there it is. Scapey running. Great, people remembered. And of course you can pretty much port more sniffers and injectors if you want. So I'm gonna give it to Thomas now what he's going to show is how you can now take all of these packets and do deep analysis. Yeah. Great. So I created recently another tool called Wi-Fi Beat. So you store all your packets, parsed in Elastic Search and then you can search for them using Kibana or you can use other tools such Elast Alert to create alerts and send you emails or using other channels. So I'm gonna quickly go through and explain the different Elastic Tools. What is a Beat? Wi-Fi Beat itself and the two libraries that I created along with it. And a quick demo and let you know where you can download it. So all the Elastic Tools, so you have Elastic Search which is a pretty much a NoSQL database and stores JSON documents. And you have Kibana that does visualization so it connects to Elastic Search to do that. You have LogStash that can connect also to Elastic Search and stores all the logs from a bunch of different sources. And you also have Beats. And Beats are pretty much data shippers and can send data either to LogStash or directly to Elastic Search. So here are some of them. You have FileBeat that reads log files much lighter than LogStash if you only need to read log files. You have a MetricBeat that is metrics. WinLogBeat that is Windows logs because Windows had to do something different. HeatBeat that shows the uptime and PacketBeat that does packet monitoring and parsing. You might think that PacketBeat is the one you're looking for but no it doesn't understand RadioTap which is the header that comes with Wi-Fi packets, the metadata. So basically you have all the information, say it says which channel is best captured on, the signal and a bunch of other information. So that's the error that appears when you start a program. So I created Wi-FiBeat as well as two libraries that I needed for it. So Wi-FiBeat captures all the packets from one or multiple wireless interfaces and store them on Elastic Search. So you can even read pcap file. You have full packet decoding pretty much like wire shark filters so you can transpose pretty much your wire shark filter, display filter in Kibana so you can search for the packets. You can also do decryption if you'd like but in that case you have to provide the key in the configuration file. It doesn't do any cracking whatsoever. You have to use a crack engine or any other tool to do that. Another library that I created was simple.json-cpp a C++ library that just do a simple generation for JSON. Then here's what it looks like so you have some of the codes. You create an object here, that's the main document. You create values and you simply add all those values to the main document. Here I create another object and I create a key and value in that object and I finally add that to the main one. For example, here is a vector, an array that we add to the main object and then I exploit it to a string. So that's very easy, very simple to create a JSON. I used to use a rapid JSON but that one was very complicated. It's very nice, very fast but the problem here has some very weird memory allocations so and you had for example, for this one, for this one you had to do like four lines of code and considering the amount of code that is even in Warsaw decoding 27,000 lines that was out of question, not maintainable. The other library that I did was Elastic Beat and that is both of those library are header only so you don't have to compile any code so you just include it in your main project and it gets compiled with it. So for now it uses rapid JSON for parsing JSON documents and it inserts stuff using the bulk API from Elastic Search. So this is what it looks like. So you connect to Elastic Search here. So on our local hosts, we display the version. Here's another example where you can get indices, all the tables pretty much. You can check if an index exists and then create it and here's for example that bulk request that we do.  All of them are gonna be sent in one query. You can do either index or delete. So the index is pretty much insert for those who have done a relational databases. And finally, you can see if there are any errors, if there are any, so you will just display that into the error field and if not, you get all your IDs back in case you want to process them. So to summarize, so the Wi-Fi beat is GPL V3. It parses and so the data in Elastic Search you also have a Kibana dashboard with it and it's in C++. The two libraries that created were in BSD license so you do whatever you want with it. You can even include them in your commercial product. It doesn't matter and they're both C++. So Elastic Beat communicates with Elastic Search and simple JSON generates JSON. So now let's switch quickly to the demo. Okay, so now you can see, I have a search field so in Kibana you have three main items so you have discover where you see all your logs or documents, you visualize where you can create visualization and you have dashboard. So here's just a search for a specific time frame because I already have a ton of data for that and here's one of the document. So you can see here exactly all the data parsed and in database. So one thing about it is Elastic Search for Kibana displays everything flat so you can see it here. So that the W9.MGT.ASEL and you see a bunch of them ACL.Cable.CSI.IF.Reserved.Irex. And so all those things were in a single JSON document and here you have a different item so you can see that image here. So Elastic Search for Kibana cannot handle arrays so it just displays it like this. There's a workaround, there's a library for that for either Elastic Search for Kibana and I give the link to it in the project. So here's you if you want to take a look at the JSON. That's what the document looked like. So the familiar fields in the baguette. So version type subtype, so the type of the frame and subtype of the frame. And if I look at the water shark here so if I can open that one and I can actually take my filter all the way above here I just have to modify a little bit since it changes the column to equals and so we have the exact same bag as well, different capture, the same thing that are parsed. So the frame control field that we had and you can see all the information in Elastic Search here. So in the dashboard for now I created a very simple dashboard with a bit basic information about a network. So that way it looks like you can see a different type of frames, the amount of frames. You can even calculate the other searches that are added so that you can calculate the amount of data that is stored that has been transmitted in the network. So that's what the tool looked like when you run it. You have the version, it's the version of configuration. You can change the configuration file if you're doing some testing. You can make it go in the foreground if you want to debug some stuff and all the logs go to syslog. So everything, all the action that are logged to syslog in case you want to sit and you're running a background. You have a pit file, very useful when you're running as a service. So we already went through all that. So a few last words, elastic beat. So I'm gonna add the beat protocol in the future built in a rapid JSON or even get rid of it and built in a library. For simple JSON, I'm gonna do more JSON parsing with it and for Wi-Fi beat. I will do persistent queues, support for NP-CAP, so some Windows adapters supports monitor mode so you can use them. Very P-CAP supports unusual channel width, so 5, 10 megahertz, even HG and VHG channels which is already in the code but not enabled yet.  So if you want to take a look at all the projects they're all on GitHub, github.com slash Wi-Fi beat. The case doesn't matter so you can even put a lower case, that's fine. It will redirect you to it. Or you can just go to Wi-Fi beat.org that contains the links to it and just a brief description. Be good back to back.


Have you ever thought about making money in the U.S. stock market? Well, if you'd like to make money in the market, you need a specific strategy or system to follow every day, otherwise you will be lost. You have to find stocks that are rallying, that have strength to go long, or if you want to short, then you're looking for stocks that are weak, that are dropping, that you can sell off. And remember, if you're day trading, you only need that strength or weakness for that one particular day or one particular time period that you trade it. So I teach a class on my system. My class is called the Golden Gap course where you would learn the 26-point rating system that I use to determine where a stock is going to go in the day, what institutions are going to buy the stock, or what institutions are going to sell the stock. It is all about power money in the market. I call it power money because it's institutional money that comes in and moves the market higher or sells the market off or any stock that you would happen to trade. If you'd like more information, you can email me at melissa at thestockswitch.com.


your occupation here. The vote has been concluded. We won 217-210. The MX is passed. That's the fourth vote in the last few weeks in the Congress on the MX. All four have been victorious as far as, well, I think as far as America's concerned, because this shows again that we are able to stand in a bipartisan way before the world and say this is where our security is concerned. How do you put them up in the next round for the 48? Well, we've got a few months before that comes up. Senator Nahn has introduced a measure all ready to cap it at 42. Cap the MX. Well, those things will go on, but all I know is that in Geneva today, they can sit down at the negotiating table and know that we came forward in a bipartisan manner and have voted this weapon system. Do you think you'll do that well in the next round when you go for contra-aid? Well, that's a whole different subject. We'll fight that one out too. Frankly, it is vitally important. How about negotiations on the defense budget? Are you close to an agreement, Mr. President? We're talking right now with our own Senate leaders here on whatever we can do and what the package will be that we hope we can go forward together. How much more do you think you can cut? I don't know, but I do know that no compromise should involve any of the basic weapons systems that we're defending. But a stretch out would still allow them to go forward. You'd agree to a stretch out, wouldn't you? Sometimes a stretch out, however, results in an increased cost. If you delay the manufacture of something stretching it out, you find out the per-unit car storage up and you don't save anything. You still think you're going to have a budget deal before Easter? For the Easter recess? That's kind of hard to protect. We haven't been able to do that so far since I've been here. All right, good luck in your tie. There's not a sunny tie. Where's your sweater? Oh, we have it. We have all our treasures. What do you think about the indictment of Bernard Getz yesterday? With that before and of course, no compromise.


Hello and welcome back to another vlog. Thank you so much for tuning in as always. My name is Claire Carmichael and I'm a newly qualified general practice nurse. I'm ashamed to say I'm 36 years old. I am a nurse and I have never ever given blood. This was my first time and there's always been, well there's a mixture of two things. Firstly, I'd never really thought about it before. I know the message is out there and maybe the message needs to be out there a little bit more and people need to raise awareness a little bit more I think because I didn't really think about it until probably a few years ago and I thought maybe I should give blood. That's a really good thing to do. But then I had tattoos, I had piercings, I'd go away on holiday. So there was always something that would stop me from giving blood but then that's down to me as well because if I really, really wanted to I would prioritise that obviously. So I think for me I need more awareness I think and this is why I wanted to do this vlog to raise a bit more awareness about how important it is to donate blood and actually how un-painful and actually fine it was as well. Spoiler alert, it was okay. But on Sunday I gave my very, very first blood donation. I couldn't vlog when I was in there. I couldn't because of the people that were around me. I didn't want to break confidentiality, anything like that. So I didn't vlog when I was in there but I did take a picture. It's coming up now so please if you're squeamish look away for a split, four seconds I will put this on for just to show that I did do it. I was there. But yes, this was my blood donation. Now I have to warn you this looks ten hundred million times worse than it actually is. I think because when she went into my vein and this happens to me as well because I take blood sometimes if your vein's quite juicy vein and you go in sometimes the blood squirts out as you go in. I think that's a good sign because you've got good juicy veins I suppose. So that's why it looks a little bit worse because when she went in a bit of blood squirted out and it's on my arm so it looks way worse than it was, it wasn't that bad I promise. So what happens when you give blood? Firstly you register. Download the app. I'll put all the links below. Download the app. Register your interest to donate blood. There's a whole load of dates and times to pick from. They may be weeks and weeks and weeks in advance. I had to wait I think about three months for my blood donation because it was so full. Obviously it gets so full because they haven't got that much space to do the blood donation so only so many people can go at once and they only have certain days and times that they do it. So it looks like a lot of people are given blood but actually realistically not many people are given blood if that makes sense. So please sign up it's worth the wait, please do it. Register today. Next you will get some updates. You will get some text message updates from them just to remind you to sort of motivate you. It motivated me. Then you will get a form through the post.  So things such as make sure you eat in the morning. It's not a fastened blood test. Make sure you eat, make sure you stay hydrated. So I prepared the day before and this is something I always do if I'm going to have a blood test or something like that. So if you really struggle with blood tests and they can't find veins and stuff like that just a little tip that it doesn't always help but nine times out of ten it really does help. So the day before you want to start getting hydrated drink as much as you physically can without overflowing your veins. You don't want to overdo it but just drink a lot. You don't want to be just drinking one or two drinks a day. That's not good.  Make sure you're drinking plenty of fluids, pints and pints in the morning before you go. I had two big mugs of tea. I had a glass of squash like a half pint of squash and then when I arrived, I also had my breakfast as well and then when I arrived at 9.40 they gave me a pint of squash to drink as well and some biscuits and stuff so I did that as well. So I really overdid it I think because I wanted to be prepared for my blood test so that's what I did. So make sure when you go for your blood test just prepare yourself. Make sure you eat, make sure you drink a lot. Just really prepare yourself and your veins but not only that it's going to help you maybe stop from passing out because it is a lot of blood they take and a lot of people do feel a lot faint and queasy and I actually felt fine after mine and I think that was the preparation side of it as well as the mental state of it. I know a lot of people have needle phobias, blood phobias, trust me I've seen so many people faint when I've taken their blood even the people that say that they're okay with needles I've seen faint it's so common it really really is so please don't be embarrassed or worried that this might happen to you because if it's going to happen it's going to happen but just prepare yourself for it and make sure you're eating and drinking and that's why they have a lot of snacks on site as well just to get those blood sugar levels up and yeah you'll be okay don't panic. So on arrival you will get to a little desk you will register they will make you sit in a waiting area because of Covid at the minute I sat in a different room everything was like separated we had all this distancing in place it was really really well organised actually so I had to sit in a room I drank my pint of squash I had some biscuits and then I fell out of form because I couldn't find my form I know I had it planned I still can't find it I've put it somewhere so safe I can't find it so I arrived I had to fill out the form so I just filled out the form drank some squash and then they took me through they went on to the computer system so you will sit with a really nice healthcare professional who goes through all the questions for you they will double check your identity so check your name address date of birth make sure you are who you say you are you're not just giving blood for somebody else I don't know why and all do that but um yeah that just they've got to put in these checks people are strange sometimes and then they will take you to a little private booth where they will do a fingerprint test which wasn't too bad actually I was really dreading it because I know they can hurt quite a bit but actually it wasn't too bad they put a drop of blood into this solution I still have no idea what they do I'm not very good with bloods honestly so they drop it in and they're measuring how long it takes for it to sort of sink to the bottom to judge your blood and if it doesn't sink then they have to do the second test which I had to have of course I did so they drop the blood and it literally just sat on the top and I was like what does this mean I don't know what this means and then they said oh we just need to do a second test to check your hb and they said as long as it's over 125 it's okay so mine was 127 so I was like great okay that's good so luckily I did give blood thank god and then once all that is okay they take you round to the chair when a chair becomes available it's not if it's not available you'll go back into the waiting area again and then when a chair comes available you go you sit in the chair they prep you all up they check your identity again ask your name address date of birth there's quite a lot of checks that goes on which is nice assess your veins that's the first thing they have to do is assess whether your veins are good enough for blood donation because if you've not got good veins you're there for quite a while you're there between five to eight minutes they say giving blood so your veins have to be good enough for them to get the vein in the first place and yeah it's got to be a good flow and stuff like that so they have to assess the veins how big they are how juicy they are if they bounce like when you tap them do they bounce if they got a good bounce which means you've got a sort of a good amount of flow of blood but yeah anyway they assess your veins if they're not good enough you're out of there you can't donate blood you have to come back another day and do 101 things like drinking more and stuff like that to try and get your veins good enough and yeah but my blood it kept um slowing down and the machine kept um sort of beeping so then she was like you need to do the exercises so you have to do this when you've got your arm like that in there and you have to sort of squeeze your hand like this and then they give you exercises to cleanse your bum and your thighs and then release slowly and then clench and then release i'm doing it now why am i doing it now and they give you other things that you have to move your feet like this and lift a leg and lift a leg and then lift both legs all things like that but as i was doing that i think i wasn't thinking about my arm and i kept moving my arm and possibly that's why the machine kept slowing down that's my theory so in the end i just had to lie there like just concentrate on the blood concentrate um but it was okay in the end i managed to get the full bag and i'm so chuffed that i finally did it and then she took it out and it was fine i was fine i felt fine afterwards everyone was so lovely as well they constantly check on you constantly say thank you as well for your donation it was just such a nice experience and i know people don't really think of blood donations as a nice experience but it was nice it made me feel good and everyone was so thankful for your donation as well everyone was really friendly and lovely and after your blood donation you'll be asked to take another seat so you have to wait for about five to ten minutes just to make sure that you're okay you're not going to pass out anything like that drink the tea coffee juice that they provided the crisps the biscuits chocolate whatever they provided have because you need to make sure that you're okay before you leave that room and replace those fluids that you're sort of losing if that makes sense afterwards my arm i think my arm hurt more after i mean you feel it go in when you um when they initially put the needle in it's like if you've got your ear pierced or your nose pierced or anything like that you feel that sharp but it's literally seconds once it's in you don't feel it so you just sort of lie in there like i don't know if anyone else is the same but i couldn't feel anything once it was in it was just that initial quick literally seconds to save a life is nothing so please don't let that put you off at all um and then afterwards it felt like um felt like i've been at the gym and i've been doing weights on this arm because my whole arm was aching and it felt where they took the blood just felt a bit bruised but that was it and it felt like that pretty much for the rest of the night until the next day the next day it was fine it was like nothing had happened and literally i had the tiniest i mean you can see it now that's literally all i've had when i took the plaster off and i looked and i was like is that it come on guys i looked and i was like this is pathetic come on i was expecting it to go really bad because i bruised really easy but actually that's nothing for me that's nothing i fully expected a lot worse and i know some people do bruise a lot worse as well afterwards so if you do get bruised don't worry about it it's normal and i found out that my blood group when you go you find out your blood group sorry info guys i found out and be positive which is amazing and then i read into actually only eight percent of people that give donations or be positive does that make sense so be positive people only eight percent of us give donations so i looked at that and i thought you know what i now i need to give blood because there's not so many of us giving blood and that really put that into percent and that really put that into perspective for me so now every 16 weeks females you can give every 16 weeks so now i'm going to be giving blood every 16 weeks knowing those stats and knowing actually it was all right it was literally nothing so i'm going to give blood every 16 weeks guys save a life so yes that be positive status really cheer me up like that is the perfect blood group for me be positive that is me i am positive yeah so the second part of this video is all about some little facts about blood donations why your donation is needed and hopefully it's going to give you the motivation to register today it's not that bad guys just do it go on so the nhs blood donation people need at least 400 new donors a day and around 135 000 donors a year to replace the people that can't donate anymore they also need 40 000 black donors to meet the demand for better matched blood they also need 30 000 new donors with priority blood such as o negative every year and more young people really need to start signing up to give blood so that we've got more blood donations for the future the two rarest and the most high in demand blood groups are ab negative and r o subtype with only around two percent of donors that have these type of bloods and the demand increases by 10 to 15 percent each year for it so there might be some things that stop you from giving blood so if you've been unwell recently and with covid it's going to be even harder if you've currently got a cold flu if you're pregnant you've got a long-term condition if you're currently taking any antibiotic you've had any sort of medical treatment recently or if you've been for a big operation at the dentist some parts of travel as well so if you've traveled outside the uk you need to make sure that that's not on the list of you can't donate blood if you've received a transplant or a blood transfusion yourself if you have had acupuncture in the last so many weeks then you can't give blood but if it was like a few months ago then it's okay and in november 2017 i'm pleased to announce there were some changes so that men who have sex with men can give blood now so we need more blood donors absolutely 100 get out there register today give blood it's an amazing feeling as well i've got a text message i'll put the text message here actually i've got a text message as well to say that um i had my blood group and like my blood was being processed for somebody so it was just amazing to think do you know what that was really quick i've only just literally given my blood this week like within days i've had a text message to say it's been used and it was just amazing so chuffed that i finally did it not only was it my new year's resolution but it's a really good thing to do it's saving a life you are literally saving a life and i always said do you know what my mission is before i die i want to save a life and to know that i may have possibly saved a life today is just incredible and if that doesn't motivate you i don't know what will don't be selfish go give your blood save a life


The mental health challenges were 2000s cartoon characters. Anxiety is so Timmy Turner. With that bullying babysitter, no wonder Timmy is a walking embodiment of the unease intention that characterizes anxiety. Also, his wishes, impulsive attempts to solve his problems, turn his life into a vicious cycle of creating more problems than they solve, and we won't even get into this fear of failure. Squidward is basically depression personified. Squid sonified? Octa sonified? Hopelessness? Check. Lack of enthusiasm for hobbies? Check. Social withdrawal and then irritability when someone, cough, Patrick and Spongebob? Cough. Try to break the isolation? Yeah. ADHD is stitch. Energetic and impulsive. Our favorite alien represents the difficulties with attention and accomplishing tasks that are typified by ADHD, but he learns the superpower of channeling that energy into doing some great things. If any of these things sound or feel familiar and you're struggling, don't hesitate to reach out for support. There is no shame.


Your opinion on Ihan Oman's anti-Semitic remarks. I mean Ihan Oman is a horrific person She is you know, again, she wears that You know, she holds a Barbaric from everything I've seen. She's a really slommest. She holds a barbaric Islamist ideology on top of that You know, she Expresses herself clearly an anti-Semitic with anti-Semitic remarks. Suddenly if it's not anti-Semitic they are blindly viciously anti-Israeli, which means blindly viciously anti civilization anti-Western civilization. So she is viciously anti civilized Civilized country and should be condemned by all means for that. So even if you don't even if she says oh, I'm not anti-Semitic I'm just anti-Israel. Okay, I'll take that That is vicious in and of itself. So I think it's horrible. I think it's horrible. She was elected I think the Democrats needs if you know Unless this is direction they want the party to get somebody should run against her in the primaries and defeat her because this is You know This on top of socialism the end of this country. Okay, drudge


Welcome back to the channel. Welcome back to the vlog. I'm officially on my very first, oh wait No second day of vacation now. I have the next 10 days off as I mentioned on the prior video So what that means is I have nothing to do but a whole bunch to do at the same time over the next 10 days But first I wanted to talk to you all about something and get your opinion on a few things And I'll tell you what those things are in just a minute So the thing I wanted to talk to you about is My vacation, which is kind of not happening anymore So we're playing this whole grand trip up to upstate New York We're gonna say this super elaborate Mohawk Mountain House, which I'll link a picture up here Many of you have probably already seen it on social media. It's absolutely beautiful The only problem is it's super expensive. So with that being said, we were basically going to book for a few days Just go upstate relax turn all phones off turn all camera turn all laptop Wi-Fi everything off and just kind of experience Nature because that whole reserve over there is beautiful. We're going to mountain bike. We're gonna hike and then We cancel So you may ask yourself Why did you cancel your vacation when you were so excited to go on it in the first place and the answer is If you looked at the weather you would know so back to vacation So it's supposed to rain literally the three days We were supposed to go all the way to upstate New York So we basically had a discussion is it worth spending a whole bunch of money just to sit inside a Ritsu hotel room and not even be able to explore any of the stuff upstate has to offer Which is the whole reason we were doing up there in the first place And we eventually just decided that it wasn't worth it. So cancel the trip So and your Anna being the order how she is actually chose to go back to work on her week off instead of take vacation with me So essentially, I'm here just roaming around New York City for 10 days on a prolonged Stacation which basically means I can catch up on every single thing. I've been putting off for the past like Year of my life pretty much. So let's start with making a whole bunch of videos. I Have no idea why this tractor is at the Guggenheim Museum, but this tire is as tall as I am I'm six four This tire is literally I should taller than me. I think look hold on So now let's talk about the next thing I wanted to talk to you all about which is I Want to know your opinion on if me and my brothers should start a podcast now I know what you're thinking Everybody's starting a podcast right now. Why do you want to just follow the pack and do your own podcast? But the real reason is I think we can offer something unique Which is why everybody starts a podcast to begin with so for those of you who don't know my older brother is a neurology Neurosurgery veterinarian and my younger brother is also a Radiology resident. He's in his third year residency. So he's two years behind me So we have three doctors in the family. So my brother came up with a good plan that Why don't we just start a podcast? We have a unique outlook on things We have two brothers in human medicine one brother in animal medicine. So with our powers combined We could probably come up with Something entertaining right so I don't know we are in the talks about doing it my both my brothers live in Chicago I live in New York City, obviously, so I don't know how the logistics would work out Maybe we could bank a whole bunch of podcasts or whatnot But let me know in the comments below what you think should we do a podcast together and what should we talk about? So the next thing I wanted to talk to you all about is something I already mentioned before and that is what the heck I'm going to do with all this footage from our live case conference. I did One or two weeks ago now. So when I say stock footage basically what I mean by that is During the procedures, which I did two procedures that day and kind of film them broadcasting them to the world I had a camera set up in the corner in which I kind of recorded like the whole process of me prepping the patient getting access Doing the case and all that kind of stuff But then I realized I was trying to do this whole like behind-the-scenes style video and I never actually finished the video So it kind of just cuts off after the second procedure of the day because I had to do inpatients at the end of that Whole live case symposium and I never got around to kind of finishing the video. So it's just kind of Stuck in its raw form. I have a whole bunch of footage in the corner of the procedure room A beginning I have when I'm doing like some of the behind-the-scenes stuff, but then there's no ending so I'm thinking about just posting like a 30 minute video of just purely the whole procedure And just kind of like a behind-the-scenes look at what we do Without any commentary whatsoever and I'll probably speed up some frames and whatnot But let me know in the comments below if you think that'd be something you'd be interested in I'll probably do like 10 views on it, but what can you do? I don't know what else to do with the footage This Is linux hill hospital that is the hospital I did my intern you're at that is the hospital I've also done two videos on now. I have a lot of fond memories of this hospital I feel like this is the hospital where I actually became a doctor It's where I pretty much learned everything learned how to operate learned how to take care of patients And also met my wife. So I never told you my favorite thing about living here and that is because The hospital is right there and My old apartment is like right here. So I literally used to just wake up at like 5 30 Walked across the street and I was at the hospital. It was the best thing ever Here's my old apartment This little Six-story or seven-story elevator building loved it All right, so I am going to officially end the vlog here I want you all to respond to all those questions. I asked you I want to know if I should do a podcast with my brothers I want to know what you all think I should do with the footage I want to know What videos you want me to make during this vacation or staycation where I'm just sitting around doing nothing And that's pretty much it. So as always make sure you smash like subscribe And follow me on instagram if you're already leave a comment below if I liked it. I'll respond to it. Follow me on tiktok Otherwise, see you all on the next video


Tom here from Lawrence Systems and we're gonna talk about Nebula, the open source global overlay network from Slack. And before you're probably wondering, well, do we need another network VPN style solution? Well, maybe. And I bring this up because I started digging into this. I can't remember if it was a comment from a YouTube video or a forum post. But I think more than one person had mentioned, hey, Tom, can you look at Nebula? And that was a little while ago. And I say, hey, it looks pretty cool. Well, then I didn't realize just how cool it was. And I like right here on the Slack's announcement page. And yes, Slack is essentially where this was developed, tested and vetted. But then it's all released as open sources, 100% self hosted type project that you download the code and run yourself, which is an important factor in this. So what is the easiest way to securely connect tens of thousands of computers hosted at multiple cloud surf riders and he doesn't locations around the globe. And they had to invent this tool to solve this problem. And you're probably thinking, well, doesn't VPN solve this? And well, not exactly. And I really encourage you to watch the video over here on Define Networking. They have embedded which Define Networking is the new company that kind of came out of this. And my affiliation is always like to get this clear upfront is I found this project interesting. It's open source. I had a great conversation with the CEO, Ryan Heber. I actually went back and forth on the fundamentals and where the project's going, which was a great conversation. And you know, I am as enthusiastic as he is about networks. And we were having this conversation even on a Sunday afternoon on Twitter. Anyways, not to get off topic. They have plenty of deep dives where they've talked about some of the impetus for inventing it. I wanted to cover it here on my channel because I did some testing with it and find it really to be a fascinating solution, especially because security in this is October 2019. He talks about the essentially zero trust where Slack did not want some third parties to be part of the control plane for the security of their network. And that seems pretty like a good idea in October 2019. And with the events that took place in December of talking about supply line attack and things like that that occurred in December of 2020, it seems like a wonderful idea to completely self host a secure networking solution that doesn't have or a reliance, I should say, on any type of third party, which is what makes this a really interesting tool. And this is why I'm bringing it up. Also, I want to bring a few things up about some problems with it. And that's this right here. I just want to get this out of the way before people take the time to watch this video and go, Hey, it doesn't work with my NAT setup. Yes, if you have two devices behind NATs, they are going to cause problems because at this time in January 2020, but it is on a roadmap for a future release to have this solved, they have a lot of NAT problems. This was really designed for a lot of public cloud infrastructure that they wanted to have private access to with groups and security. So it works wonderful. And that's the solution that we're going to show in action where you can have a node behind a NAT talking to a public cloud server. But if both nodes are behind a NAT, each nebula node behind separate NAT, then you may run into a lot of problems. And that's what this long discussion breaks down. But once they support relaying, and this is, you know, very similar to zero tier, which I've covered on this channel before, which does support relaying, that's how zero tier solves this problem. If two firewalls have trouble talking to each other through UDP hole punching, it can go, Okay, I'll just relay the traffic. Now, in zero tier, if you had watched that video, I'll leave a link to it. They refer to them as your moons and planets to talk about how it works. Nebula uses a slightly different nomenclature, but very similar functionality of, they call them lighthouses. Lighthouses are the directors of traffic, if you will, to understand where all the nodes were and basically create an index of where all the connections are coming from. And we'll break down how to set that up shortly here. Before we dive into these details, let's first, if you'd like to learn more about me and my company, head over to laurancesystems.com. If you'd like to hire a short project, there's a hires button right at the top. If you'd like to help keep this channel sponsor-free and thank you to everyone who already has, there is a join button here for YouTube and a Patreon page. Your support is greatly appreciated. If you're looking for deals or discounts on products and services we offer on this channel, check out the affiliate links down below. They're in the description of all of our videos, including a link to our shirt store. We have a wide variety of shirts that we sell and new designs come out. Well, randomly, so check back frequently. And finally, our forums, forums.laurancesystems.com, is where you can have a more in-depth discussion about this video and other tech topics you've seen on this channel. Now, back to our content. Now, as I said, it's all open source right here on GitHub. You can download the code, compile it yourself. They got a pretty straightforward how to set that up, or you can check out the release pages for the downloads. And they've got quite a few different downloads for a lot of different variety of things. Of note, besides having, you know, ARM and MIPS, which means you can get it working on things like Raspberry Pis and lots of other devices, they do have the Nebula Windows. But the Nebula Windows does have a reliance on the TUN TAP driver from OpenVPN. So you do have to load that in addition to this to get it working on Windows. These are all things that are in the future will be solved. But this is also a very heavy DevOps tool, more so than a end user tool, or something that's easy to set up.  This is more targeted as building cloud connectivity that was also cloud agnostic. So if you want to move servers around, you assign these Nebula adapter IP addresses to them. And no matter where the servers are, the development tools can just always point towards those IP addresses for connectivity and the lighthouse will redirect and fix things kind of as they go wrong. As you go, okay, I moved all these servers over here. Now I got to go redeploy these IP addresses. Actually, you don't. You can just change public cloud IP addresses all you want. The Nebula IP address is the same for connectivity on the back end. So it's really kind of a clever solution for that. You can also build in groups and a lot of other features that some of this will go out of spec for this. But like I said, watch the video over and find networking where they dive deeper into it. I just want to get the news out there, so to speak, and other people interested in this particular project. And by the way, they do need a lot of help with documentation. So if you want to help an open source project, reach out to them over at Define Networking, they are hiring, and I have no financial vested interest in this at all. It's just one of those, hey, it's a cool project and I want to help them out. Back over here to how to get started with it, though. What is Nebula? We covered that getting started quickly. Downloading up into binaries, start building the certifications or certs, not certifications. The Nebula system works on your CA that you build in the beginning of it. This is actually a really clever thing because when you build everything off of CA, we first create our signing authority, which we'll call, they called my organization, I just called it Nebula demo, we'll cover that in a second. And you create these two files named key CA.key and CA to occur in the current directory. The CA.key is the most sensitive file you create because it's used to sign certificates for individual nodes. So essentially you establish where you're going to sign all these nodes. You can sign them privately on your computer and keep this locked down and then distribute all the certificates through probably some level of automation, however you want to build that out, as you see fit. By the way, they do have a quick start vagrant right here file. So you can use some of the automation. It's a framework. It's not complete, but it kind of gets you the idea of how to get it set up if you want to build this with automation. They did all this with scale and automation by using this type of file to do all the creation and distribution of keys, et cetera, customize it. I like that they give you kind of an idea and a template to get things going, including how to install it as a service, which is going to go out of scope of this.  You can just run the binary for the command line. But yeah, those things go out of scope of this, but I do have installs of service and a couple of the servers. They give you an example configuration, which will walk through how the lighthouse is configured and how the nodes are configured. They also show you how to sign each individual node. Now the default signing for both the original CAU create and each individual node is one year, but that can be customized through the command line to say I want it to go longer. Now the advantage of doing it this way is when you define things like your groups and that is for security reasons. So when we get to the firewall rules, it's rather clever because you can say, all right, I assign this group called servers or this group called users or well, let's say we had a group called developers and we want to give all the developers access to these particular ports on all these hosts. Well, you just define that group and then you throw the group in there and firewall rules and you define the ports in that rule and now away it goes. The other advantage of doing it when you do certificate based here is that one year. Now, like I said, you can extend it if you wanted to, but this is something that happens in the corporate world all the time, especially when you build things at scale, you sometimes may forget about something. Now, if the key expires on something, someone's going to make some noise and complain about it, but this is a way to kind of auto prune by letting them expire and go, well, they're not accessing anything anymore and let's practice proper principles of least privilege and let those nodes expire. If no one complains, fine, they're no longer part of the nebula. I kind of like that from a security standpoint of maybe even creating expirations that last even faster. Now, this is not standard public domain type signing for those wondering. This is all your own signing server. It's rather simple to manage because you can just reissue certificates each time for the nodes and renew them on a signing server and through whatever automation DevOps tools you're using, push those out to keep everything up to date. And like I said, anything that goes into expiration is just going to fall off. All right, now let's actually look for how it works and show you some of this up. Now, complete disclosure here, I'm going to expose public IPs on both my digital ocean lighthouses and any keys you see will can be, well, they're going to be destroyed before this is over. And yes, this is my home computer that I'm going to SSH into that will expose my public IP, which I'm fine with because it does dynamically change. This is what it is right now. I'll also log in through my IPs here at my office, but that doesn't really matter because I'm not going to be showing a public IP for that. But just to make it easier for this demonstration, yes, I will. I just want to address that because it comes up in the comments constantly. All right, here's that first late house. Now, the first thing about lighthouses is how they work. The lighthouse is either part of the network because you want it to be one of the servers. So you can have one of your DevOps servers be a lighthouse and also something you want to access, or the lighthouse can be just a node that directs traffic in terms of where things are located, but doesn't actually pass traffic. So this computer is going to ask the lighthouse, where's this? So let's we want to get to the server over here. And so it asked that question. That question is then answered by then creating a connection between these servers. So the traffic never routes through the lighthouse. It's not the way to sign. Now, when a future releases, they, when they add relaying into this, they'll be designated relays, and probably the lighthouse could be a relay where when we have that double NAT problem, because this NAT and this NAT means these two can't directly talk to each other easily because the lighthouse, when it when asked, where's the Tom desktop computer? It answers, but because it's behind NAT, there's that connectivity problem that I alluded to in the very beginning. But without the traffic passing through the lighthouse, it's really just a lighthouse, a beacon, if you will, for where all of the things are. So let's go ahead and look at the lighthouse over here. And we're in the ocean lighthouse. Let's look at the config file. So there's the CA dot cert, the keys, the part you keep private, but each server, each nebula node, host needs a CA dot cert file, the original search. So they understand to talk to that key. Here's the ocean lighthouse dot CRT and ocean lighthouse dot key that we created. Then comes to the static host map, those static host map 10, 001, and then the public IP address.  So this is 10, 001, 10, 002, my desktop is going to be 10, 009, and London is 10, 0044. Each one of these is the signing name for it. And these are the IP addresses. I didn't bother with the groups. Didn't really need them for this particular demo. Then it drops these, grabs these files, the dot key, dot CRT and CA dot CRT and drops them all in each of those locations. It's installed as a service on the ocean lighthouse. And it's installed as a service on the London server we'll log into. It is not installed as a service on my nebula home or my local computer here. So we're just going to run it from the command line on those. But that's where we got that IP address you define out your network. Now I did a slash 24, obviously you can do even larger scale if you want to. Then we go to the lighthouse config and lighthouse equals true. That means this one's a lighthouse hosts. Now in all the other hosts, you'll list out the lighthouse IP addresses in the lighthouse. It doesn't need this in here. It can be empty. Now the default port in the example config file they give you is 4242. I left it. It doesn't really matter. They have a couple other fine tuning options that you can read through here. This is a little bit interesting because you can adjust fine tuning such as the MTU. Watch that video that he did because he talks about the different challenges of defining different MTUs and different cloud services. And sometimes while you want to increase or decrease them for efficiency and fine tuning, but they give you all those options. There is some built in logging in here goes out of scope, but it's a feature it has. And now we come down to the firewall rules. Now outbound and inbound, everything's defined on each nebula node and the host can be any or as it shows down here that's commented out the groups. So you can define a port of 443 protocol TCP group laptop or home. I don't have any groups to find, but that's how you'd set that. And then here we can set the ports. Now the nebula, because it's not actually traversing any traffic, it's not making a list on 4242 public IP side, but internally I would at least recommend allowing any, any for ICMP. I've actually got it wide open here so anything can do it because I'll change it and show you how the demo works. But the same thing with the outbound traffic. This is a good way to narrow everything down. Now anything that's going to be talking on the nebula nodes is going to be able to talk on these nodes because you authenticated them and put them on the nebula nodes, which means you can watch the firewall logs very, very closely because you're not going to have a lot of noise in them. If there's something getting a disallow, it's trying to get to somewhere that you blocked. You have either a nefarious actor on your network or you have a misconfigured service reaching out to something it wasn't supposed to, either way that makes firewall logs very, very actionable. This is that security that I mentioned at the beginning where they wanted to be able to monitor things and not just from standing up a bunch of VPNs. This is a nice, quiet way to do it. Everything on the nebula node has been signed with the certificate and everything should be there. And if something happens, you kind of get to note right away because it's trying to reach out to something it shouldn't reach out to. Anyways, we'll leave these at any of you to get them started. Now we'll go ahead and close this. Now the service is already running. So if we go and we can see it's active running, we can restart the service if we needed to, but let's actually go right here and show right here is my security union where we're going to show the public IP address and show the connections. And I want to show that this computer, this is my home computer, has no active connections to this London host and no active connections to the lighthouse host. So let's go ahead and change that. We'll actually watch this one here and we're going to do a nebula, show the config. I'll just show real quick here. Here's the ca cert and config.yaml. Well, I guess we've probably looked at the config file real quick. So let's go ahead and look at it. There's the ca home ltsca.cert, the home key home.crt, the static host map, which matches the same as the lighthouse. This is where things start changing. Lighthouse false because well, this isn't a lighthouse. It just needs to talk to them. And this is the lighthouse that'll talk to and for redundancy, you can have more lighthouses. Of course, we just have one, which is enough for this demo. This is where the hosts are listed. The hosts you listen here are the lighthouse nodes. And this was empty on the lighthouse one. Other than that, all the config is the same. Actually, one thing I probably didn't change here is it is on default port 4242. And on other ones, you can define it to go on 4242 or set it to zero, which means pick a random port each time it starts. It doesn't really matter because it's reaching out to the lighthouse. But we can delete that, insert zero as an option. Then we're going to come down here to the firewall rules. So we have this all set to wide open any any, we'll change them in the future here. But allow any between the hosts and allow outbound traffic any so we can have anything incoming that's on the nebula nodes that are authenticated anything outbound. And now we're just going to go ahead and create that adapter. So let's go here, write that and I have config currently no nebula adapter attached to this device. So we go here and sudo actually will make it right here. So you can see what happens in the background. So when we kick this off, my password in, we've now established a connection port 4242 because that's what we told it to talk to a nebula. Here's the random outbound ports of 617 and of 54454, whatever it's talking to a nebula node. So let's go ahead and bring up another connection. I'll split the screen numbers using Tmux because people will ask. So let's first ping the lighthouse node. By the way, if you ping 10.1 it adds the zeros in between automatically, but I'm talking to the lighthouse node. So there's some traffic. We can see the traffic going up as I talked to that node. What about the London node? That one has actually a IP address of 10.0.44. So let's go ahead and ping 10.44. And it reached out, asked the lighthouse, where is the London node? And it responded very quickly and is now pinging away on that particular node. So if we go over here, we don't see anything other than a connection that's going out from the public IP address and heading out over to the London node. Now, all that it did was talk to does not relay through the lighthouse, that's the house where it is, and then the connections are established. So pretty straightforward for being able to do that. And we have, and let's go over here to the London node. And let's look at the config on that. So if we, vim slash etsy, nebula, config, and we allow protocol ICMP, any, any. And Tom desktop though can do any, any inbound from nebula. I do recommend you at least have this protocol, any ICMP, any, and the reason for that is at least be able to ping. So you, before you're wondering why a service may not be working or you can't get to a port on it, always try ping. So we can allow ICMP, but nothing else. And what that means is if we are on here and we SSH to root at dead air won't let me talk to it. So let's go ahead and adjust that. So we want instead, I think this one's going to be called home. So if we change it from Tom desktop to home, and let's say a port specifically 22, and it's a TCP. So now we've created this rule that says we will allow home to talk TCP only on port 22 to this particular server. So go ahead and write that or restart the nebula service permission and I bubble key, but it works now. I don't have a key for it. So it says, well, you can talk to it, but you don't have the right key for it. But now it does respond in a civil course will respond to ping requests. And by the way, that's one thing about this is how fast does nebula restart. So we can really show and let's actually do it this way. So in the bottom window here, I'm on the nebula home on the top, I'm SSH into that London nebula. So let's sort of ping over here. So you can see him at the same time. Whoops. 10,00044 restart the nebula service. Yes, the connections are rebuilt so fast, we didn't even I don't think we lost a packet on there. 7% packet loss. So there was a there was a packet dropped inside of there nebulas protocols do establish very, very fast. So restarting service or even when a service moves, it'll update the lighthouses of its new location. And it can reestablish the connections very, very fast. This is definitely an advantage it has and should be able to look over here. We'll see both the new connections were established and the old ones because it's got to expire out those old ones, but they still exist. And I think we can probably demonstrate this again. Restart the service. And you keep seeing the stale connections because they're still existed. They're just getting dropped. So each time I do this, but it only drops just for a moment. So things that are happening in the background and connectivity on there if you have to modify a service. Now there's another way to do this that he examines in a video where you don't have to restart the service. It can reload. I believe it's the firewall rules. Some of the rules can be reloaded so to speak on the fly and change without actually shutting down the service without being disruptive. I don't remember how he did that. This is something you need is more documentation because there's some other methods you can do, but either way you can see how fast it can reestablish a connection on there. Now let's go ahead and add one more to the mix here. So we'll exit this and go over to Tom's computer. Now let's look at the node here I have and we have a config YAML file for me. And we have the Tom desktop. So here's the cert key, et cetera, et cetera. Once again, I'm not a lighthouse. I'm defining the one IP address. I defined the one host. I'm not worried about inbound traffic to me or maybe I should be and probably have these set to none so I don't allow any inbound traffic. I'm allowed to inbound here, outbound, et cetera. But I'm not too worried about any of that right now. This is my host defined and go ahead and close that. So let's go ahead and kick it off. All right, it's connected. It reached right out to the lighthouse and let's look at the adapters on my computer real quick. We now have the nebula one adapter assigned with this IP address. I don't think I showed that on the other computer, but you get the idea. It instantly assigned it. And if we destroy this, for example, I'm just going to close the session. There's no nebula adapter on here. So it destroyed it right away. This is one of the reasons you have to run a sudo to add that extra adapter. So away we go. We've done it and there's the nebula adapter 10 009. So let's go ahead and ping. I can talk to the lighthouse. I can talk to London, but 44 not four. So I'm talking to that one. And we'll SSH to London fail. So let's go over here to our London server. And we'll add port 22 TCP Tom desktop. So we want to allow me to SSH into this nebula. Now this is where that groups would have come in handy, because then I would have just built an SSH group and you just say group instead, like it does down here where we'd say, all right, add these groups to there. So it's not our option, but you know, simple enough for this demo, do that, restart the nebula service. I do have the keys. So I'm able to log right in. And here's my session. Now let's talk about another situation. So we have SSH here and I'm logged in and, you know, able to have a connection here. What if we restart the nebula service? Did it break my connection? No, it broke it for just a moment. And you can see it reestablished it right here because it said, Hey, that stopped. And now as a matter of fact, we can do it from here system. Whoops, restart nebula service, instantly reestablished a connection to the point where I was able to restart it and it didn't break even my SSH connection. So I'm still logged in because I actually use the SSH session to do that. So pretty straightforward as far as how you rebuild these tunnels and restart them and adjust firewall rules. And like I said, this is something you build as part of the automation. But this is nebula in a nutshell of how it works. And it's a project I think is really cool. I'm excited about its future development. It was just why I wanted to show some of the demonstration here and get more people interested in playing with it. And I know a lot of people who build out some solutions. I've actually talked to a couple of my DevOps friends who found this kind of interesting and said, that is kind of interesting. We do handle the security on the back end of all the servers, especially because well, one of them has a ton of bare metal servers running in a lot of data centers. And they're like, Hmm, this could be an interesting way to handle control planes across a wide variety from I was even thinking of ways to integrate it with things like XCPNG for when people have some public hosting on there. And they want like an easy back end way to have one web panel that automatically can talk to everything else. And this might be an interesting way to do that. But there's a lack of documentation. This is one of the reasons I did the video was to raise some awareness of it, find some other people who want to contribute to an open source project and reach out to define networking. I said, leave links to all the videos dive deep into the videos that Ryan did. They're great. They're definitely give you a lot of insight into the thought process of building it's kind of a long video, but they also talk about all the challenges they face and trying to do this as a VPN. I think it's a solid, secure solution. It's completely self hosted. So you know, you're building your own trust, it's open source. So we can look at all the code and modify it. And there's plenty of active parties participation in their GitHub of people discussing bugs and different scenarios and different use cases. So if you're interested in me project, I'll leave all the links so you can join in. All right. Thanks. And thank you for making it to the end of the video. If you like this video, please give it a thumbs up. If you'd like to see more content from the channel, hit the subscribe button and hit the bell icon. If you like YouTube to notify you when new videos come out. If you'd like to hire us, head over to LawrenceSystems.com, fill out our contact page and let us know what we can help you with and what projects you'd like us to work together on. If you want to carry on the discussion, head over to forums.LauranceSystems.com, where we can carry on the discussion about this video, other videos, or other tech topics in general. Even suggestions for new videos, they're accepted right there on our forums, which are free. Also, if you'd like to help the channel in other ways, head over to our affiliate page. We have a lot of great tech offers for you. And once again, thanks for watching and see you next time.