Your next presenter will be Greg Conti, who will be talking about network attack visualization. Can you hear me in the back? Reasonably well? Okay. Hi, I'm Greg Conti. Welcome to network attack visualization. Thanks for coming. I think it's a very cool subject that has a great deal of potential that hasn't been tapped in the security world. So I hope to do several things during this talk. One is give you a feel for the classic info of this research area because it's, people have been working on it for the last 25 or 30 years, but it's largely untapped in the security research area. So then give you a feel for what people are doing in security research. Third, to build a system that's on your CD, kind of a proof of concept, to go over that and some of the lessons learned and what it looks like with some real world results. And finally to help motivate you. I believe this has a great deal of potential. Just walking around, capturing the flag, it's all text. And if you can tie into what the human mind can do through the visual processing system, a great deal of potential. So I hope to motivate you to consider using some of these techniques in the future. That's a picture of someone I know with their eyes blacked out, DEF CON 2C, New Las Vegas, Lunar Penal Colony. I was just looking into the future as we explore other planets where DEF CON might end up. I'm currently at Georgia Tech, but I'm also in the Army and I'm here as a free citizen and not as a representative of the government. Okay, just to get us all on the same sheet of music, this is the classic definition of information visualization. And the key notion here is that you're taking advantage of the capabilities of all your senses. Typically vision is what comes to mind in a way that you can find insights and data that you couldn't see otherwise. So we're going to look at how people address that through a variety of techniques. And why is there such great potential here in the security area? Let's do a little survey and find out. So what I'm going to ask you to do is you get to vote once at the end which of these A, B, or C, or I know there's nothing up there now, but which of these you think is R? So there's Mona Lisa. That's ASCII Mona Lisa. Or the BF programming language that will generate ASCII Mona Lisa. So who thinks A? Okay, you can only vote once. So who thinks B? Who thinks C? Who knows what BF stands for? Someone? Yes, that would be correct. Thank you. This goes to a lot of the classic info of those people have been doing great work. They fall into the A category. A lot of the security people fall into the B and C category, and the two worlds haven't overlapped. But I think they're beginning to now as people see what it can do. And hopefully we'll address that a little today. So why info of those? Just by glancing at data, information can pop out at you that you can't get from just textual output. So you can see patterns, anomalies. And what this example here is the DEF CON forms, and in there there's two columns, in the top left from the website about a month ago, replies and views. And you could look and you guys saw different numbers, but you really didn't have a feel for what the data was about. So I put it used a scatterplot technique, plotting replies on the x-axis and views on the vertical axis, and you can see it gives you a feel for what the discussion was all about. I also encoded, used color to encode the heat, or how much activity there was, as well as, so it went from a cool blue to a hot red. And I also mapped it to the size of the square so that more replies times views, the hotter it was, as well as the larger the square. So you can see that at that time, colonel female geeks generated a great deal of interest, followed by making friends, and then other events like the toxic barbecue and that type of thing. And you can see all the way down there at the bottom is someone wanted to play as a DJ. It was hard to get that when you've got a great deal of tabular information. This scales really well. So I just want to give you another hopefully motivating example. You can think TCP dump, you know, it's a little bit down, but another level up from that is ethereal, which I saw a lot of people using on Capture the Flag, which is a very useful tool for what it does. It's extremely well-designed, but if that's your task, it's great. If you want to see other graphical visualizations, it's a lot harder. And then ether ape is an example of what you can do with real-time packet capture. I get a feel, and what that is is a circle network addresses and then the connections between them. They map the width to the bandwidth, so it gets wider as if there's more activity and it also decays over time, so that's a technique you can use to care over time. Map different data values to different ranges or colors. So what this helps you do is get beyond the algorithm. You're using the human brain instead of trying to code stuff up so it's an entirely different problem. So things that you're very good at, the computer may be very bad at, so that's where the power of this lies. The second making, Capture the Flag, a spectator sport, I think it'd be very... I know it's a bit tongue-in-cheek, but the idea is if you can look at a network activity visually and see what's going on and people can wander by and really see what's going on, you could do the same thing when you're monitoring your networks. And you can really do this in two ways. You can do it in the forensics based on data sets that you've collected that you can mine, or you can do it in real time and Capture. There's issues associated with both techniques that we'll try and cover a little bit. And what I'd like you to think about is what tasks do you need help with? If you're in here you probably think, hey, there's something to this, so I'd ask at the end if you've got some ideas on areas that have potential, it'd shout it out because I think it'd be a pretty cool discussion. So here's another example. Capture data from a cyber defense exercise with an NSA red team going after one of the military academy, the defensive network, so basically the red team attacked their defensive network, plotted IP addresses on vertical access, access and the time was a number of seconds during the attack. So at a glance you can see that they did a wide range of reconnaissance across a large number of IP addresses, and then they did some focus attacks, and it's very clear from the data that it might not be as obvious if you're looking at textual data. So you can see the focus attacks, and then later they did another wave across the board. So again, it just pops out at you what's going on. So like I said, Classic InfoVis research has been going on in earnest for 25, 30 years, and it goes way back, you think of map making and the like. The reason why I'm presenting it to you is it's largely untapped. There's some great work out there, but these weren't security people. So they were thinking about bus schedules or, I don't know, all sorts of off the wall stuff, but none of it involving security. But there's a great deal of untapped potential hopefully could inspire you to do some really cool stuff. Let's start off with a couple of the core concepts that came out of this. The InfoVis mantra is by Ben Schneiderman out of the University of Maryland. And the idea is you give whoever's working with the data, give them an overview first so they can see what's going on. So in a theory you can think, you get an overview of all your packets. Then you provide the ability to zoom and filter. This could be on any InfoVis system. These are the key ideas. You give an overview, you give people the ability to zoom and filter into what they're interested in, and then ideally get them down to the details so they can see that. Ethereal provides all three, and it really I think illustrates in a textual way, but the same applies to a visual system. The second main concept, kind of similar, is the idea of overview and detail, that you can have different visualizations combined into the same window. Oftentimes this is called a multiple coordinated display in that the three panes or two panes or whatever all interact. The activity will affect how the others show what's going on, and so this is from Civilization 2. And you can see there's an overview, you have a world map, and you can picture how could you apply this to networks, for example. That could be your large scale network. Then it has a great deal of focus area, a detail area where you can get in more, and if this was your network it could be your local subnet or something. You can click on the links and then click on the right. I thought this was just a good example of overview and detail. Another idea is that of focus and context, being that you can see the detail at the center, but you get a feel for how it relates with the rest of the data. So using the fisheye view, and that's a Washington DC Metro map, it expands out and magnifies the center of the map, so you can see what's going on, and the context around it. Now, granted, this might not be the best example because it distorts it a little bit, but that's a technique to consider. So you can see it amidst the context. And then the right is an interesting technique, extremely powerful. That's about 500 major league baseball players and their data all visualized on one screen. The vertical columns that you see are, think of them as bar charts, and they're on the side, so they're histograms, what they're formerly called. But that shows about 500 baseball players, and they're just highlighting the purple columns that's average, career average, and salary. So you can just look at what's their batting average, and you can get a feel for if they're highly paid, and you can look at it and say most of the players at the top with the highest batting averages are some of the highest paid players. But it also provides the overview, but it also shows the, you can provide focus. So by clicking on it, it would give, on a given line, it would show you the exact details and the statistics, and that's the green area. Okay, so that's a, what I wanted to give you is links to more information, and this is on your CD. So just to have some example systems, you can take a look at it. But really the one thing I'd point you towards is the information visualization courses. Most of these links will take you to courses with excellent slides, all condensed, all free, and really do a nice job of linking to example systems. So if you want to leave here and find out more about this stuff, that's where I'd start first with those course links. And again, it's on your CD. Or should be. Okay, just wanted to give you an example of some classic info systems. These are all pictures essentially. This stuff's out there. I'm not saying any given technique is applicable, but I wanted to give you a feel for the wide range of techniques that are out there. This is called Data Mountain, which these are, think your bookmarks, another way to look at your bookmarks. These are snapshots of web pages that you can arrange on this virtual desktop any way you want, and you can double click on them and give you the web page you want to go to. So this is one technique that I took a look at. This is called Film Finder. It came out again out of University of Maryland. What it shows are a large number of movies. I believe there's 210 movies being displayed here, the dots. But what's neat about it is on the right, the sliders allow you to do dynamic queries. And that means if you want to, for example, there's a double-ended slider that allows you to set the minimum and maximum length of the movie that you're interested in. And by adjusting that, movies will disappear off there or reappear. So you can interactively explore the data. And there's other sliders that allow you to change other variables. And again, I think this would be interesting to put something like this together on the network side. This is a very powerful technique called Parallel Coordinates, and it's a bit like an ink blot. It takes a little bit of time to get used to. But what's interesting about it is you may have many, many fields of data you're trying to display. Some techniques scale better than others. This will scale out to, say, records with 20 to 30 data fields. So the main idea is each vertical axis is a scale. So this is data on cars. The first vertical axis is miles per gallon. The next vertical axis is cylinder and horsepower and so on. Anyway, what you do is you plot for miles per gallon, say this 30-mile per gallon car on the vertical axis. Four cylinders, low horsepower, low weight, and you essentially connect the dots for each field. And you can get a field. This is a very powerful technique, but it's also useful if you rearrange the columns. Because you're looking for insights into the data and dependencies between data values. By rearranging the columns, you can get different insights. And the tool will take a look at the end, uses this a little bit. This is a little bit out there. This is information art. The idea is this is on the wall, it's an ambient display. So it's not in their blinking red lights. And some of these systems will give you, throw you into an epileptic seizure or something if you look at them too much. So this is art. It's on the wall. This represents, based on modern art, a bus schedule. Each of the squares represents a given destination. And the color coding addressed how long until the shuttle would leave. So again, people could just glance at it. That's loosely on a map metaphor. So people learned where each of those squares, what they represented. Again, just a few examples. And I put together 72 examples for you.  Let me show you quick. What I tried to do for each of the examples was give you good links as well. So lots and lots of cool stuff out there. So I'd ask you, if you're interested in this, flip through that. Really, really cool things. We only have 50 minutes, so I couldn't cover it all. Another thing I'd recommend to you is these are some books. The first three are works by Edward Tufty. These were really nicely done. I have no affiliation with them. But I think they're very nicely done. They're on the order of $40 to $50. He also has a fourth coming out called Beautiful Evidence. The fourth book I'd recommend to you is a survey of the field. It's relatively thin, about 350 pages or so. But it covers the whole InfoViz area in a very accessible way across the board. And that's InfoViz by Robert Spence. And the fifth is a highly regarded textbook as well. And finally, if you're interested, Edward Tufty has a traveling roadshow that he goes around the country. It costs about $300 to attend. But he leads it. It's extremely well done, condenses it all down, and you get all three books with it. So if your company is paying or something like that, it's a good way, perhaps, to get some of the books. Okay, so let's look at how people have taken some of those techniques and then applied them to security. In my experience, it's only about 5-10% of the techniques have actually been applied to security. And that's why it has such great potential. So this is a technique. This is showing routing data out of a UC Davis. And I have a better example first to show you how a tree map works. So this is a space-filling algorithm. And this is a tree map of my hard drive. And think of it as nested directory. So within one directory you can see the files that are in there, the things in there. You have the ability to get an overview. And then if I want to zoom, I can just click on a button in the background region. And you can use color to encode file types. I think this would be very cool to show the security data on your file permissions or something like that. Or even if this was a front end for network scanning or something like that, constantly probing a network, you could see, hey, a SSH server or something popped up, and you could look at huge network spaces using something like this. But anyway, if you want to highlight an area and you can get in closer, you can hover over. It gives you the details on demand that you can see at a glance. Well, what's my largest DLL here? And this is shell32.dll. And you may say, well, what's this huge purple file? It's a driver.cap file, that type of thing. At a glance you can see the outliers. You can see patterns in there. I have a USB key ring I would back up regularly. And you can see that each of the very identical images between them. So it's a very cool way to get a feel for a large data set. So that's what he did with different routing messages, trying to get a feel for anomalies in the routing data. It's a little messy. It's a little complicated how he put it together, and I'll not go into it today. But there's a great paper. If you do a search on his name, he's got several papers on this that explain the technique he used. Again, these are tree maps. And what's interesting is you can see a histogram at the bottom. So you're not just tied to one visualization technique. You can combine them. You can link them together. The smaller squares on the left-hand side represent detail views. And it's kind of hard to see. It's kind of hard to see on this, but each of those squares has a pair of lines going to a little white rectangle on the two large squares in the center. So you can slide those around and it provides you detail on that area. So you have this slider, kind of sliding zoom thing that you can move around and see the detail on the side. So it's a pretty cool technique. So another technique you can use is the 3D space. And when you use 3D space, that typically means things will be in front of other things. So you generally have to look at being able to rotate the object and make some math a little bit funkier. But what this shows is the type of workstation in the front. So it's workstation network a mission server or project server. So that's one of the coordinates on the bottom. And then the coordinates on the side are their physical location. So which you can see at a glance where are all my project servers. They're all located on the second floor. Then they use the third dimension to tie in to network alerts. So the different severities of the alerts. And you can see at a glance where are my alerts, where are they located, and what type of mission are they performing. So I thought it was an interesting technique. So I'm going to show you how to use up secure scope secure decisions. This is Starlight. It can be on one of the national labs. It uses the small picture on the top just shows you the 3D space that it uses. And I thought this was very cool because it combines you can throw into this workspace multiple visualization techniques. So they tie a map of terrorists or whatever. A geographic map several data sets. And you can see the interrelationships between them. It's a very interesting technique. It can be very cool to see open source something like this going on. This is open source security information management system. I haven't had a chance to take a look at it, but a couple of people I highly regard recommended it to me. The idea here is it takes multiple sources of data, network security related data, and it correlates them and presents them all on one screen. So you get a glance, you can see what your network is doing. And when I was at Black Hat I went around to the vendors and many of the vendors had something like this. One of them I asked them how much it cost and they told me it was $250. And silly me, I thought he meant $250, but he meant $250,000 for the starter kit. So there's probably some money to be made in this as well. Now think, if you were looking how you'd normally see sequence numbers in a, you know, in theory or something. This is a very cool technique using attractor theory to plot X, Y, and Z dimensions and get a feel for the randomness of the data. So these are two data sets. Which one do you think is random? The other top, that gray diffuse cloud is the random data set. Which one do you think is a Microsoft product? Yeah, the bottom, the very detectable, you can see a distinct pattern there. So again, you can have this huge number of sequence numbers. You can see them at a glance. And what he did, there's two papers here. They're both very cool with lots of pictures that show the randomness of the data. It was very obvious if it was random or not. And then he did a paper a year later where most of the vendors had addressed the issue. So you can see kind of a before and after. Another technique you can use is, you know, plotting things on geographic terrain. This is what a satellite image showed that from the University of Kansas. And this is wireless activity. But I have also another example that I want to show you. This is a little bit on the simpler side, but I want to show you something that showed the power of animation. This shows the propagation of code red. And you can see it evolve and you can see when the tipping point is when it explores. So I'll go ahead and show you. So again, animation very powerful tool. See what I mean? And if you're looking at log files you want to get that impact. So very, very cool stuff. This is another researcher's spin on observing and shooter behavior. And I won't go into all the details, but in the center, that small circle when the center represents a central server and then the lines coming in represent connections. The closer in lines where it present closer positions on the network and then the farther out lines represent much farther away. So you can just at a glance see who's connecting from a distance and who's connecting close. He used glyphs that I'll cover in a second that represent different types of connections. So you can monitor this. He uses animations, and I have a video clip I'll show you in a second. This animates this. You can kind of see at a glance what's going on on the network. So he used the different types of arrows or glyphs to encode, for example the solid arrow is telemet and it's cousins. The dotted lines are FTPs and the like. And he used port scanned red arrows. In the lower right you can see tick marks for multiple connections from a given remote host or something like that. And then the center, the black donut in the middle of the centralized server shows the server load, the processing load. So I'll show you a video clip of this. And he has several papers on the subject as well if you're interested in this. So again, you can picture monitor, being able to monitor your network. Okay, I think you get the basic idea. But that's out there on the web if you want to download it as well. Oh, goodie. Well, that's bad. Okay, that's better. Let's just hope it doesn't put the screen adept the whole computer. And as I was putting this together I have like 45 examples I wanted to show you and I didn't think there would be time. So I put together a PowerPoint presentation that has all the examples. But it was after I submitted my materials for the CD. So on my front page of the slides that you do have that's my website at school. And I'll go ahead and post this out there when I get back. But it's got examples of some of the 45 examples of security systems. This I wanted to just give you a feel and the presentation you have on your disk has two slides of these. They're having the first ever really formal workshop in visualization security at an association with the ACM CCS. So that's Computer and Communication Security Conference. It's a big conference. And they're having a one day workshop on this stuff. But I thought this is from their call for papers and I thought it was really interesting to see what they were looking for, what they were trying to deal with. And there are ideas on areas that are untapped where the research is going in academia. These are some ideas. Just to throw out a couple, visualizing routing anomalies. So that was that one researcher. Visualizing attacks in near real time. Line speeds. Can processors keep, can you visualize stuff at gigabit ethernet speeds? That's a whole issue that you, that networking is outpacing the processing capability that you need to do some of this. And I'm not going to say this is your rock solid commercial product or anything, but it's, I think insightful and fun to play around with and I welcome any feedback that you can give me down the road where you think it would be useful. This falls more into the, that overview first details on demand. I've gotten pretty much as far as overview first. It takes a while to put something together that's pretty solid. What I was going for is you have your classic automated intrusion detection system. So on the top left I have the signature based IDS and then you have your anomaly based IDS. So what I, where I was going with this is that I'd like to augment those two with properly designed visualizations that bring the human into the loop in the smart way in a right way. So an attacker has to not just defeat the computer algorithm, but they also have to fool the human who's observing the network activity. So basically what I'm doing is performing real-time packet capture, parsing it and I think you'll run into this. I mean any visualization system starts off with getting a feel for the data that you have at your disposal that you want to visualize. Getting a feel for the tasks you're trying to solve and then you'll need to go through some process like this. Well, how do you clean up the data? What processing do you need to perform on it and then how do you visualize it? As you go down that process it's more interesting. It's less textbook and more creativity as you go down as how can you present this in cool and useful ways. Another design decision you'll need to make is do you want to just present it in a straightforward way or do you want to embed artificial intelligence or other processing techniques into your system? And it's a trade-off. If you want to embed more intelligence into your visualization system then that comes at a cost of processing capability and then you're back to the idea that you can fool the algorithms or something. So there's this spectrum of very... you offload it or the human carries the burden all the way over to the machine carries most of the processing lies. So I tried different prototypes I started building it in C on top of PCAP I tried another version using TCP dump Pipe to Pearl type 2 XM Grace which was the best open source visualization tool that I found. It's pretty good. It wasn't exactly what I was looking for but at Interzone this past April I have I gave a demo and it's also on your CD with a little white paper how to of that track of piping it through through to the visualization tool to see what's going on. It wasn't real time really what I was going for. So I used Visual Studio on top of WinPcap and yes I know that there are security vulnerabilities in WinPcap but it's on the right now. What I put together is this tool and that stands for rumor intelligence versus signals intelligence or imagery intelligence and what it does is and I'll go through this. The idea is it takes it captures the packets pulls out different fields and plots them in different ways hopefully in insightful and useful ways. So this is the main control panel you enter in your IP address here it needs to know the IP address it understands the notion of what you consider your home network or what you want to filter. It's really just a simple left string so if you want to monitor a class C network or whatever you just chop off the 100 and it'll capture that. I had it running the Georgia Tech Honey Net as well as a commercial ISP outside the firewall and it found it's pretty cool what I did is remove the on Windows XP removed all the network protocols so it can still sniff the packets without having any protocols installed in Windows. So just start and stop buttons and there's a lot of 11 11 different visualizations and then some variants which bring up to about 15 different windows on your network data. Also have the ability to change color settings different things you're trying to highlight require different colors and if you click save or it basically takes snapshots of all the visualizations and throws them into the directory. So it's not a polished thing but I think it would be pretty fun to play around with. So it uses that concept of parallel port view that connect the dots that we took a look at earlier. So these three the first one on the left that range is the whole internet all the way up to 255.255 and so on. So that's external people connecting to me. So you can see that a variety of internet addresses I was connected to and I mapped bright green, rain bound, darker green or outbound TCP and then orange represents VDP and I don't know if there's really any on here on this example. So again you can see at a glance like where on the internet am I connecting to and who's connecting to me. So this example takes a look at external ports with the same color mapping so 0 at the bottom and 65, 535 on the top what external ports are connecting to me. And if you do this enough different port allocation algorithms embedded in different operating systems so you can get a feel that when I was doing activity much of the windows network and it's kind of hard to see but basically form a square or an X at the bottom XP to XP type activity and then when I was doing things with Linux it would be much higher poor allocation and obviously that can be spoof but just naively that has some potential. And then on the right that visualization shows the external IP address range mapped to the internal ports so I found that useful if someone was doing distributed scan you could see distributed scans where they were coming from and what ports they were hitting so I have some snapshots of the Georgia Tech honey net that give you a little bit of feel for that. Like I mentioned before you can have multiple sets of data in the parallel plot so I have two other visualizations on there this does external IP to external port to internal port to internal IP so just a different way to get a feel for the data and then I have another variant of as well so you can play around with it and see what it looks like so I tried it with that port external port to internal port view using CERA which is a successor to you Satan so using the light setting which they say will probably miss the will be missed by the intrusion detection system you can see very little activity just a line or two at the bottom medium activity which they say will probably be missed by the intrusion detection system and then heavy activity so you can really see that there's visual fingerprints falling out of this and I envision perhaps a smart book of what some of these things look like before some people who own code up randomizers and things like that obviously this stuff can be spoofed but not any of you, it pops right through so I did the same thing using a variety of other tools several variants of NMAP found stone scan line and super scan couple more NMAP variants 4.0 and super scan 4.0 each one of them had a distinct visual signature that's shown through and you can get a feel for the port activity the super scan on the bottom right looks massively I haven't seen the source code but it looks like a great deal of multi-threading going on or something like that and what doesn't show through is the timing, each of these executed at different speeds so for future work it would be interesting to see over time how fast each of these occur and you can also see the orange UDP mixed in with the green TCP so to try and get a feel for the time sequence of the data I made a different visualization that this plots on the Y axis ports so these are external ports and then each packet and just as an example I thought it was interesting just to look at NMAP which has this kind of diffuse randomness sort of on the packets and then super scan 3 there's a very distinct curve so you can run this and I ran this as I was just surfing the web and had it set for external IP what IPs was I talking to so I went to a web page and I thought a nice solid line of all these same external IP and then as I as it downloaded the ads you could see it hop around to different ads so I thought that was something for each of these visualizations by something something going on in the network something going on in the data I was surprised by so it's kind of that's the whole idea of visualizations getting to those surprises finding things out you wouldn't have known it's also good for seeing how chatty your computer is because this works I did a port scan out you can see the fan going out I did a port scan and see it going in so it's useful as a drop down box so I want to take a look at the data another way and this draws packets horizontally so each packet comes in it drops down one, drops down one and what this is is packet length as a fraction of the maximum ethernet frame so you can get a feel for you can see the large maximum size green ethernet packets and then a number of smaller orange UDP packets and as you do different activities you're getting a feel for what's normal and what's not normal so I let it run another technique is one of the problems with this is occlusion things put on top of other things so ideally there'd be a buffer and a little time slider we could float through the data this is the Georgia Tech Honey Net and we let it run for 30 days we could really get by looking at the left one you can see external IPs you could see where was the most activity coming from something down I mean at a glance you can see where the activity was the way and what ports they were going after so that's external IP to internal internal port and you can see all the lines going down to the low ports the next one is what operating systems, what external ports were in use so you can see a wide range across the whole spectrum but I thought it was useful for 30 days and then you can see that they went again for the low ports but also what jumps out at you is hey what's this these other ports where there's activity going on if you're monitoring this in real time you start seeing activity make clear that something's going on out there they would just have gotten lost if you weren't looking for otherwise okay so I'll go ahead and give you a demo of the tool and we'll take your questions I think that's enough to get us started but so I'm going to go ahead and enter the IP address that I want to monitor click start and then I'm over here this is from Linux I'm going to go ahead and do a port scan and for whatever reason the crossover cable there's a few about 15 seconds or so delay as it does whatever it does but it's going to do a port scan in a second you don't get this delay in real time okay you don't get this delay in real time but hopefully it will come up in a moment okay there we go so you can see the port scan going on so if you're sitting there at your computer it starts doing this something's wrong and you can resize each of these windows if you do the snapshots it will do the it'll make the image in the directory to whatever size that you click that you're using at the time so okay let's go ahead and stop this we already did most of those so let me just go ahead just rehash what we covered the classic InfoViz stuff I think there's a pretty cool survey on your CD there's a security InfoViz survey which I'll go ahead and post to my website then there's on the right that's xngrace and there's a demo of that on the CD the moment tool which runs on top of a winpcap is on your CD bookmarks are on your CD and then I'll have the latest version of this talk out on my website so I have a lot of people thank, I want to thank the 404.2600 people who looked at this and really gave a great deal of feedback as well as several of the Georgia Tech researchers so with that in mind what are your questions go ahead could you come down here to be the mic have you given just about like your tool for drawing data points and things like that or just doing the general drawing are you doing any sort of optimization or using any sort of like efficient line drawing algorithms or efficient visualization things like that for dealing with very large data sets because one thing that I've noticed for a lot of the open source tools or even some commercial tools out there is that they're very naive in the way that they actually do the drawing of the data and I've seen just even with a couple hundred nodes on a network which any enterprise size land would have will bring just your average Windows laptop or desktop completely to its knees because there is so much stuff to draw so I was wondering if you're doing any of that in your application and if you're not to kind of suggest it that's a good question this stuff's process are intensive so that's when it's useful to go back to the graphics domain, the computer graphics domain and look at some of their efficient implementations again I'm doing this on XP which might not be the wisest thing but that's a good point that you want to tie in and get the smartest algorithms out there this won't scale up I wouldn't recommend putting it on a gigabit ethernet network I don't really know what would happen but I'd put it more on like the a hundred or ten and it works reasonably well okay other questions yes I think are any of these visualization tools standard enough that if you need people are running honeypots, you know they're running them and you can spell out messages to them in the displays that's a good question can you attack these visualizations and actually I think a deeper question can you attack the data streams that feed into any of these systems if you can get into the data stream where my research was going next is attacking visualizations and attacking the data going into kind of all this stuff I had one person talking about at one end you can do a buffer overflow and just knock out ethereal or whatever their packet capture altogether all the way through can you manipulate people can you trick them, can you fool them and I know you've probably seen the spinning cube of impending doom or something that was on slash dot just recently it was a 3D space and it plotted packet headers it plotted packet headers and you saw these different 3D pictures came out of it and then on slash dot what they started talking about is hmm if we make design packets the right way we could have 3D pornographic objects rotating in space and if we timed it to when the supervisor of the system administrator was walking through with his teenage daughter fired and then they'd have to get a less well-versed system administrator so yeah this stuff's vulnerable and that would be a very good hack but I think what this has put more so this shows that it's really naive people are doing this stuff and every packet is visible so it's almost like you need electronic countermeasures out there to obscure what's going on random noise or carefully crafted packets or whatever what are some of the best commercial or open source or security visualization tools right now in the market so what are the best commercial and security visualization tools including like the security information managers like ArcSight and NetFriends etc I haven't had as much experience as I would like on those tools because that's why I use the time at Black Hat to take a look they generally are on the order of 3 to 6 zeros or 5 zeros after them I can talk to you more on the general purpose systems well XM Grace on the open source side Excel is kind of at the lowest end of the food chain on the whole Viz thing but up in the upper end each of the researchers that you saw on those like 75 or whatever InfoViz examples each of those researchers has a system many of them are free that you can download their spotfire is a good general purpose system spotfire it's a scatterplot has the dynamic sliders it's very well regarded that's one to take a look at but the stuff's not cheap InfoViz people are getting like 5 to 20 thousand dollars a seat for this stuff so I can't say there's a low cost effective option yes it's stupid it's simple but it's open source and it's free and it was designed by AT&T to visualize large scale networks GraphViz it's an output language for visualizing networks it does directed and undirected graphs so you can do networks that have associations and not and like I said it's kind of stupid it's simple but it's cheap it's open source and it's hackable it's called GraphViz GraphViz.org and it's the output is like post script so you can just go in if you have a pro script


This is stock number 10230. We are here at Summit Automotive in Fond du Lac, Wisconsin. You're new and used. Heavy-duty truck, headquarters. Today we are checking out this extremely clean, extremely good-looking 2017 Ford F-250 crew cab short box. This truck has the 6.7-liter power-stroke diesel. From this HD video you will be able to tell just how clean this truck is all the way around. Inside and out. Shadow black is the color. We shoot all of our videos in 1080p. So if you have HD capabilities on your computer, tablet, or a smartphone device, turn them on right now because it is like you're right here looking at the truck with me. And your best way to check out the vehicle before seeing it in person. Factory chrome step bars, very clean down that side comes with BMF. 20-inch painted and polished aluminum rims. Open-country Toyo AT, 35 by 12.5 R20 tires with about half the tread left. Has the FX4 off-road package with the Rancho shocks, frame and under bodies in really nice condition. Didn't see any dents or dings on that front fender. Headlight lenses are nice and clear. The hood is in really nice condition. I didn't see any dents or dings on that. Passener side fender, no dents or dings on that either. Very nice condition. Passener side rims in pretty nice condition as well. Maybe one little chip on the paint there but nothing too bad. As you go down this side of the truck you can see just how clean the body is, how reflective and mirror-like that paint is. We take these HD videos so if you are far away or even if you're close by and just cannot make the trip down you can still see the truck. You can still hear the truck and you can have confidence in the vehicle that you're looking at before you even get here. You can even buy your whole vehicle right online. Do the fill out the financing, get your trade number. We call it the Summit Fast Pass. Make it easy. If you don't like talking to people or you can give us a call. It has all the remaining factory exhaust so it has been altered in any way shape or form and a framed underbody is in really nice condition. Lower rockers are nice as well. This back rim is in nice condition too. No scuffs or scrapes and the back tires have just about as much tread as the front tires. Once again frame underbody box rails look really good on this truck comes with the chrome tipped exhaust, FX4 off-road package, skid plates, rancho shocks, rear bumpers in excellent condition. No dents or dings on that. It comes with a full towing package which includes the receiver hitch four pin and seven pin wiring, backup parking sensors, tailgates in pretty nice condition as well. It has a truck support soft tonneau cover that is locked. That locks with the doors so we will unlock that in just a second. Check out the bed and as you come around to this side of the vehicle just as clean as I pass under side. See just how mirror like that paint is. Very very nice truck. Very clean on this side. Back rim is in nice shape as well for full disclosure and down the rest of the side very nice. Didn't see any dents or dings on the doors. Has the power scope mirror so you get blind spot monitoring in those mirrors. Driver side door code entry. We do have the door code for this vehicle. I do want to take a quick look at the bed of the truck here. Does have the tailgate step assist. Has a factory drop-in bedliner.  I would do it for the video but it is a little tougher when you only have one hand. Once again down this side see just how clean that body is. Inside this one has a wall dock conversion they say but it does have the leather interior. Cat skin leather. Power driver seat. Weather tech floor mats throughout. We got power pedals auto headlamps. Power windows power locks power mirrors those power scope mirrors so they power fold in and they also power telescope out and in. Inside you can see that this one has the big instrument cluster the digital instrument cluster 43,295 miles on this truck. Has the leather wrapped steering wheel, Bluetooth and audio controls on the right cruise controls and information center controls on the left. This one comes with the factory navigation system with the sync radio, AM, FM and Sirius XM radio capabilities. It does have a CD player as well. Up here is your factory exhaust brake, your stability control, your downhills assist control and your lane departure warning.  This one does have a factory brake controller and turned dial four-wheel drive. 110 volt 400 watt plug-in and a 12-volt power point. You'll also get two USBs down here. Pass under floor mat and seat are in excellent condition. No rips or tears on that. This truck has never been smoked in. Smells very clean inside. Headliner is in excellent shape. It does have six auxiliary switches up there. You can put lights and stuff if you want to put a plow or something on the truck. You got these switches that act just like power points or light switches in your house. So we got all that and we'll take a quick look at the back seats and then we'll check out under the hood. Front seats are very nice and clean. Back seats much the same. No rips or tears back here. Has the fixed glass rear window with defrost. These seats fold up for extra storage. You do get a storage bin back here that collapses down. You got a winter front, jack tools, all that good stuff and a full weather tech floor mat back here. You can see the carpeting is in excellent shape. And finally there's a 110 volt 400 watt max power point back here as well. We will take a quick look under the hood as the child safety locks for the back seats as well or back doors I should say. Under the hood we have the 6.7 liter power stroke diesel engine base. Very clean runs, very smooth. This truck has been fully safety and inspected by our service shop. Has a fresh oil and filter change. All the fluids have been checked and topped off. Truck has been gone through mechanically 100% and is 100% ready to go. To see more pictures of this truck or one of our other 450 new and used cars, trucks, SUVs, minivans, Wranglers, half tons, three-quarter tons, one tons, you name it we got it go to our website www.summitauto.com. Full pictures and descriptions of every single vehicle from two locations all at summitauto.com. If you'd like to check out more HD videos you can go to youtube.com slash summit auto. Remember to like, subscribe, and share on this video and all the videos that you see there. In fact in a second you will see a link to subscribe to our YouTube channel on your left. A link to more heavy-duty truck videos like this one on your right if you have not been to our website on the bottom. A link to this vehicle on our website click those check us out and we really look forward to helping with this super clean 2017. Ford F-250, Crew Cab Short Box, XLT, FX4, Power Stroke Diesel. Thanks again.


వ  goin హర౗ ఆకిస్స్ Twenty By completing and commissioning these projects, we are making a clear statement. Those of you who have lived in Ibadan will have been aware of the cares that this place used to be. With these projects, we are bringing sanity to this axis. So, this project is significant in our quest to implement another component in our Iowa State Roadmap for Sustainable Development 2023 to 2027. And that is the rule of law. The best time to have planned the cities, the existing cities, was probably 60, 70, 100 years ago. But never late. The second best time to plan them is today. And I am very excited to be part of this ceremony today, which is very, very symbolic. The government, when you spoke, you talked about the scale of it. Maybe it might seem small, but the symbolism of it is very deep and fundamental. It's about urban regeneration. The commissioning of the project has been held as a significant milestone in the state's journey towards progress and sustainable development.


Well, hello and welcome again to another OpenShift Commons briefing. We're really pleased to have with us today Alvin Picky from InfoGuyo, a recent new member to the OpenShift Commons, and a number of the from WeaveWorks are here as well. Today, the topic that we're talking about today is testing web services with traffic control using some of the WeaveWorks scopes and showing it working on. I saw Alvin give this talk at KubeCon in London, and I knew I had to get them to do it on OpenShift because it's one of the most full testing techniques I've seen in a long time. And as well, it also shows off a lot of what you can do with Weave Scopes. So what I'm hoping we'll do today is get Alvin to tell us all about testing and traffic control. But then we'll also try and push some of the folks from WeaveWorks, so we have a number of them on the phones and Ilya and others, to maybe give us a little bit of another demo in the second half during the Q&A of some of the new features of WeaveWorks scope product, and working with some of the new features of KubeNeti. So this should be a really interesting talk, and it is interesting today. So I'm going to let Alvin introduce himself and get away from there. Thank you for the introduction. So I will talk about testing web services with traffic control on OpenShift. I will start by introducing myself. I am Albon. I work on the container runtime rocket in the last month, and I'm currently the tech lead on Rocket. And previously, two years ago, I worked on traffic control for a different use case. It was for multilayer application in-car for the automobile industry, and I'm trying to reuse that knowledge in a different context. I work at KINFOG. We are a very based company, and we work on different foundational new technology. We work on Rocket with CoreS. We work on SystemD, and we have part of the SystemD team is in Berlin as well, so that's quite good. And we work on Linux, so whenever we need to make changes on Linux, we can do that as well. And we work on OS3. OS3 is the kind of a guide for operating system binaries. You can find more about that, but I will start with the plan. So I want to talk about what is traffic control and how does it work on Linux. And then how it can be used for testing in applications. And then I will do two demos. The demo will be on OpenShift. It will use the capabilities, and it is based on WeaverScroll. So first, what is traffic control? How does it work on Linux? So the traffic control exists for a long time, and it can be used for different use cases. It can be used to have a fairly solution of the bandwidth when a web server is connected to several clients. We don't want to buy a client to have to be there, start and have a share amount of bandwidth between the clients. We could want to reserve bandwidth to specific applications. Now we want to avoid a buffer bloat. Buffer bloat is when a router on the internet has two large buffers that can introduce problems with latency and congestion on the network. But here, we don't use traffic control for that. We will use traffic control for testing web services. Traffic control on Linux is implemented in the Linux channel using something called queuing discipline. Queuing discipline or QDisk is something you can plug on a network interface. For example, on ETH0, we can plug queuing discipline and that will decide what to do with a packet to emit, when to emit them, on which packet to emit first. Queuing discipline can be configured on Linux with a TC command. When it uses a netlink socket to talk to the kernel to decide to talk to the kernel to configure the queuing discipline. By default, there is always a queuing discipline and basic one. There are different kinds of queuing discipline. I will just mention one example here. This example is called a stochastic furnace queuing SFQ. On this one, put the different TCP connection in a different queue and then do a run or win over them to select which packet to emit next. That's not the one used by people, but just an example of queuing discipline. And there are plenty of different queuing discipline that can be configured differently. But how can we use that for testing? Actually, there is a queuing discipline called a network emulator or NET-EM. And that NET-EM has different configuration parameters. There is, for example, the bandwidth. We can configure it to limit the bandwidth of the traffic emitted by the network interface. Or we can increase the latency. Or we can say, hey, I want to have 2% packet loss. Or plenty of other option that you can find in a new page of NET-EM. And we are going to use that. But we don't want to use that to configure the machine, the computer as a whole, but we would like to configure only the network used by one application. On one way to do that is to use containers. Each container can run a specific application that will run in a different network space. That means that network space will have its own network interface In this example, we have container one with one network interface called ETH0 and container two having a different network interface. And then we can have a testing framework configuring a queuing discipline on each specific network interface to add some latency or to drop some packet of NET-EM. We want to do that in OpenShift in Kubernetes. So OpenShift use Kubernetes. And in Kubernetes, there is a different... There is the concept of pods. Pods are a group of applications running together in the same context, in this case in the same network space. And they can communicate together on the network. And we want to configure the network parameter on each pod to save for this pod as a high latency or different parameter for the bandwidth. I want to be able to configure different scenarios. And for that, I implemented a small demo called TCD for Traffic Control Demo that will run on each Kubernetes node. And it's a start-res demo and it will receive command on the Unix okay either through GRPC or through Debus. And it accepts remote meta calls such as configure address to say I want this network interface to have some latency or some limited bandwidth. You can find the source of TCD online on Gitm. And then I integrated TCD with WebScope. I will show you a demo after. WebScope is an application showing you all your calls on the cluster all your containers on the cluster. And in this slide, we see one view of one container and I added a few buttons. Yeah, I'll take to traffic control. So when I will show you in the demo after what it does but we have a with scope is composed by two part the with scope app which is the web view on scope pod which then on every node. On the scope pod, we will receive the commands when we click on the buttons and to talk to the traffic control demo and configure the traffic control for each specific pod. I will start a demo now. So stopping my slides. So first, this is an open shift and I pre-configured different applications on it. I can see it on the web UI here or I can see it from the terminal using OC commands or Ctl since it's using Kubernetes. In this example, I have different application and the first one I will show you was one called ping test. And this is actually just a very small screen. This is starting replication controller of three pods and each of them will run a simple script. That's it. We don't have a small file on the internet if it could come to the TV. So now I'm going to re-score. Now I have a view on all my pods on my containers and I can see effectively the three ping tests for the directly seen open shift. But if I click on one of them, with scope allows me to have different statistics. So I can monitor my pod. I can see, for example, the commands that is running. If it takes much CPU or not, since it mostly doesn't see ping, it doesn't take CPU. That's good. And I have some button to interact with it. One of them is called attach. I'm clicking on it. What it does is it will show the terminal as a related to this container. So now I can see actually what it does. It doesn't load a small file, a 15 bytes file on internet every two seconds. And I see my network is quite fast. It takes less than one second to do that. But let's see one of the three buttons. I have added one button called traffic speed slow. Medium or fast. Let's click on this one. What it does, it will configure the latency to add some latency to that container. It only does that not on a complete computer, but only on the specific container. So the other container should be unmanifed. So since I click on this button, I see that it takes more time to download the small file. It takes more than one second. And if I click on the slow button, it will add a latency of two seconds. And since the loading file on internet will have... It has some... It does save around one trick to establish the TCP connection. It actually takes more than six seconds. So I left this one like that. And I will see another team test. That's another replica of it. This one should not be affected by the configuration because each container has their own configuration. That was the integration with DCD. But how can we use it for real testing for that? I took the Kubernetes example application called guestbook. I will show you it right now. So guestbook is a really simple application. It has frontend written with Apache on PHP, kind of backend interface. And I can add some message here and install it in the backend. And I see here it seems to work quite fine. But actually does it really work? Here I have a good network connection. So I might not see the problem with that. But I'm going to go back to with scope and find... Sorry, we'll find the correct... So I found the container running Apache on PHP. That's the frontend of my application. The application that you can see just here. And I will add some latency. So here I have two seconds latency. So if I refresh the page, I press refresh. I see it quite slow. I see the release spinning here. It doesn't think... Oh, no, it's so fresh. But actually, we are on my message. They seem to be lost. Are they really lost? Did I... Oh, no, they appear. It was just slow. I think that's a user experience bug because when I have refresh, at first it says it's refreshed. And then all my messages are lost. And then I don't have any user feedback. And later they come. It would be good to have some message, say loading or something, some user feedback. And for that, I developed a new version of the Facebook. It's really similar. It's really similar. But it has different user feedback. Now I will add some latency as well to that new version. I will show you how it's configured. So if I go back to the list of replication controller, I put one replication controller for the version one of the Facebook and one for the version two of the Facebook. Sorry, of the Facebook. And they both connect to the same way this back end. So in this one, that's the new version. I will put some latency there. And if I go to actually version two, here I see the message loading. So that's a user feedback message. It means that the JavaScript code which we are fetching the data is still running. And if I refresh again, take some time to get the new page. And here it's loading. So I know that it's not finished. Okay. And now I will add a new message. Good evening. And I have another message sending. So I know that it's not finished yet. So that's a good user feedback. So far, I only tested manually. That's I go to Firefox, I click on button, and I changed the configuration thanks to WaveScope. It would be quite good to automatize that. If I have unit test, I don't want unit test to require a tester to click on Firefox to check if it works correctly. So let me go back to my slides. I would like to do that in a testing framework. And there are different testing frameworks that exist. There is a Selenium to simulate different kind of weather like Firefox on others. There is Agoti and Gingo on GobiGa. I will show you a demo with that. So here I have two files. And that's configure small unit small test. I use Agoti connected to the Chrome driver. And it will run the test, the following test. That's a small script returning low. And what it does, I hope you can see, it connects to the following web page. It expects to fetch the page correctly. And then it can find in the HTML page this specific attribute in the HTML page. And then it expects to find the message loading and with that I can automatize the test process. I can check that it gets all the message for the user feedback around. And I can run this inside Gingo. And hopefully it will load Chrome in this example. Since I configured the latency to quite high, it takes some time to load the page. And then the Golan script checks that the message loading is actually there. And then it sends a message. And it checks that it returns something. And then the test passed with success. If I was actually not using control, it might not be possible to do that because the message might be so fast that the test might not have a seat. So let's see if I predict back too fast. It might not work. So it checked the page really fast. Actually, the script didn't have time to get the information from the HTML page before it went away. My demo for today. And I would like that to be this kind of test with traffic control. I would like that to be developed more and that more web series use this kind of techniques to develop, to test the application. And I have a wish list of things that I did not implement. But I would like to have. For example, when we attach a Q&A on a network interface, we apply the same rules for all the traffic. But with my implementation, it's not yet possible to classify the traffic in different tasks. For example, I would like to classify traffic on HTTP to one-eyed address or to DNS or to apply different latency and different parameters on it. It's possible to do that on Inux. On Inux, you can attach on network interface Q&A on filters and classes. And there is one filter called U32. What it does is inspect the network packet and look inside and apply a mask on it to detect, for example, what destination plot it uses. Or what destination IP it has. On both of that, you can classify the traffic into different classes. And each class can have a different Q&A, so you can attach a network calculator Q&A with some latency, another one with some packet row, etc. And my small demo, TCD, doesn't implement that, but it will be possible to add that feature. It will be possible to use TCD to configure the network traffic control so that one pod can have different parameters when it talks to one pod or another. For example, when it talks to this pod, it will have a latency of 101 milliseconds or to this pod, actually don't hold the packets. I think this kind of thing could be useful for testing, for example, the Vaft consensus algorithm, which is used in TCD. TCD implements a membership protocol. Each node sends a heartbeat at a specific interval, depending on the configuration, every 100 milliseconds. And then if there is no connection, there is an election timeout, and we start a new election to select the new leader. If we have a high latency like 5 seconds, as you expect, it might disconnect the node. And I will be interested into testing that with traffic control. There is more techniques which could be used with a Bacchet packet executor, BPR. It's possible to write some programming C and compile them in a specific machine language, BPR, and upload that in the kernel. And that would be useful so that the Qindice thing can use that program to decide how to classify the packets. So it could write more complex rules with that. Recently, BPR was extended into extended BPR, and it implements a new feature called EBPR maps. Maps are actually a hash table that is in memory, which can be shared between the kernel and user space. That hash table can be wished via TCD to read some statistics. And the Qindice thing could execute the program and update the hash tables in memory. I think that might be interesting to develop that. Thank you. That's almost the end of my talk. If you want to try the demo yourself, you can get that GitHub history. And it has instruction to repeat the demo step by step. And the source code is available. You can read the blog post that Alessandro here posted recently. Just before stopping, I would like to mention the SystemB conference in Berlin in September. I will be at ContainerCon in Toronto. Would you? An awesome place to go and hang out and learn about this stuff. There will be a CNCF there and the Cloud Native Foundation folks will be there talking and networking a little bit and try to promote work that we're all on. Thanks, Alvin. Alvin, I have a quick question regarding you. You talked about this being a number of these things being on your wish list. Where does that work need to be done in order to get your wish list fulfilled? Is that on TV? Or is that something that is just something that needs to be figured into Weave Scope? Or if someone wants to work on that, where do they need to go? Let me go back to this slide. So the features in the kernel are already implemented for our world, so that work is done. But in this slide I show the demand for our world, TCD, at the moment, only work with very basic features. It can only change the latency on the boundaries on packet drop. But it could have an intrusive command on GIPC, or DPS, remote method calls. And it would be possible to add more method calls to add more features. And then TCD, when configuring the network traffic control, could code the TCD to do that. So the question was where to do that code. It would be possible to do it in TCD. And then Weave Scope could connect to that if there is a UI in Weave Scope to do that. Or it could be an external framework, testing framework. Yeah, so that's great. Good. That's where you wanted to point people to. Perhaps we can round up a few of the folks to collaborate with on getting that done. That's really what we're trying to do here at Commons is to find other people to collaborate, distribute the code, and give you some feedback on your work. I know we also have a number from Weave Scope on the call. And I would love it if I could coerce one of them. There aren't any questions. So you did a great job, Albin, answering most of the questions. I think the questions will come on the email list afterwards. But I'm wondering if we could get Alphonse maybe to share his screen and show off a little bit of some of the new features of Weave Scope because I think we could use the Kubernetes. That would be great. We'll sneak that in here today, too. Hello. I'm Alfonso Acosta and I'm a software engineer with working at the Scope team. And Alfon has done a pretty good job at showing some of the capabilities of Scope. But I wanted to show what we've been very recently working very hard on, which is the deep integration with Kubernetes. By the way, this all works on an OpenShift as well. But I didn't have an OpenShift cluster around. So I'm going to be demoing a Kubernetes cluster instead. The first feature we added, which is simple but shouldn't be undervalued, is how you install Scope on Kubernetes. A lot of monitoring solutions are complicated to install. It's actually part of the philosophy of WeWorks, to make things as seamless as possible for developers and operations. And we've put together a little service, which generates the Kubernetes resources for you so that you can install Scope with a single command. I've already installed it, so it will tell you that everything exists. But it's as simple as using the URL capability of kubectl in Kubernetes. kubectl is the command line CLI for Kubernetes. And it allows you to deploy Scope in your infrastructure with a single command. It will create an engine in every single machine in your Kubernetes cluster. And what happens when you connect to Scope is that you get this view. In fact, our awesome frontend team has been working on a high-contracts view for this type of presentations. I hope you can see it more clearly now. What we're seeing here is a very simple application in which we have multiple clients, which you can see here and here, obtaining information from a web service, which goes through a frontend, connects to an app, and it accesses search services, a database to know how many times the service was accessed, so on and so forth. And what Alvin has, this is the container view, by the way, what each of these hexagons represents a container. What Alvin hasn't been showing is the new Kubernetes-related views. So they follow the same philosophy as the container view you've seen before. But instead of showing containers you're showing pods, edges represent connections between pods. You see how many containers a pod has and how they're connected together. And we have also added more views. We have views for replica sets and deployments and services. And we have reached contextual information about each of the pods. So, for instance, if we clicked on a client, it will show you to what pods is being connected at this very moment. It also will show you the pods and you can navigate through them. Now this is the visuals of the pod. In fact, I could be showing the logs of the client by clicking on this command. Actually, the client doesn't log anything to a standard output. But we could show that in the front end, for instance. And we would be able to see the requests here they go in coming into the client. So scope is not only a visualization product, but also a monitoring and controlling product. A typical use case is you have your infrastructure and you want to scale it up, and you want to, for instance, add an extra client to add more load, or you want to add another front end. You would do that in Kubernetes through replication. Well, in a few months ago, you would do that through replication controllers, but now they've introduced deployments and replica sets. So in order to scale the client, the client has a corresponding deployment and it says it has two replicas. But let's add an extra one. We have two controls here to reduce the number of replicas or increase them. If we click on plus and wait for a little bit, we'll see that the number of client pods should increase. It will take a little bit, but hold on. Let me check again. Okay. It doesn't seem to be working at this point probably because it's a local cluster, but if we wait it for a bit, we should be able to get, oh, here we go. We have three replicas and there you go. Now we have three pods. We also have contextual information about the processes running in the pod. We have the pod IPs, which are always very useful, and we also introduced a new feature, which is not related to Kubernetes but a general feature, which allows us to search textually. So, for instance, if we wanted to search containers by IP or by CPU, we will be able to see them here. Let's see if we have an example. Here, we highlight all the client containers and it also shows us what other views contain those names. I think that's more or less what I wanted to show you. If you have any questions, I'll be very happy to answer them. That is super useful for people who are hosts or operators. I'm just really, it's a very nice visualization of everything that's going on under the hood. So, I actually don't see any questions in the chat at the moment. I think that between the blog posts that Alexandro wrote and the work that Alvin did here today, I think we covered a lot of territory and gave some really good insights into how to use Weave Scope. I'm looking forward to trying it out on OpenShift. Probably everybody knows we have OpenShift online and OpenShift dedicated, so I'm thinking I can coerce the operations folks in testing it out too. So, I think there's going to be some interesting use cases coming up in larger deployments for some of this work. I'm really appreciative of you taking the time today to showcase all of this, and we will be posting this as a recording on YouTube and in the blog.OpenShift.com links will be there and to the YouTube and other places, and we will definitely see you Alvin in Toronto and next in two weeks in Berlin. If anyone has any questions there, welcome. I see one. Ilya, do you want to try and show the install process on OpenShift now? I mean, if we have time, sure. Yeah, I've got time to record. We've got a few more minutes. Yeah, cool. Okay. Yeah, right. Can we give them a few minutes? Yeah. Yeah. So, okay, it's kind of sharing. I'm sorry, that's the point. Okay. Then I'm going to coerce you into writing up as a blog post. Okay. Yeah, that's right. Yeah. So, I was just going to show really quick how you install Scope on OpenShift. Oh, perfect. Can everybody see my terminal here? Is that quite good font? Yep, font size. Okay, cool. So, I've written down some notes here just in case I forget. So, I've just logged in to OpenShift.com for the purpose of these demo. I've prefaced the images, so we won't have to wait for images to download from Docker Hub. And I see login. And login is admin here. Yeah. Okay, cool. I create a new project. Okay. Next, I need to run a couple of commands here to apply a specific policy for Scope to work properly on OpenShift, setting administrative privileges. Okay. So, we should be all set. And now this is basically the command that installs Scope. Sorry, I forgot the scheme. Yeah. So, we have this URL, which you pass to OCCreate or kubectl, if you like, that will install Scope on Kubernetes or OpenShift all the same URL for more. And right now, if we do get pods here, we should see that some pods have been created. Okay. Okay. Well, in the meantime, I can log into OpenShift console here. This is obviously a default install from Reagan. Okay. There we go. Okay. Cool. We have these two containers running. One, there is, potentially, what there is is a, there's a probe and the app. So, those are the two components. And probe is what runs on each node and that runs as a demon set. And the app is just a regular replication controller. And there is also service for the app. Right. So, now I'd like to access the app and I'll go to the OpenShift console here. Find Scope and create a root for it. Okay. Cool. And this should give me a Z-Bio URL that I can access.  So, this loads Scope UI. It's still... Still thinking about it. Still thinking. Yeah. So, essentially, this is what you need to install it. Yeah. Okay. Here we go. So, it loaded, I think. Okay. Well, that's a reload. Yeah, this... I might be running a couple of more VMs. So, yeah, maybe there isn't a wide slope. Okay. What else? And I mean, I'll also create an app here that we can look at. See new project line up. And I have this really quite simple app here. Yeah. Something like that. Load it. Load it. It's loaded. It's pretty high. I wonder what else does that. Okay. This is the fun of running a live demo on your machine. You'll have to get a bigger machine. That's right. Yeah. Well, what I'm seeing is, essentially, this seems like Docker taking a lot of CPU. I don't know. That's interesting. Okay. Well, there is OpenShift. I don't have a bit of a problem. But this is, I assume it's running latest OpenShift too soon. Really, it's there. Okay. Well, I mean, we can see that Scope is running on OpenShift. Fortunately, we have a little load issue with this VM. I'll have to investigate that. That's okay. That's okay. I think live demos off the cuff are always fun to watch. But it's really... I think it's a good example of the compatibility between Kubernetes and OpenShift to pretty much the same commands that you run. That's right. OC does pretty much the same thing as CUBE CLT plus all of the OpenShift work too. We try very hard at OpenShift to say in sync with the latest release of Kubernetes. We're pretty much in a couple of weak cadence after each release. I think we're very happy with the world of Kubernetes, the cluster management. I'm seriously thrilled to see the weak Scope stuff looking so nicely on OpenShift. So there's a lot to say. Thank you for... And that's kind of the power of collaborating together on this. But a lot of people work behind the scenes to get everybody up to speed on OpenShift. And I really appreciate the work you guys did. So hopefully, we can do a lot more stuff together in the coming months. And we'll see about trying to run some of this at scale. Yeah, absolutely. Online and OpenShift dedicated as well. I think the other folks who are hosts and operators who are using OpenShift on the hood like GetUpCloud and CloudIsle and a few other pods providers out there are going to be interested in this. I really do want to take another shout out to Albin. The traffic control stuff is something and latency issues are near and dear to my heart as a web app developer. So I think highlighting that and how to use Weave Scope for that was really awesome. I'm hoping we can entice some developers to start thinking about this in a more realistic way. Thanks again, everybody. I'm not seeing any more questions. Going one, going twice. We'll talk to you all next week again for the next OpenShift Commons. And you can find this recording on our blog post next week. Probably by Monday should be up and available. So thanks again.


The House of Representatives has mandated its Committee on Health Care Services to investigate the non-functionality of the primary health care centers in the country and give it a feedback within four weeks. The resolution was based on a motion unanimously adopted at the plenary titled, called to investigate the non-functional national primary health care centers in the country. A member of the House, Sergius Ogun, who moved the motion, had noted that, per the intersection 3B of the National Primary Health Care Development Agency Act, the Primary Health Care Development Agency was established to, among other things, stimulate the technical development of primary health care centers on an equitable basis in all local government areas in the country. The lawmaker Uso noted that the federal government flagged of a primary health care center revitalization program in 2017 to refurbish PHCs and establish at least one functional center in each center or district of the country. He said the House is concerned that, despite the revitalization program, only less than 20% of the 30,000 primary health care centers in the country are in good working condition, while others are either completely grounded or ineffective in the delivery of primary health care.


Central Lakes College in Brainerd opens its performing arts season later this week with their production of The Elephant Man. The Elephant Man is the first of four productions that the Brainerd Community Theater will put on at CLC this year. The performers consist of students at CLC and members of the community. The Elephant Man may remind people of the 1980 film, but it is not a direct adaptation. It's a very uplifting story about overcoming adversity and seeing through the exterior of people to what really is underneath them. I think people will recognize the play from the film, but should know it's a very theatrical piece, and we won't be doing a lot of prosthetic makeup. The Elephant Man opens on Thursday, September 27th, and will run for six performances, including on Thursday, October 4th. If you enjoyed this segment of Lakeland News, please consider making a tax-deductible contribution to Lakeland PBS.


The time has come To face you in Mortal Kombat to teach you respect Liu Kang the champion of Earthrealm Orphan at a young age Liu Kang was raised by Shaolin monks who trained him in the ways of the spiritual warrior Having defeated Shang Tsung and Shao Khan in Mortal Kombat Liu Kang is ready for any fight with fists of fury and dragons fire Let us get to know each other in the duelist variation Liu Kang changes between light and dark metamorphosis Altering the properties of his projectiles in the dark stance Liu Kang's dark sphere can stop on command Trapping and juggling your foes in the corner in the light stance solar flare back forward X plus right trigger is best used to juggle your opponent Choose between the searing damage of light the setup potential of dark or a combination of both I'm simply too fast. I Will show you hell Liu Kang ignites the fury of the Shaolin in the flame fist variation Use Shaolin fur no down down X plus right trigger to quickly buff Liu Kang's punching attacks and extend combos His new enhanced special attack when meal flurry is a great armored launcher that could be canceled into another special The potential chip damage of flame fist punishes any foes who choose to block Use Liu Kang's mobility and quick normal attacks to punish those that choose to flee or attempt reversals I am far more than mortal The dragon's fire variation and captures the Liu Kang legacy with high-pressure play and ferocious fireballs Liu Kang's dragon fire can be dash cancelled to extend combos and push your enemy to the corner Keep up the corner pressure with Liu Kang's fast normal attacks and dragon fire cancels Keep in mind your opponent will attempt to escape the pressure change the tempo of your offense to capitalize on your opponent's mistakes The strength of Liu Kang rests on safe pressure Use ankle snap down a to poke at your opponent allowing Liu Kang to stay on the offensive Whether you choose the adaptability of duelist the rod damage of flame fist or the versatility of dragon's fire Liu Kang has an answer for any challenger Shatter bones for the Shaolin with an x-ray finisher and go from enter the dragon to release the kraken with a brutality Leave the charge with earthrealms defender Liu Kang and tune into the ESL Mortal Kombat X Pro League presented by Xbox


My name is Łukasz and I'm joined today by Agnieszka Szorkowska. Agnieszka is a professor at the University of Warsaw and honorary research associate at University College London. Agnieszka, you dedicated your career to researching audiovisual translation and subtitling in particular. What do you do to actually know where people look when watching subtitles, how people are reading subtitles? How can we actually know that? Well, basically you can do two major things. You can ask them and then this may or may not be true because they may or may not remember, may or may not pay attention or you can try some more objective measures. For instance, we've been working with eye tracking a lot and eye tracker is basically a device that allows you to see where people are looking. So you show them film with subtitles, you can manipulate different reading speeds of these subtitles and then we are able to find out whether they have been able to read those subtitles at all. Sure, that sounds absolutely fascinating. So you mentioned this device, eye tracker. To a person who has never heard about it, how could you describe how this device works? Okay, this wasn't in the script. So there are different types of eye trackers obviously and the ones that we have are very user-friendly. They're called non-invasive. It's basically a panel that uses infrared light. This light shines some light that you as a viewer, as a participant, you don't see. But the eye tracker's camera sees that and thanks to the reflection of this infrared light, we can know precisely where and for how long people are looking at something. That is displayed on the screen. So for you as a participant, it looks like this. You sit at a computer, could be a laptop, could be simply a simple monitor and you just watch something on this screen and you don't even notice that there is an eye tracker there. Sure. So let me recap to make sure that they understand correctly. So thanks to this device, eye tracker, you're able to know where people are looking and for how long they are looking at this part of the image. That's right. And we are trying to infer what that means, right? And we need to remember that the eye tracker only tells us where they looked and for how long. It doesn't tell us anything about what they think, right? So you later as a researcher, you're trying to analyse why people were looking there and why they spend so much time in this area. Yes, yes. Generally the longer you look at some place, the longer your fixations are. Fixations are these moments, so and the eyes are relatively stable when you're actually taking in some new information. So the longer you look at somewhere, we can infer that potentially this was either a more interesting thing or more difficult to process and then you'd need to follow that up with some more subjective questions or some other methods to triangulate. That means to put together different methods and see what comes out of it. Thank you for explaining that. So as subtitles, we often wonder about reading speed. What is the reading speed that we should be using? You've spent approximately 20 years researching reading speed, right? So you seem to be the right person to ask this question. And the question that people, when they're doing subtitling for the first time, the question that I was asking myself, what reading speed I should use? What is the best reading speed? Yeah, that's an excellent question. What's the optimum reading speed? I go to those conferences, I talk to people, I talk to students and they are asking me, so what's the best reading speed? What's the speed that we should use? And actually, this is a question that cannot be answered really. It's like the holy grail of subtitling, industry and subtitling research as well. I understand why people want to have one number. For instance, if you're a company, you're basically looking for the number for the reading speed and characters per second to put in your style guide, for instance, right? As a subtitler, you need to put something in your subtitling software, so you need that one number. However, it's really impossible to say what this number should be because it depends on a number of factors. For instance, it depends on the audience, whether you are an adult proficient reader or whether your subtitles are meant for children, whether you're hearing or deaf or hard of hearing, right? That also depends on what actually people are saying because if we are watching some really specialized documentary with lots of difficult words, obviously it would be recommended to go down with reading speed, when the content is much easier, you can go up a bit. I think the important thing that we need to remember is that what you have in the style guide and what you put as a subtitler in your subtitling software is the maximum reading speed, right? If you have, I don't know, 17 or 20 CPS, it doesn't mean that every subtitle should be that fast, right? Having said that, I think it's quite good that your subtitles should have some similar reading speeds, consistent speeds so that you don't have a lot of differences. And one final thought, I think it's also impossible to state what the reading speed should be because you have different types of content. I already mentioned specialized language, but it also really depends on how much is going on on the screen, right? If you just have two characters like us talking, it's not much of an issue, but if you have a lot of things that are going on on the screen that you want people to actually have a look at, right? People go to the cinema or watch films not to see your subtitles, right? They just want to see whatever is on screen. So that also depends. So I cannot answer, I'm afraid. But anyway, you've given us so much useful information. So let's try to recap and make sure that we can remember all of it. So first of all, you're saying that reading speed depends on the number of factors. So when I'm thinking as a subtitle, which reading speed I should use? So you basically need to think for whom, right? You're translating who your audience is, what the content is right, where they're going to watch it, for instance, if they're in the cinema, nothing is going to distract them probably if it's content on television. Perhaps you might want to go down with your reading speed a bit. Sure.  You also mentioned that it depends on the content. So now the two talking heads are right in this video. Not much going on. That's right. So if you're reading subtitles, there's not much that you are going to miss, right? But if you're working with some action-packed film, you would really want people to actually look at the image so action is important, right? Yes. I was just thinking about that, that these fast-paced action movies where there's really so much going on and people will need more attention on the image and subtitles should not distract them that much from what's going on in the image. Okay, so we mentioned the audience, we mentioned the content. Does it also depend on the language, the language of the film and how the audience is familiar with this language or not? Well, I suppose it makes a big difference if you are familiar with the language of the soundtrack, right? I'm not sure if that's what you're asking, but with so much English language content that we've had so far, so the situation that is quite common is that people can understand the language of the audio and you know that yourselves probably, right? You start comparing what you can hear in the dialogues with the characters that are saying with the subtitles and then if you know the language, you might be looking for, unconsciously, some discrepancies, right? And then you're not very happy about that. Yes, but that, of course, differs. When I watch, I don't know, a Korean film, right? Some non-English content or the content that we are not familiar with, obviously you would want to have some lower reading speed because you can't take in any useful or meaningful information from the verbal content of the dialogues. And that's because you just don't understand that language. You don't understand. You can try to get something from the intonation or from some other sounds the characters are making, but still, you just don't get it, right? So the only meaningful information that you have is actually in the subtitles. So summing up, if the audience is familiar with the language of the film and understands it to some degree, reading speed could be a bit higher, whereas if this is a language that the audience in its majority will not understand, the reading speed should be lower. That's right. That's what we found in our study, yes. Okay. That's very interesting. But the bottom line for a subtitler is what should I set in my subtitling tool? Whatever your company tells you. They pay you. You need to... Although, no, I have to say... I'm wrong to say that. There needs to be some common sense, right? So if your company tells you, okay, let's do, I don't know, 35 or 40 characters per second. Then perhaps it's time for you to say, hmm, really, no, let's think about it. That's not really the speed that people will be able to follow. Okay. So usually as a subtitler, you will receive this information from the company you're working for. So you will have style guides prepared by the company that will say, use this reading speed, okay? But can we give people the range of reading speeds which are mostly used on the market today? Yes, yes. So roughly speaking, the speed that we have on the market, that of course depends on the country and all those different factors that we already mentioned, that somewhere between 12 to 20 characters per second, I think most of the style guides, they fall into this range and that's an okay range, depending again on all those factors. Okay. So our advice will be never to go off 20 characters per second. That's already very fast. That is quite fast. That's true and our research shows that some people are able to follow subtitles up to 20 characters per second. However, there was some research done in Australia by Professor Jan-Louis Kruger who also tested another speed, 28 characters per second and he found this speed is much too fast for people to be able to follow. So the result that we have currently show that at 20, most people can still cope. Sure. So the bottom line for us, never go above 20 characters per second and I think we should also remember that some countries have very strong traditions of lower reading speed. So there might be countries with 12 characters per second. That's right. That's right. Some Scandinavian countries using subtitling traditions, they traditionally have worked with very low, what seems to be low now, reading speeds like 10 to 12 characters per second and that's something that we haven't mentioned yet. That, of course, lower reading speeds imply higher text reduction and that's the key point in subtitling. So I think that's also the reason why reading speeds or the increase in reading speeds has caused so much controversy on the market because there have been those traditional subtitling markets, as Scandinavian countries, as I mentioned, that have always condensed a lot and their audiences are used to that and that's part of their professional ethics as well. So this is how subtitling is done, you condense a lot. That, of course, depends on the speed of the characters, the speed rate, the different factors, but that's their ethics and then a couple of years ago some new companies entered the market or there have been changes in style guides and with increases in reading speeds. So there has been discussion going on, whether it's good or bad, whether it's good subtitling, good quality or not and what does it really mean and who's the right to say? So you mentioned condensation, let's perhaps unravel that for our students. So the lower reading speed, the less text we can actually have in a subtitle, the less letters will fit, right? That's right, so you can have, with lower reading speeds, let's say 12 characters per second, with lower reading speed. So you as a subtitler, what you have to do, you have to condense the text. So you can insert fewer characters with lower reading speed. Okay, thank you for those, Agnieszka. It's been great talking to you. Thank you.


And troops of the Special Task Force Operation Safe Heaven have arrested eight suspects in connection with the killing of three women at Rafin Bonner Community of Plateau State. The soldiers responded to an alert but two of the women had been killed by the time they got to the scene of the incident, a farm. The third died from high injuries. So you get notified about fresh news updates.