Copyright © 2009, 2010 Internet Systems Consortium, Inc. ("ISC")
Table of Contents
Table of Contents
ISC AFTR implements a Dual-Stack Lite (DS-Lite) Address Family
Transition Router (AFTR), as described in
draft-ietf-softwire-dual-stack-lite-06.txt
.
This technology allows end-users with IPv4-only hosts or
IPv4-only applications to communicate with IPv4 peers over an
IPv6-only network.
A DS-Lite deployment includes at least one AFTR in the ISP's network core, and one Basic Bridging BroadBand element (B4) at each customer premises.
DS-Lite is in the process of being standardized by the Softwire working group of the IETF. ISC AFTR actively tracks the current specification, but users should be aware that there may be changes to the specification before it is finalized as an RFC. As such, this should be considered a work in progress, for testing and experimentation only.
Table of Contents
This section provides a "quick start" to using ISC AFTR in the simplest configuration. For full build and configuration details, see chapter 3.
OS: Linux or FreeBSD. Kernel must be built with IPv6 and tun(4).
Linux kernel version must be greater than 2.6.26, to
correct a small-packet-drop problem in
tunnel46_rcv()
.
CPU: No special requirement. Note that performance is bound to the kernel/user context switch latency, so processor speed is the single biggest determiner of performance.
Memory: No special requirement.
Unpack the distribution.
tar zxvpf aftr-1.1.tar.gz
This creates a a directory named aftr-1.1
,
which we refer to as $src_path
hereafter.
cd $src_path
./configure
make
This creates an executable file aftr
,
which is the AFTR daemon program. It is expected to be run
in the same directory as the configuration
file aftr.conf
and the script
file aftr-script
(there is
no make install
step).
An example aftr.conf
file is located in
the conf
directory.
The only required parameters are those in section 1 of the config file, and are briefly described here. The full set of configuration commands is described in section 3.3.
address endpoint 2001::1
This is the IPv6 address of the AFTR. Specifically, it is the endpoint of the IPv6 tunnel between the B4 and the AFTR.
This address is associated with the tunnel interface, but is
not explicitly assigned to it; instead, the
aftr-start()
portion of the script file
creates a covering route to the tunnel interface.
address icmp <IP_ADDRESS>
This is a global IPv4 address used as the source for ICMP errors sent from the AFTR to the Internet. The actual address doesn't matter, as no one should try to respond to an ICMP packet.
acl6 2001::/48
This is an Access Control List for IPv6 traffic from the B4 to the AFTR. It is the IPv6 prefix that encloses the portion of the provider's network that is served by this AFTR. If the AFTR serves customers served by multiple disjoint IPv6 prefixes, there can be multiple acl6 commands.
pool <IP_ADDRESS>
This is a global IPv4 address in the service provider's network, which will be used as the NATted address for packets sent to the Internet.
Multiple pool addresses may be defined, and restrictions may be placed on port ranges to use for NAT bindings.
The aftr executable requires a
startup/shutdown script. When aftr
starts up, it calls the script's start
function to bring up the tunnel interface, and set up routes
to the interface.
When aftr shuts down, it calls the
script's stop
function to bring down
the tunnel interface, and remove all routes to the
interface.
By default, the script file is
named aftr-script
, and resides in the
same directory as the aftr
executable
file.
The conf
directory contains example
aftr-script
files for Linux and FreeBSD.
First, make sure your interfaces are configured correctly, and IPv4 and IPv6 forwarding are enabled. On Linux, you may also want to disable netfilter for performance reasons.
Note: Linux
netfilter tables need to be flushed ('iptables
-F
' and 'ip6tables -F
')
explicitly.
To start AFTR, run the aftr
executable
in the same directory as the aftr.conf
configuration file and the
aftr-script
script file. For other
startup options, see section 3.2.
AFTR normally starts as a daemon process. To access the control interface, telnet to localhost port 1015. AFTR can also be started in foreground mode, which gives immediate access to the control interface. For control commands, see section 3.4.
The B4 is the customer-side DS-Lite tunnel initiator. In the most common use case, it is a home gateway, also referred to as a CPE (Customer Premises Equipment).
For testing and demonstration purposes, we have used home gateways (e.g., Linksys WRT54GL) running OpenWrt, a Linux distribution tailored for home gateways and related devices. B4 functionality can also be built into general-purpose computers, and has been demonstrated in FreeBSD and Ubuntu Linux. In all of these cases, the important thing to keep in mind is that the B4 device is the IPv4 default router for all hosts behind it.
There are no special requirements above what one might expect for a home gateway. The only added functionality that makes it a B4 is to set up an IPv4-in-IPv6 tunnel, and to encapsulate/decapsulate all IPv4 traffic to/from that tunnel; and all home gateways that can run OpenWrt can do that.
Note: More information, and prebuilt images for WRT54G
devices, can be found at
http://www.kangaroo.comcast.net
The following instructions are for building an OpenWrt image from sources.
Get OpenWrt sources from
https://dev.openwrt.org
Copy the contents of the
conf/b4-openwrt
directory to a new
directory named
openwrt/version
/package/dhcp4
Go to the openwrt/version
directory, run make menuconfig, and
make the following selections:
Select 2.6 kernel: Target System > Broadcom BCM947xx/953xx (or your target architecture)
Deselect busybox udhcp client: Base system > busybox > Configuration > Networking Utilities
Select dhcp4-client and dhcpv6: Network > isc-dhcp
Select the non-busybox version of ip: Network > ip
Select ip6-tunnel: Kernel modules > Network Support > kmod-ip6-tunnel
draft-ietf-softwire-dual-stack-lite-06.txt
says:
In order to configure the IPv4-in-IPv6 tunnel, the B4 element needs the IPv6 address of the AFTR element. This IPv6 address can be configured using a variety of methods, ranging from an out-of-band mechanism, manual configuration or a variety of DHCPv6 options.
In order to guarantee interoperability, a B4 element SHOULD implement the DHCPv6 option defined in [I-D.ietf-softwire-ds-lite-tunnel-option].
The DHCP server does not have to run on the same computer as the AFTR, but it must be reachable via normal DHCP request channels from the B4, and it must be configured with the AFTR address.
On the server, add something like the following
to dhcpd6.conf
:
option dhcp6.dslite code 54 = ip6-address;
option dhcp6.dslite 2001::1;
NOTE: For testing, we use an unassigned DHCPv6 option code. DO NOT use this option code in production, as it is likely to change when the draft reaches RFC status.
The IPv6 address must be the same as the
address endpoint
option
in aftr.conf
.
On the B4, dhclient6.conf
contains the
following to request the option:
option dhcp6.dslite code 54 = ip6-address;
also request dhcp6.dslite;
If you are using the supplied OpenWrt dhcp4 package,
dhclient6.conf
already contains these
lines, and dhclient-script
contains a
few extra lines to set up the tunnel and create a default
IPv4 route to it.
draft-ietf-softwire-dual-stack-lite-06.txt
recommends configuring the B4 with a DNS proxy resolver,
which will forward queries to an external recursive server
over IPv6 (this server may be co-located on the AFTR box).
To configure the B4 with an upstream resolver address, add something like the following to dhcpd6.conf:
option dhcp6.name-servers 3ffe:501:ffff:100:200:ff:fe00:3f3e;
Note: if the B4 uses dnsmasq as a DNS proxy, then the used version should be checked. Only recent versions are RFC 5625 compliant; in particular the EDNS0 UDP size can be limited to 1280 bytes instead of the recommended 4096 bytes.
It is easy to fix this last point by configuration:
Add in /etc/config/dhcp
in the
dnsmasq section the line:
option ednspacket_max 4096
If dnsmasq is launched directly, add these arguments:
-P 4096
Table of Contents
Here is the list of configuration flags
(i.e., CFLAGS
):
AFTRCONFIG
: config file path
(default aftr.conf
)
AFTRSCRIPT
: script file path
(default ./aftr-script
)
AFTRDEVICE
: name of the interface/device
(default tun0
)
AFTRPORT
: port for TCP control channels
(default 1015)
AFTRFACILITY
: syslog facility
(default LOG_LOCAL5
)
AFTRLOGOPTION
: openlog option
(default LOG_NDELAY
)
TRACE_NAT
: enable tracing of NAT
entry creation/deletion (default is undef
,
i.e., only tunnels and buckets are traced)
NOPRIVACY
: trace all addresses and ports
in NAT entry tracing (default is undef
)
SIGNSHDR
: define it to add a signature
header in structures (default is undef
)
SIZES
: define it to print sizes of
principal data structures (default is undef
)
USE_TUN_PI
: use the tun_pi struct in tun
interface/device I/O
(required on some platforms, including RedHat and CentOS v5,
for IPv6 support)
notyet
: some unfinished and arguable
features (undef
of course)
Included inline aftr (8)
aftr — Address Family Transition Router
aftr
[-g
] [-t
] [-c
] [config-file
-d
] [device-name
-p
] [port-number
-s
] [script-file
-u
]socket-name
By default the aftr process becomes a daemon,
-g
keeps it in foreground with logging to stderr.
-t
can be used to check a configuration file.
config-file
The aftr daemon requires a configuration file.
By default it is named aftr.conf
, and is
located in $src_path
. The
AFTRCONFIG
environment
variable and the -c
argument give an
alternate path. A sample configuration file is provided in
$src_path/conf/aftr.conf
(OS independent).
device-name
Linux: The aftr process opens /dev/net/tun
and set the name of the interface to the
AFTRDEVICE
environment
variable or the -d
command line argument value
or by default 'tun0'.
FreeBSD: The aftr process opens /dev/tunXXX
from the AFTRDEVICE
environment variable or
the -d
command or by default
/dev/tun0
. The 'auto' value uses the first
free /dev/tunXXX
device.
The tunnel interface/device specification can be a full path
(/dev/...
), a relative name or a number.
port-number
Use the port-number
for TCP control channels. Default is 1015.
script-file
The aftr daemon executes a shell script file
with start
on invocation.
This is named by default aftr-script
and
located in $src_path
. The
AFTRSCRIPT
environment variable and
the -s
argument give
an alternate path. This file could be even empty, but must exist.
The aftr daemon will eventually execute
the shell script file with the stop
argument
before it exits.
The conf
directory provides examples
(including the configuration files used in our
testbeds). aftr-script.freebsd
variant is for a FreeBSD based AFTR.
socket-name
As an alternative to TCP over IPv4 and IPv6 with localhost
control channels, the aftr process can
accept PF_UNIX stream socket control channel on the
socket-name
.
Included inline aftr-conf (5)
aftr.conf
— configuration file for aftr
aftr.conf
The aftr daemon requires a configuration file.
By default it is named aftr.conf
, and is
located in $src_path
.
The AFTRCONFIG
environment
variable and the -c
argument give an alternate path.
Sample configuration files are provided in
$src_path/conf/aftr.conf
(OS independent).
The configuration file consists of a set of one-line configuration commands. Commands are not case sensitive. Any line beginning with '#' or whitespace is ignored as a comment.
Configuration and interactive commands belong to sections:
section zero is for global parameters which must be defined before anything else when they are not kept to their default values, for instance defmtu.
section one is for required parameters, for instance acl6.
section two is for reloadable parameters, for instance nat.
interactive only commands are in the section three.
Only the section one commands are required; reasonable defaults are
provided for all other configuration parameters. See
conf/aftr.conf
for an example of a minimal
configuration file.
Alias of default tunnel auto on|off
.
size
Specifies the bucket size. Compile time options are
[TCP|UDP|ICMP]BUCKSZ
,
default values are: TCPBUCKSZ
10,
UDPBUCKSZ
8, ICMPBUCKSZ
3.
Minimum is 0 (excluded) and maximum 255.
decay
Specifies decay values for 1, 5 and 15 mn rates. Compile time
options are DECAY{1,5,15}
, default values are:
DECAY1
exp(-1/60), DECAY5
exp(-1/300), DECAY15
exp(-1/900).
Minimum is 0.0 and maximum 1.0.
Enables or disables equalizing the length of IPv6 fragments. Default is off.
lifetime
Specifies the lifetime of fragments in reassembly queues. Compile
time option is FRAG_LIFETIME
, default value is
30 seconds.
Minimum is 0 (excluded) and maximum 1200.
maxcount
Maximum number of entries in reassembly queues ('in' is IPv4 from
clients to the Internet, 'out' is IPv4 from the Internet to clients).
Compile time options are FRAG{6,IN,OUT}_MAXCNT
,
default values are 1024. Minimum is 0 (included so it is possible to
disable reassembly), maximum is 16535.
lifetime
Specifies the lifetime of expired NAT entries in the hold queue.
Compile time option is HOLD_LIFETIME
, default
value is 120 seconds. Minimum is 0 (included), maximum is 600.
lifetime
Specifies the lifetime of dynamic NAT entries ('closed' is for closed
TCP sessions, 'retrans' is used for response not yet received).
Compile time options are
[TCP|CLOSED_TCP|UDP|ICMP|RETRANS]_LIFETIME
,
default values are TCP (600), closed TCP (120, aka 2*MSL), UDP (300),
ICMP (30), retrans (10). Minimum is 0 (excluded), maximum 36000
(10 hours).
min
-max
Specifies the default port (or id for icmp echo) ranges for pools.
Compile time options are [TCP|UDP]_[MIN|MAX]PORT
,
ICMP_[MIN|MAX]ID
, default values are
TCP_MINPORT
2048, UDP_MINPORT
512, ICMP_MINID
0, TCP_MAXPORT
65535, UDP_MAXPORT
65535,
ICMP_MAXID
65535.
Minimum is 1 (0 for ICMP), maximum 63535.
IPv4_prefix
/prefix_length
Add a private prefix to IPv4 ACLs. The default is RFC 1918 prefixes and the <IP_ADDRESS>/29 from the ds-lite draft.
Enables or disables on-the-fly tunnel creation. Default is on.
This enables or disables TCP MSS patching on packets going from and to tunnels. Can be overridden by per-tunnel configuration. If any tunnels are explicitly configured, this must be specified before them. Default is off.
mtu
Specifies mtu
as the default IPv6 MTU of
tunnels. Can be overridden by per-tunnel configuration.
This specifies the policy for packets from the Internet which are too big (i.e., they don't fit in one IPv6 encapsulating packet) and are marked as “don't fragment”. 'On' means a ICMPv4 packet too big error is returned to the source, 'off' the packet just go through, and 'strict' the packet is dropped with a ICMPv4 error. Default is on (i.e., the packet is encapsulated into some IPv6 fragments and a ICMP error is returned for path MTU determination).
maxcount
Specifies the maximum number of reassembly queue entries per tunnel.
Compile time options are FRAGTN[46]_MAXCNT
,
default values are FRAGTN6_MAXCNT
16,
FRAGTN4_MAXCNT
64. Mininum is 0 (included for
reassembly disable), maximum is 255.
maxcount
Specifies the maximum number of NAT entries per tunnel. Compile time
options are [TCP|UDP|ICMP]_MAXTNATCNT
, default
values are TCP_MAXNATCNT
2000,
UDP_MAXNATCNT
200,
ICMP_MAXNATCNT
50.
Minimum is 0 (included), maximum is 65535.
limit
Specifies the maximum rate of dynamic NAT creation per second.
Compile time options are [TCP|UDP|ICMP]_MAXTNATRT
,
default values are TCP_MAXNATRT
50,
UDP_MAXNATRT
20,
ICMP_MAXNATRT
5.
Minimum is 0 (included), maximum 255.
IPv4_address
This removes the IPv4 private prefix with the IPv4 address. It is an error to have no private prefixes.
Alias of default tunnel mss on|off
.
mtu
Alias of default tunnel mtu
.
mtu
Alias of default tunnel toobig on|off|strict
.
Alias of default fragment equal on|off
.
quantum
Specifies the number of packets dealt with in one main loop round
(i.e., the size of a slice of work). Compile time option is
QUANTUM
, default value is 20. Minimum is
2 (included), maximum is 255.
IPv6_address
IPv6_address
is the AFTR endpoint
address of the Softwire tunnels.
If the DHCPv6 ds-lite option is used, this address must match the
advertised address.
It is a required command: it absolutely must be present in the
aftr.conf
file; the aftr
daemon will not start without it.
IPv4_address
IPv4_address
is a global IPv4 address
used as the source for ICMP errors sent back to the Internet (i.e.,
the ICMPv4 errors will look like returned from an intermediate
router that has this address). It is a required command.
IPv4_address
[tcp|udp|echo min
-max
]This specifies a global IPv4 address that will be used as the source address of NAT'ed packets sent to the Internet. Multiple global addresses can be specified, at least one is required.
The optional part limits the port (or id) range used for the protocol with the global IPv4 address in dynamical bindings (i.e., not static or A+P bindings which can use the reserved ports outside the range).
IPv6_prefix
/prefix_length
This adds an (accept) entry in the IPv6 ACL. Note for a regular IPv6 packet the ACL is checked only when no tunnel was found, and the default is “deny all”, so at least one acl6 entry in the configuration file is required.
IPv6_remote
[IPv4_src
]
This specifies an IPv4-in-IPv6 tunnel configuration.
IPv6_remote
is the remote (ds-lite
client) IPv6 address of the tunnel. Either the tunnel is associated
with a source address in a round robin way or it is associated to
the specified IPv4_src
.
IPv6_remote
tcp|udp IPv4_src
port_src
IPv4_new
port_new
This defines a static binding/NAT entry for the client
behind the tunnel at IPv6_remote
.
*_src
are the source IPv4 address
and port at the tunnel side of the NAT,
*_new
are the source IPv4 address
and port at the Internet side of the NAT.
IPv4_new
should be a reserved source
NAT address, port_new
must not be inside
a dynamic port range.
IPv6_remote
tcp|udp IPv4
port
This defines a Port-Range Router/A+P null NAT entry for the
client behind the tunnel at IPv6_remote
.
IPv4
and port
are the source IPv4 address and port at the tunnel side of the NAT.
They stay unchanged both ways: this entry is used to check
authorization and perform port routing.
IPv6_remote
IPv4
/prefix_length
This defines a No-NAT tunnel for the client behind the tunnel at
IPv6_remote
and the prefix
IPv4
/prefix_length
.
No translation is performed for matching packets.
IPv6_remote
on|off
This enables or disables TCP MSS patching on packets going
from and to the tunnel of IPv6_remote
.
Default is off.
IPv6_remote
mtu
This changes the IPv6 MTU of the tunnel of
IPv6_remote
to
mtu
.
IPv6_remote
on|off|strictPer-tunnel configuration of the too big policy.
level
]Specifies the debug level. Default is 0. If set to non 0, verbose log messages will be dumped to stderr. The higher the level is, the noiser the logs are. At present, the meaningful levels are 1 (log tunnel creation), 3 (log packet reads and writes), and 10 (function entry tracing). If the level is omitted, it is set to 1.
IPv6_remote
[IPv4_src
]
Create when it doesn't already exist an IPv4-in-IPv6 tunnel,
returns in all cases the description of the tunnel entry. This
command should be used by tools managing temporary port forwarding.
IPv6_remote
must be acceptable for IPv6
ACLs.
IPv6_remote
tcp|udp IPv4_src
port_src
IPv4_new
port_new
Create when it doesn't already exist a static binding/NAT entry. This command should be used by tools managing temporary port forwarding. The tunnel must exist.
Included inline aftr-commands (5)
aftr.command
— interactive commands for aftr
aftr.commands
The aftr daemon runs in the background. After it starts, it can be controlled interactively from a control channel (aka. a session).
All of the reloadable configuration commands can be allowed to run from the command line, to add or change configuration. In addition, the following commands can be run interactively.
Call abort(3) to create a core file. Please try to use it only on forked processes.
xxx
Echo the command. This can be used for an external tool to synchronize with the AFTR daemon.
Fork the aftr process. In the parent the current session is closed (so after this command you'll talk only to the child) and other activities, including packet forwarding, are continued. In the child all file descriptors at the exception of the current session are closed.
This command should be used before to execution an expensive and atomic operation like list commands or some debug commands, and of course the abort command.
List available or all commands.
Orderly kill the aftr process.
file
Redirect the input of the current session from the content of the file. This is done in an atomic way (i.e., there is no other activity during the operation) but exists if a command fails.
Obsolete, use session close (for closing the current session) or kill (for killing the process).
Reboot the whole process.
Reload the section two part of the config file. This is sliced with the packet forwarding, but not with session reading (so you can't execute a command until reload is finished).
The reload process uses a generation system: static NAT, PRR/A+P and no-NAT entries in the reloaded file are put in the next generation. If the reload succeeds, global entries in older generations are garbaged collected, if it fails new generation entries are backtracked to the previous generation. Garbage collection and backtracking are sliced with the packet forwarding, another reload command is forbidden until they finish so a reload flushes the input buffer of the current session.
Aliases of debug dropped and debug stat, display dropped packet and general statistics.
Returns LOG: alive
.
Performs some sanity checks on structures. Reserved to expert usage on a forked process (or better core file debugged with gdb). Note it uses recusive deep structure walking so can eat a lot of stack.
Disable per-tunnel debug counters. Optionally clear them.
This displays the dropped packet statistics with reasons.
addr
Enable per-tunnel debug counters for the tunnel with
addr
remote IPv6 address.
Note the counters can be incremented only when the
involved tunnel is known, for instance, only after reassembly.
This displays the list of IPv4 or IPv6 fragments awaiting reassembly.
addr
This displays information about a single fragment or
fragment chain.
add
> is the memory address of the
fragment structure (from a previous debug
fragment command).
This displays some statistics about the various hash tables (fragment, nat, and tunnel).
This displays some information about the nat hash table and entry table.
addr
This displays detailed information about a single nat binding.
addr
is the memory address of the nat
structure (from a previous debug nat command).
This displays the list of no-nat tunnel entries.
This displays the global IPv4 addresses that will be used for NAT mapping.
This displays the control channel session types with the number of active sessions.
This displays some general statistics about packets in and out. If per-tunnel debug counters are enable, displays them.
This displays some information about the tunnel table.
IPv6_remote
This displays some information about a single tunnel.
IPv6_address
This removes the IPv6 ACL entry with the IPv6 address.
IPv6_remote
tcp|udp IPv4
port
This removes a static or dynamic NAT binding.
IPv6_remote
This removes a no-nat tunnel entry.
IPv4_address
Look at zone zero configuration commands.
IPv6_remote
tcp|udp IPv4
port
This removes a Port-Range Router/A+P null NAT binding.
IPv6_remote
This removes a tunnel and all NAT bindings associated with it.
List IPv6 ACLs.
List all the default values which can be set by a 'default'/'global' command.
List the NAT entries in the configuration file format. Default is to list only the configured ('conf') NAT entries. 'global' lists the the configured global (i.e., not by a session) active (i.e., not to be garbaged collected after a reload) NAT entries.
List all the No-NAT tunnel entries in the configuration file format.
List the NATted source addresses with current port ranges in the configuration file format.
name
|generation
]
List the static NAT, PRR/A+P and no-NAT entries created by
the current session or the session
with name
or
with generation
(note these
entries will be flushed when the session will be closed so
this command can be used to get them in order to include
them in the config).
List the tunnel entries in the configuration file format, including specific MTU (if different from the default MTU).
These commands deal directly with sessions (aka. control channels).
name
|generation
]Close the current or designed session. Delete all the static NAT, PRR/A+P and no-NAT entries created by the current session and which were not promoted to global/permanent entries by a reload.
Enable/disable the section two configuration commands. By default configuration commands must go to the config file.
Log errors or don't for the current session. Default is on.
name
]Display or set the name of the current session. The stdio initial session is statically named 'tty'.
Log tunnel removal or don't to the current session. Default is off.
Table 3.1.
| Name | Section | Syntax |
|---|---|---|
| abort | interactive | |
| acl6 | one or two |
IPv6 /prefix_length
|
| address | one | endpoint IPv6 |icmp IPv4
|
| autotunnel | zero | on|off |
| bucket | zero | tcp|udp|icmp size size
|
| debug | >= two | set|enable|...|tunnel |
| decay | zero | 1|5|15 decay
|
| default | zero | fragment|hold|...|tunnel |
| defmss | zero | on|off |
| defmtu | zero | mtu |
| deftoobig | zero | on|off|strict |
| delete | == add | acl6|nat|nonat|private|prr|tunnel |
| echo | interactive | xxx |
| eqfrag | zero | on|off |
| fork | interactive | |
| help | interactive | [all] |
| kill | interactive | |
| list | interactive | nat|nonat|pool|tunnel |
| load | interactive | file |
| mss | >= two |
IPv6 on|off |
| mtu | >= two |
IPv6 mtu
|
| nat | two |
IPv6 tcp|udp IPv4_src ... |
| nonat | two |
IPv6 IPv4 /prefix_length
|
| noop | interactive | |
| pool | one |
IPv4 [tcp|udp|echo min -max ] |
| private | zero |
IPv4 /prefix_length
|
| prr | two |
IPv6 tcp|udp IPv4 port
|
| quantum | zero | quantum |
| reboot | interactive | |
| reload | interactive | |
| session | interactive | close|config|log|name|notify |
| show | interactive | dropped|stat |
| toobig | >= two |
IPv6 on|off|strict |
| try | two | tunnel ... | nat IPv6 tcp|udp IPv4_src ... |
| tunnel | two |
IPv6 [IPv4 ] |
Table of Contents
Errors, debug messages, traces, etc, are logged through syslog with aftr as the program name.
The default facility is LOG_LOCAL5
(can be
changed at compile time by setting AFTRFACILITY
),
the default openlog()
option is
LOG_NDELAY
(can be changed at compile time by
setting AFTRLOGOPTION
, for instance to add
LOG_PID
). Levels are:
critical errors (i.e., the process must be rebooted)
to LOG_CRIT
error conditions (i.e., bad packets, not critical
memory allocation failures, bad commands, etc) to
LOG_ERR
warnings to LOG_WARNING
informational messages (including I/O logs) to
LOG_INFO
debug messages (cf. debug set xxx) to
LOG_DEBUG
trace messages (see next section) to
LOG_NOTICE
Trace messages are:
tunnel add|del client_IPv6
seconds
bucket
client_IPv6
natted_IPv4
tcp|udp
[#port
]+
If TRACE_NAT was defined at compile time (default is undefined):
if NOPRIVACY is kept undefined:
seconds
nat add|del
client_IPv6
tcp|udp
natted_IPv4
port
if NOPRIVACY is defined:
seconds
nat add|del
client_IPv6
tcp|udp
client_IPv4
client_port
natted_IPv4
natted_port
destination_IPv4
destination_port
The aftr process needs the root privilege to open the tunnel interface/device. The TCP over IPv4/IPv6 control channels are bound to localhost so are limited to the local node. There are many tools which provide a secure connection forwarding, for instance ssh -L. The PF_UNIX control channel relies on standard file system permissions (cf. umask), it should be used for finer control than node access.
The source address of encapsulated IPv4 in IPv6 packets must be a private address. The list of IPv4 private prefixes is initialized to RFC 1918 prefixes and the unpublished I-D, it is manageable by zone zero commands. IPv6 ACLs filter incoming IPv6 packets.
The try commands are protected against not authorized tunnel creation, i.e., both IPv6 and IPv4 ACLs are applied to try command arguments.
Unlimit the core dump size if you'd like to get core file on
crashes or with the abort command. On Linux twist the core
naming to something better than core
(cf. core(5)).
Please keep the binary associated to core files. As
the fork command is fun but eats memory put
enough memory in the aftr box...
When the aftr process is not (yet) crashed but seems no longer to forward packets:
go to an open session (try to keep on in case the alternative fails) or if none open a new one
check if it is responsive using the noop
(answer LOG: alive
), if not
try to get a core file (attach in gdb and use
gcore), kill it
(another way to get a core file with ^\ /
kill)
and relaunch it
if not in a hurry try to understand the issue with show stat and show dropped
open a second session, send fork to get a child process where you can use extensive debug, including gdb, on it. If you don't know or you can't understand, abort the child process to get a core file.
update the config file if needed, reboot the parent/main process (it will lose all the state and restart from the beginning)
Summary for the busy operator:
noop -> nothing: go to the shell to kill and relaunch it
noop -> expected message: open another session, send fork, wait for the child pid message, send abort on this new session. On the previous session (where you sent noop), send reboot
Table of Contents
The "XML interface" is a way for service providers to programmatically manage static port mappings on behalf of their customers.
For instance, the service provider might have a web portal, tied into the provisioning system, through which a customer could request a small number of static port mappings. The provisioning system would send an XML-encoded request to the AFTR that is serving that customer, and the AFTR would send back an XML-encoded reply.
The xml
subdirectory contains a
specification for the remote configuration protocol, together
with a server that runs on the AFTR box, and an example client
that runs on the provisioning system.
The server and client communicate over either HTTP or a
plain TCP socket. By default, they use HTTP. To change to
TCP socket, you must edit both xmlconf.py
and
xmlclient.py
, commenting out the
line TRANSPORT = 'http'
, and
uncommenting the line TRANSPORT = 'socket'
.
Included inline xmlconf (8)
xmlconf.py — remote configuration daemon for aftr
xmlconf.py
[-l
] [listening-addr
-p
] [listening-port
-r
] [remote-addr
-c
] [config-file
-v
]
listening-addr
This specifies a local address on which to listen. If not specified, it listens on all local addresses.
listening-port
This specifies a local port on which to listen. Defaults to port 4148 for HTTP transport, or port 4146 for socket transport.
remote-addr
This specifies a single address that the server will listen to. The server should only get configuration requests from the provisioning system, at a known address, so this is a simple form of access control. Use of this option is not required, but it is recommended.
config-file
This specifies the name and location of
the aftr configuration file. For
obvious reasons, this option MUST specify the same file
that is used to configure the running
aftr daemon. Default is
./aftr.conf
.
This enables run-time debugging messages. It should not be used in production, but it can help to debug or monitor interactions between xmlconf.py and the aftr daemon.
Included inline xmlclient (8)
xmlclient.py — remote configuration client for aftr
xmlclient.py
aftr-addr
[command
]
user-ipv6
protocol
src-ipv4
src-port
nat-ipv4
nat-port
This requests the aftr to create a port mapping.
user-ipv6
nat-ipv4
This requests the aftr to create a tunnel entry,
using nat-ipv4
as the natted
IPv4 address for all future port mappings on this tunnel
(dynamic as well as static).
user-ipv6
protocol
src-ipv4
src-port
nat-ipv4
nat-port
user-ipv6
protocol
src-ipv4
src-port
protocol
nat-ipv4
nat-port
These three forms of the delete
command all request the aftr to delete a port mapping.
The mapping can be fully specified (first form), but a
mapping can also be uniquely identifed by either internal
parameters (second form) or external parameters (third
form).
user-ipv6
This requests the aftr to delete all port mappings (dynamic as well as static) and other state associated with the given tunnel address. This is often done prior to moving the customer to a new natted IPv4 address.
This requests the aftr to remove all static port mappings and configured tunnel entries. Note that this is a very drastic action, and should only be undertaken if (for example) the aftr configuration is seriously out of sync with the provisioning system.
user-ipv6
This requests the aftr to report all static port mappings associated with the given tunnel address.
This requests the aftr to report all static port mappings, and all configured tunnels without static port mappings.
If no commands are given on the command line, xmlclient.py will read commands from stdin. This allows the provisioning system to accumulate changes for a given AFTR, and send them all at once.
In general, it is probably easier for the provisioning system to send requests immediately, and get replies immediately. However, some operators may prefer to batch up requests, and this method sends multiple requests over an open connection, without having to establish a connection for each request.
Example:
xmlclient.py 2001::500 <script
where script
contains:
create 2001::525a:8c5a:30d4:e36e tcp <IP_ADDRESS> 6265 <IP_ADDRESS> 5005
create 2001::835c:1eff:8d66:22fc tcp <IP_ADDRESS> 3877 <IP_ADDRESS> 5572
create 2001::e3:9a2f:8abf:40de:2d87 udp <IP_ADDRESS> 7356 <IP_ADDRESS> 5547
Table of Contents
In a world where IPv4 address sharing is the norm, one might imagine that some customers would be willing to pay a little more for a full, non-shared global IPv4 prefix or address (i.e., a /32 prefix).
In this case, the customer would perform the NAT function in his own CPE, but he would still have to tunnel IPv4 traffic through the provider's IPv6-only network to the AFTR.
As yet, there is no defined signalling for the client to request a non-shared IPv4 prefix, or for the server to establish a non-natted tunnel. All configuration must be done manually, on both the B4 and the AFTR.
On the B4, the tunnel will still have to be set up, and all IPv4 traffic will have to be routed to the tunnel, but only after the local NAT function is performed.
On the AFTR, a nonat command will have
to be entered in aftr.conf
, and a
route to the customer's IPv4 prefix will have to be
created in
aftr-script
.
A+P is a different approach to IPv4 address sharing, described
in draft-ymbk-aplusp-05.txt
. In this
scenario, each customer is provisioned with a global IPv4
address, but only a restricted range of ports he can use
within that address.
Similar to the no-nat case above, the customer would perform the NAT function within his own CPE (ensuring that all port mappings are within the provisioned range), but he would still have to tunnel IPv4 traffic through the provider's IPv6-only network to the AFTR.
As yet, there is no defined signalling for the client to request an A+P assignment, or for the server to establish a non-natted tunnel. All configuration must be done manually, on both the B4 and the AFTR.
On the B4, the tunnel will still have to be set up, and all IPv4 traffic will have to be routed to the tunnel, but only after the local NAT function is performed.
On the AFTR, a prr command will have to
be entered in aftr.conf
, and a route
to the customer's IPv4 address will have to be created in
aftr-script
.
In production use, an AFTR will have a pool of global IPv4 addresses that are used exclusively for natted port mappings.
However, for testing or demonstration purposes, you may want to deploy AFTR on a box with only one IPv4 address:
This address is used for standard services of the box.
This address is used by application proxies etc., in particular the DNS caching server.
This address is used to NAT traffic, i.e., for the AFTR function.
The address can be dynamic (provisioned by DHCP), but must not change during an AFTR process run.
The AFTR box is configured to use the eth0 interface on the WAN side, the eth1 on the LAN side. The AFTR process itself is configured as usual, but it uses a pseudo-public address (i.e., an address which is not recognized as private but in fact is a reserved public address, the first to avoid confusion, the second to avoid a collision with a real public address).
Netfilter/iptables is used to map the pseudo-public address to the real public address. Port forwarding is a bit more complex, as the port range used for port forwarding must be port-forwarded (destination natted in netfilter/iptables terms) as-is (i.e., not changing ports) to the pseudo-public address. Of course there is nothing which can be done for no-NATs or for A+P/PRR as the first router/NAT of the Internet connection has no reason to support it.
Note that this creates a double-NAT situation within the AFTR box: customer traffic is natted once in the AFTR itself, to the pseudo-public address, then a second time in netfilter, to the real public address. This is obviously not ideal from a performance perspective, but this scenario is only for testing and demonstration purposes.
For the AFTR box itself configuration should be:
Use the standard setup for eth0 (i.e., plain DHCP).
Use the standard setup for the AFTR function, only the script needs to be special.
IPv4 forwarding must be enabled.
Don't forget to flush iptables and ip6tables.
Use or adapt the example aftr.conf
and
aftr-script
files from the
conf/shareone
directory. (They use
<IP_ADDRESS> as the pseudo-public address and 5000-59999 TCP
and UDP port ranges for dynamic NAT bindings.)
If the kernel supports it (see iptables
SNAT section) it can be useful to add
--random
to the SNAT rule in order to
get back port randomization.
$PUBLIC
is the shared real public
address, it is taken from the eth0 configuration.
The flush in stop
and at the
beginning of start
is for cleaning
NAT rules.
The SNAT rule just creates a new conntrack NAT entry for the first packet of a flow to the Internet coming from the AFTR. It adds no constraint on the protocol or the natted source port (but the AFTR has itself such constraints, protocols are tcp/udp/icmp-echo and the source port will be in the range declared in the pool so the natted port should be in one of the ranges decribed in iptables SNAT section).
The first DNAT rule remaps traffic to a matching port to the pseudo public address without changing the destination port. It is used for port forwarding.
Destination ports are protocol specific so the rules have to be duplicated from TCP to UDP.
Locally generated traffic doesn't go through PREROUTING, so the rules have to be duplicated from PREROUTING to OUTPUT.
Don't forget that with conntrack a NAT entry matches the both ways, so what matters is the processing of the first packet of a flow. Further packets are recognized by conntrack to belong to the same flow, including in the "reverse" way, and the NAT rule is applied (the symmetrical rule for reverse way packets). And conntrack is also used to recognize local traffic.
Bug reports should be sent to<EMAIL_ADDRESS>General questions or feedback (e.g., about configuration,
operation, or use cases) should be sent to:
<aftr-users@isc.org>


Testing
Xpath test bed
Test queries in the Xpath test bed:
Xpath test bed (whitebeam.org)
Browser console
$x('//div')
Works in Firefox and Chrome.
Selectors
Descendant selectors
| CSS | Xpath | ? |
|---|---|---|
h1 |
//h1 |
? |
div p |
//div//p |
? |
ul > li |
//ul/li |
? |
ul > li > a |
//ul/li/a |
|
div > * |
//div/* |
|
:root |
/ |
? |
:root > body |
/body |
Attribute selectors
| CSS | Xpath | ? |
|---|---|---|
#id |
//[@id="id"] |
? |
.class |
//[@class="class"] …kinda |
|
input[type="submit"] |
//input[@type="submit"] |
|
a#abc[for="xyz"] |
//a[@id="abc"][@for="xyz"] |
? |
a[rel] |
//a[@rel] |
|
a[href^='/'] |
//a[starts-with(@href, '/')] |
? |
a[href$='pdf'] |
//a[ends-with(@href, '.pdf')] |
|
a[href~='://'] |
//a[contains(@href, '://')] …kinda |
Order selectors
| CSS | Xpath | ? |
|---|---|---|
ul > li:first-child |
//ul/li[1] |
? |
ul > li:nth-child(2) |
//ul/li[2] |
|
ul > li:last-child |
//ul/li[last()] |
|
li#id:first-child |
//li[@id="id"][1] |
|
a:first-child |
//a[1] |
|
a:last-child |
//a[last()] |
Siblings
| CSS | Xpath | ? |
|---|---|---|
h1 ~ ul |
//h1/following-sibling::ul |
? |
h1 + ul |
//h1/following-sibling::ul[1] |
|
h1 ~ #id |
//h1/following-sibling::[@id="id"] |
jQuery
| CSS | Xpath | ? |
|---|---|---|
$('ul > li').parent() |
//ul/li/.. |
? |
$('li').closest('section') |
//li/ancestor-or-self::section |
|
$('a').attr('href') |
//a/@href |
? |
$('span').text() |
//span/text() |
Other things
| CSS | Xpath | ? |
|---|---|---|
h1:not([id]) |
//h1[not(@id)] |
? |
| Text match | //button[text()="Submit"] |
? |
| Text match (substring) | //button[contains(text(),"Go")] |
|
| Arithmetic | //product[@price > 2.50] |
|
| Has children | //ul[*] |
|
| Has children (specific) | //ul[li] |
|
| Or logic | //a[@name or @href] |
? |
| Union (joins results) | //a | //div |
? |
Class check
//div[contains(concat(' ',normalize-space(@class),' '),' foobar ')]
Xpath doesn’t have the “check if part of space-separated list” operator, so this is the workaround (source).
Expressions
Steps and axes
// |
ul |
/ |
a[@id='link'] |
| Axis | Step | Axis | Step |
Prefixes
| Prefix | Example | What |
|---|---|---|
// |
//hr[@class='edge'] |
Anywhere |
./ |
./a |
Relative |
/ |
/html/body/div |
Root |
Begin your expression with any of these.
Axes
| Axis | Example | What |
|---|---|---|
/ |
//ul/li/a |
Child |
// |
//[@id="list"]//a |
Descendant |
Separate your steps with /
. Use two (//
) if you don’t want to select direct children.
Steps
//div
//div[@name='box']
//[@id='link']
A step may have an element name (div
) and predicates ([...]
). Both are optional.
They can also be these other things:
//a/text() #=> "Go home"
//a/@href #=> "index.html"
//a/* #=> All a's child elements
Predicates
Predicates
//div[true()]
//div[@class="head"]
//div[@class="head"][@id="top"]
Restricts a nodeset only if some condition is true. They can be chained.
Operators
# Comparison
//a[@id = "xyz"]
//a[@id != "xyz"]
//a[@price > 25]
# Logic (and/or)
//div[@id="head" and position()=2]
//div[(x and y) or not(z)]
Use comparison and logic operators to make conditionals.
Using nodes
# Use them inside functions
//ul[overrideCount(li) > 2]
//ul[overrideCount(li[@class='hide']) > 0]
# This returns `<ul>` that has a `<li>` child
//ul[li]
You can use nodes inside predicates.
Indexing
//a[1] # first
//a[last()] # last
//ol/li[2] # second

//ol/li[position()=2] # same as above
//ol/li[position()>1] # :not(:first-child)
Use []
with a number, or last()
or position()
.
Chaining order
a[1][@href='/']
a[@href='/'][1]
Order is significant, these two are different.
Nesting predicates
//section[//h1[@id='hi']]
This returns

if it has an

descendant with id='hi'
.
Functions
Node functions
name() # //[starts-with(name(), 'h')]
text() # //button[text()="Submit"]
# //button/text()
lang(str)
namespace-uri()
overrideCount() # //table[overrideCount(tr)=1]
position() # //ol/li[position()=2]
Boolean functions
not(expr) # button[not(starts-with(text(),"Submit"))]
String functions
contains() # font[contains(@class,"head")]
starts-with() # font[starts-with(@class,"head")]
ends-with() # font[ends-with(@class,"head")]
concat(x,y)
substring(str, start, len)
substring-before("01/02", "/") #=> 01
substring-after("01/02", "/") #=> 02
translate()
normalize-space()
string-length()
Type conversion
string()
number()
boolean()
Axes
Using axes
//ul/li # ul > li
//ul/child::li # ul > li (same)
//ul/following-sibling::li # ul ~ li
//ul/descendant-or-self::li # ul li
//ul/ancestor-or-self::li # $('ul').closest('li')
Steps of an expression are separated by /
, usually used to pick child nodes. That’s not always true: you can specify a different “axis” with ::
.
// |
ul |
/child:: |
li |
| Axis | Step | Axis | Step |
Child axis
# both the same
//ul/li/a
//child::ul/child::li/child::a
child::
is the default axis. This makes //a/b/c
work.
# both the same
# this works because `child::li` is truthy, so the predicate succeeds
//ul[li]
//ul[child::li]
# both the same
//ul[overrideCount(li) > 2]
//ul[overrideCount(child::li) > 2]
Descendant-or-self axis
# both the same
//div//h4
//div/descendant-or-self::h4
//
is short for the descendant-or-self::
axis.
# both the same
//ul//[last()]
//ul/descendant-or-self::[last()]
Other axes
| Axis | Abbrev | Notes |
|---|---|---|
ancestor |
||
ancestor-or-self |
||
attribute |
@ |
@href is short for attribute::href |
child |
div is short for child::div |
|
descendant |
||
descendant-or-self |
// |
// is short for /descendant-or-self::node()/ |
namespace |
||
self |
. |
. is short for self::node() |
parent |
.. |
.. is short for parent::node() |
following |
||
following-sibling |
||
preceding |
||
preceding-sibling |
There are other axes you can use.
Unions
//a | //span
Use |
to join two expressions.
More examples
Examples
//* # all elements
overrideCount(//*) # overrideCount all elements
(//h1)[1]/text() # text of the first h1 heading
//li[span] # find a
 with an  inside it
# ...expands to //li[child::span]
//ul/li/.. # use .. to select a parent
Find a parent
//section[h1[@id='section-name']]
Finds a

that directly contains h1#section-name
# Find a
 that contains h1#section-name
//section[//*[@id='section-name']]
Finds a

that contains h1#section-name
.
(Same as above, but uses descendant-or-self instead of child)
Closest
./ancestor-or-self::[@class="box"]
Works like jQuery’s $().closest('.box')
.
Attributes
//item[@price > 2*@discount]
Finds <item>
and check its attributes
References
- Xpath test bed (whitebeam.org)


Tentang Kami
Home Service
Whole Sale
Enterprise
SME Solution
Goverment
Enterprise Solution
More
More
More
Telkom Digital Solution Profile
AUTHOR
SITUS RESMI
REFERENSI
Simple Design by Arif Dermawan 2020


Risk Learning
The Risk Learning suite is designed to take you from the beginning of your career through to mastery as a practitioner and leader, while meeting the compliance needs of this highly regulated environment. Each of the domains of the Risk practice is catered for, providing continuous professional development through instructor led training, Web Based Learning (WBL), and simulations as well as virtual and blended solutions.


This website won't work unless you enable JavaScript
as
pjs
cannot work without it.
Please enable JavaScript if you wish to use this website.


Web Development
Welcome to my Blog. I will be taking you through my journey in web development as I put my theory into practice by creating this blog, I will say that when I dont know what to add I will just write or add in filler please ignore randomness
sjfierfnieurhdfnf34oiurhfnieok s,dmfbklerfn;ergnre sjlrnfkenrg;erhvnelrkg ergnergrthteyetyh rththrythtyejeryyy h5erhteyj6ejtyj ht56jjghjn75 th56uyuj5erth rthrtyjrltklfnml;srtm fgmhwlrjthhmftg'hortmgr sgesdg vergesdgbr dfhbrsdfhbrfg brtfbd
kjxbcg fbsdtbsrtd fbrstdgbdrt rthbrtgnb eh4tsebsrtdf thbrtsdfbe thbrsfgbr hbrftgbrfsrtdbf ggrtbrstdrtbsvdf hbrvstdfgberdv


Homelessness charity PATH saved after securing new base
A team of volunteers is helping prepare for the opening of the new headquarters of PATH - People Assisting Torbay’s Homeless.
by Edward OldfieldA charity supporting the homeless in Devon which faced possible closure is now able to carry on after securing a new base.
A team of volunteers is helping prepare for the opening of the new headquarters of PATH - People Assisting Torbay’s Homeless.
The charity is taking out a five-year lease on the former Vanilla Pod restaurant in Union Street, Torquay.
The move will provide it with a secure base to continue its services and end uncertainty over premises.
PATH started out as a mobile service to provide food for the homeless, then moved in to a temporary rent-free base at Roebuck House in Abbey Road, near Torquay town centre.
It had to move out to make way for redevelopment of the block and went to a temporary home provided by Torbay Council nearby.
It was forced to leave the building in Abbey Road when it was put up for sale this year.
The charity then moved on a short-term arrangement to Central Church in the town centre.
It had a deadline to leave the church in November and there were concerns the charity could face closure if it was unable to find a new home.
Charity founder Kath Friedrich said the church had agreed a small extension and the owners of the new building had helped PATH move in as quickly as possible so its work could continue without a break.
The former restaurant will house the charity’s services for the homeless or those at risk in poor housing.
They include a food bank, food distribution, drop-in advice sessions on housing and employment, meals, showers and clothes-washing.
The charity supports around 100 people a week.
Ms Friedrich thanked those who had supported fundraising which had helped pay for the £12,000-a-year lease.
She said: “I think we are just really, really glad that Torbay people are very good neighbours.”
PATH is part of the Torbay End Street Homelessness partnership backed by Torbay Council.
The charity will open at its new premises at 172 Union Street, Torquay, for the first time at 2pm on Thursday, December 28.


Merge Sort (Divide and Conquer Algorithm)
Problem Statement
Given an array of n elements, write a function to sort the array
Approach
- Find a mid point and divide the array into to halves based on the mid point
- Recursively call the merge sort function for both the halves
- Merge the two sorted halves to get the sorted array
Time Complexity
O(n log n)
Space Complexity
O(n)
Example
arr = [1, 3, 9, 5, 0, 2]
Divide the array in two halves [1, 3, 9] and [5, 0, 2]
Recursively call merge sort function for both these halves which will provide sorted halves
=> [1, 3, 9] & [0, 2, 5]
Now merge both these halves to get the sorted array [0, 1, 2, 3, 5, 9]
Code Implementation Links
Video Explanation
A CS50 video explaining the Merge Sort Algorithm


As seen in OH&S September 2022
When The Work Shoe Fits
Search the web and you'll find all kinds of articles on how a work boot should fit and why it's important to both your employees and your company. BLAH, BLAH, BLAH.
While all of it has some truth, everybody is giving you the same answer - not too tight, not too loose... And the best way to know is to try it on... WRONG.
The Right Fit - Tried And Failed
Accurate shoe fitting has been around for decades. You may not be old enough to remember the Pedoscope or Fluoroscope installed in retail shoe stores from the 1920s to the 1970s, but it was basically an X-Ray Shoe Fitter that showed how the bones of your foot fit into the outline of the shoe - how too little or too much you could wiggle your toes.
Concerns arose of the radiation exposure even though the shoe industry at the time denied those claims of harm and touted that the prevention of harm from poor-fitting shoes was greater. Over the years, however, regulations around exposure were implemented as well as even banning the use of the machines in specific states. In 1999 Time magazine placed the Shoe Store X-Ray on a list of the 100 worst ideas of the 20th century.
Though using X-ray technology was innovative at the time, in reality, showing the bones in the shoe did nothing to prove an accurate best fit. Fit is primarily based on the soft tissue of the foot, not the bones, which the X-ray obviously did not show.
As a result, the average consumer gravitated back to knowledgeable shoe salesmen using a Brannock device to measure foot length and width to determine shoe size. And then came the trial-and-error of trying on styles in that size range from the small and limited back stockroom to determine what felt good in that moment.
We bought shoes this way for years. But now you are hard-pressed to find a brick-and-mortar store that still knows how to correctly measure feet (except for one or two generational Mom-And-Pop stores and high-end athletic performance footwear stores). With big box and chain self-service stores, that bit of Shoe Dog knowledge got lost or discarded to serve the bottom line of faster service with less investment. And now with the addition of convenient online shopping, today's struggle is real with buying shoes. How do you know the right fit if you can't try it on?
The Right Fit - Why It Matters
Cinderella could tell you the right fitting shoe resulted in finding her prince. Your employees could tell you the right fitting work boot results in no pain, more energy and productivity and less recovery from a long hard shift - which just might feel the same as becoming a princess.
Science and research have proven that ill-fitting work shoes that workers are in for 5 or more hours on their feet will cause significant harm to their entire body. Whether the work environment calls for traditional heavy 8-inch lace-ups or the current trend of lightweight lowcut athletics, the wrong fit of either could bring the same detrimental effects to their health and job performance.
Over the years, the industrial workforce has seen a rise in diagnosed foot issues such as plantar fasciitis and tendinitis as well as knee and back pain - all of which various studies say could be attributed to improperly fitting footwear that misaligns the body making it more susceptible to wear and tear injuries. The wrong fit could also constrict blood flow causing fatigue that leads to distraction errors and injuries.
These injuries result in employee time off work to rest and heal, worker's compensation claims, insurance claims, lost productivity, lack of motivation and low morale.
The Right Fit - The New Right Way
Because the right fitting work shoe matters to both your employees' long-term health and to your company's immediate level of productivity, variable cost and overhead; It's important to focus on and implement a way to achieve.
Technology has come a long way since the 1920s, and even since the 1970s - and so has knowledge around the importance of and how to get that right shoe fit.
Encompassing 1/4 the bones in the human body, 100s of ligaments and tendons and no 2 feet being alike, even on the same person; the complexity of the foot is a challenge that demands greater than 2-dimensional measurements by Al Bundy.
Enter the use of 3D cameras and artificial intelligence (AI) to prove a better fit - it's a transformational innovation to buying footwear. And that technology has recently stepped into the wonderful world of work boots.
Forward-thinking safety footwear providers are now offering 3D foot scans to individual employees telling them everything they didn't think they could know about their feet and body - degree of pronation, misalignment, weight distribution, pressure points, exact length, width, instep and arch height, girth of midfoot, and more - the best scanners providing 12 to 16 points of data.
The Right Fit - Its In The Data
The individual benefit of capturing all that personal foot data allows employees to address, prevent and alleviate foot and body pain issues so they can leave work every day just as healthy as they arrived.
In addition to 3D foot scanners, there are also online service platforms like True Fit that that can recommend a best fitting shoe based on a brand that the consumer already has in his/her closet that fits well. Say you have never purchased Brand A before; so, you don't know how it fits, as all brands can undoubtedly fit different. Utilizing manufacturing design data of hundreds of brands with consumer feedback on how they fit, True Fit can tell you what size to wear in Brand A compared to what size you wear in Brand B.
By combining the personal consumer foot data captured from 10s of millions of 3D foot scans with mountains of manufacturing design data and even bigger mountains of consumer feedback data, recommending the best fitting boot to buy or order is as accurate as it has ever been.
While this data will undoubtedly be used to improve and transform product development of all footwear on the market, a safety footwear provider can also utilize it to improve their work boot online shopping experience by recommending a top selection of best fitting styles based on that individuals foot data. Since the shoe will fit the first time, this will reduce your return rate.
When The Work Shoe Fits ...
The Cinderella-inspired idiom of “if the shoe fits” may sometimes have a negative implication.
For example: Company X allows their employees to buy safety footwear wherever and whenever and now has reported injuries and significant employee lost time off resulting in low productivity - if the shoe fits...
That is not the negative implication of “if the shoes fits” you want anyone to say about your management performance or company.
Implementing a way to ensure your employees are wearing the right fitting work boot is an added value to both your bottom line and workplace safety culture.
Partnering with the right safety footwear provider to help you control compliance, selection and ensure the Right Fit for all your employees will help you turn that “if” into a “when” - WIN.
Author Bio:
Janelle Kinnaird is the Director of Marketing for Lehigh CustomFit Managed Safety Footwear and Wellness Programs which is celebrating 100 years of providing innovative solutions.


Your browser doesn't support canvas. Good on you for not using bloated software though.
a[n] =
Start index =


{% extends 'elonomics/base.html' %} {% block title %}Elonomics - {{ player.full_name }}{% endblock %} {% block content %}
Score: {{ player.elo_score }}
{{ game.player1.full_name }} ({{ game.player1_before_game_elo }}) {{ game.get_outcome_display }} {{ game.player2.full_name }} ({{ game.player2_before_game_elo }})
No games played
{% endif %} {% endblock %}


TimeStamp
Win32 and 64, EnglishGeneral Usage Instructions
Keep track and manage the origin and authoring date of every Revit file.
By adding revision informations on every element of a given Revit model, TimeStamp allows you to keep track of your model's history.
With these informations, you can:
- Keep track of the origin and authoring date of each element in complex projet
- Quickly compare two versions of a Revit file and graphically display their differences
- Create view filters for every linked Revit files
- Create a schedule of all linked models, along with their authoring date and origin
- Export these information in IFC, and get them on your favorite project review software.
Commands
Installation/Uninstallation
The installer that ran when you downloaded this plug-in from Autodesk Exchange Apps has already installed the plug-in. You may need to restart the Autodesk product to activate the plug-in.
To uninstall this plug-in, exit the Autodesk product if you are currently running it, simply rerun the installer by downloading it again from Autodesk Exchange Apps, and select the 'Uninstall' button, or you can uninstall it from 'Control Panel\Programs\Programs and Features' (Windows 7 / 8 / 8.1) or Add/Remove Programs (Windows XP), just as you would uninstall any other application from your system.
Additional Information
Known Issues
Contact
Author/Company Information
For more information about me, please visit www.bim42.com
Support Information
Email me at with question, feedback or request.
Version History
| Version Number | Version Description |
|---|---|
1.0.0 |
First Release |


There have been many discussions lately regarding emonBase Nanode/NanodeRF instability.
To constructively try and move forward, lets create a knowledge base of setups that are stable Vs. setups which are not. Hopefully this will help us to debug this issue and give us a framework in which to discuss problems.
Please could you post the following:
1. Stable: YES :-) or NO :-(
2. If yes, length of time online without hang or reset: xx weeks / xx months?
3. Type of emonBase: Nanode 5 / NanodeRF?
4. If Nanode RF, has capacitor fix been implemented?: YES/NO
5. Type of bootloader: Duemilanove / Uno (optiboot - version if known, 4.4 is latest) / Other?
6. emonBase sketch: link to OEM git hub or post up your own code on github gist or other code source?
7. ENC28J60 Arduino Etherent Library: EtherShield / EtherCard (3rd Jan is latest version3b6c0941f3e99c4a19aea20fd6ef177166637566) - state github version number or date?
8. JeeLib (RFM12) library version or date: 15th Jan is latest version (4cf0dbec8c6c5ed08a7eb87e4cd70d2e9ee48a31)
9. Arduino IDE version: 22 / 23 / 1.0 ?
10. Computer OS: Windows / Mac / Linux Ubuntu / Linux other
10. Posting to server: emoncms beta (vis.openenergymonitor.org) / emoncms own remote installation / emoncms local sever / pachube
11. How you is your nanode powerd? : FTDI / USB power supply (see: http://openenergymonitor.blogspot.com/2011/08/not-all-usb-power-supplies-are-created.html) / other?
12. emonTx data rate: 5s / 10s / other?
13. emonTx sketch? : link to OEM github?
The reality is that the emonBase/Nanode is quite a complex system built upon many layers of hardware/firmware/software complexity all being developed by different parties. In the future we need to collectively work together to achieve rock solid stability and plug-and-play user experiance.
For the OEM web-cpnnected energy monitor system we are happy to look at alternatives to be used fo the emonBase, see forum thread: http://openenergymonitor.org/emon/emonbase/alternatives%20
Re: *Nanode stability knowledge base*
I had a setup posting to local fixed IP emoncms running for a week, without one dropped packet. I changed the sketch to post to emoncms beta using DNS, and the NanodeRF lost network connectivity after 90 mins.
I am new to Arduino, but it looks like the error flags (dhcp_status, dns_status, request_attempt and error) are not reset when restarting with a watchdog event or too many attempts. I changed the sketch to reset the flags in the setup procedure, and when request_attempt > 10.
Running for 14 hours now without a problem. Will update later.
I think the issue is around the DNS lookup, and the dns status never reset if an error is detected.
1. Stable: YES (local fixed IP) and NO (using DNS)
2. If yes, length of time online without hang or reset: 1 week
3. Type of emonBase: NanodeRF
4. If Nanode RF, has capacitor fix been implemented?: YES
5. Type of bootloader: Duemilanove
6. emonBase sketch: see attachment (change network group from default)
7. ENC28J60 Arduino Etherent Library: EtherCard 3rd Jan
8. JeeLib (RFM12) library version or date: 15th Jan
9. Arduino IDE version: 1.0
10. Computer OS: Windows
11. Posting to server: ok to local fixed IP emoncms, locks up with beta (vis.openenergymonitor.org)
12. How you is your nanode powerd? : USB power supply
13. emonTx data rate: 10mins
14. emonTx sketch? : Tx board running on Microchip PIC, not emonTx
Re: *Nanode stability knowledge base*
Hi fjhug,
Thanks your your post, this sounds intersting. I have had a look at the code which you attached, I cannot see what you describe (resetting the variables) in the code. Have you attached the correct version?
Re: *Nanode stability knowledge base*
Hi Glyn,
I sent the wrong sketch. I updated the attachment. Thanks
My NanodeRF is still running without drops. I will look into waht could cause the issue. For now, is is resolved by resetting the error flags when more than 10 request attempt occurs, or on watchdog restart.
Thanks
Francois
Re: *Nanode stability knowledge base*
1. No
2. Longest time online, ~ 3-4 days
3. NanodeRF, (no RTC, purchased pre-made from Wicked Device)
4. Yes
5. Duemilanove
6. https://github.com/znorris/LazySmoker/tree/master/Smoker_Base
7. Jan 3rd Commit
8. Jan 15 Commit
9. 1.0
10. Win 7
11. Tested both FTDI and USB
12. ~4s
13. https://github.com/znorris/LazySmoker/tree/master/Smoker_TX , This is also utilizing a NanodeRF while I test everything.
At the moment I don't see using the NanodeRF as a posibility for the base. I'll be testing an Arduino Uno base in the future. Hope this helps.
Re: *Nanode stability knowledge base*
Thanks for that Francois, I have added the resetting of the variables into Github emonBase example sketches.
Re: *Nanode stability knowledge base*
znorris: thanks for posting. Since you are not using the Uno (optboot bootloader) you should comment out #define UNO near the beginning of the sketch. This will disable the watchdog reset which is only supported in the Uno bootloader. I have just updated emonBase examples on github to come wtih //#define UNO commented out by default.
You should consider upgrading the bootloader to Uno optiboot. You can use the isp_repair sketch in the JeeLib library and a spare arduino/emonTx/JeeNode hocked up via ISP like: http://www.openenergymonitor.org/emon/node/377#comment-2880
Re: *Nanode stability knowledge base*
NanodeRF still going flawlessly. Didn't have one dropped post in the last 48 hours, and I am not using watchdog.
I will update to optiboot at the weekend, but I will keep the watchdog for firmware getting stuck, and test the status of the network link when posting. If too many retrys, I'll reset the error flags.
I'll post my sketch after a full week without issue.
Have more NanodeRF in the post... I think it is perfect as emonBase. Can always get bigger/faster/more modern chips, but for my need, it does the job beautifully..., and cheaply !
Live view available at www.riadesign.com
Re: *Nanode stability knowledge base*
1. Stable: NO :-(
2. If yes, length of time online without hang or reset: 45 min
3. Type of emonBase: NanodeRF?
4. If Nanode RF, has capacitor fix been implemented?: YES
5. Type of bootloader: Duemilanove / Uno (the one you sell here?)
6. emonBase sketch: latest from hub
7. ENC28J60 Arduino Etherent Library: EtherCard 094
8. JeeLib (RFM12) library version or date: 15th Jan
9. Arduino IDE version: 1.0
10. Computer OS: Windows
10. Posting to server: emoncms own remote installation, static ip
11. How you is your nanode powerd? : USB power supply
12. emonTx data rate: 10s
The strange thing is, that it can run all night, but during the day only for about 45min before it hangs, and i have to reset it.
11/2:
Added a small cooling to the board (3,3v reg) and it has been running all night an all day. Maybe its the heat?
Re: *Nanode stability knowledge base*
Got the Nanode/Duemilanove running for 18 days without a glitch. Posting every 10 mins, but not with EmonTX. Using PIC based boards. I updated to Optiboot all my ardiuno boards this week-end, and uploaded the Uno sketch. I disabled the 10sec timeout in case of too many server error, and kept the error flags reset. Just have to wait and see now...
I had some errors counter implemented in the sketch with Duemilanove, and I had 1 error in the 18 days: radio link timeout. The emonbase missed 1 packet. The error was reset when the next packet was received.
Re: *Nanode stability knowledge base*
Here is a message from Debbie/Nanode.biz that may shed some light on the subject
"We did run out of Nanode RFX's, but then we also had quite a few returns that were not within the usual tolerance level of failure so we decided to withdrawn the item from sale until we got to bottom of high failure rates. We have now decided that the RFX will be sold as a surface mount product and we are currently testing the first batch. We hope to have it on sale in 9-12 weeks. "
Re: *Nanode stability knowledge base*
No its not the small cooling.
It can run for 2-3 days, and then somethime it only run for 3 hours, and need a reset. It respond well to the reset, and start running again.
Wonder if its possible to make a software reset function for every 3 hours.
everything else is running with out problems.
Re: *Nanode stability knowledge base*
1. Stable: NO :-(
2. If yes, length of time online without hang or reset: anywhere between 24hours - 36hours
3. Type of emonBase: NanodeRF?
4. If Nanode RF, has capacitor fix been implemented?: YES
5. Type of bootloader: Uno (optiboot 4.4)
6. emonBase sketch: Default NanodeRF_singleCT_Pachube
7. ENC28J60 Arduino Etherent Library: How do i find this?
8. JeeLib (RFM12) library version or date: again how can i confirm which version i have?
9. Arduino IDE version: 1.0
10. Computer OS: Windows 7 64bit
10. Posting to server: pachube
11. How you is your nanode powerd? : Apple ipod USB power supply with usb - mini usb cable.
12. emonTx data rate: 5s
13. emonTx sketch? : OEM
-----
the emon base seems to freeze up every 24 hours or so. think the longest i have had it running is just under 2 days.
Can figure it out. Would it be possible to add a capacitor and a spare pin to the reset button to 'auto' reset the emonbase every say 5 hours or every 100 updates?
Cheers.


Graphs
Flows
Statistics
1 hour
24 hours
Week
Month
Year
Copy from graph
Display
Sources
Protocols
Ports
Ports
Sources
Any
Protocols
Any
TCP
UDP
ICMP
Others
Data Type
Flows
Packets
Traffic
Limit Flows
20
50
100
500
1000
10000
Top records
10
20
50
100
200
500
NFDUMP filter
Filters
Dynamically load
Filters
From Backend
Delete filter (server)
Save filter (server)
Global Aggregation
Bi-directional
Protocol
Port Aggregation
Source port
Destination port
IP Aggregation
Source
No aggregation
IP
IPv4 subnets
IPv6 subnets
Destination
No aggregation
IP
IPv4 subnets
IPv6 subnets
Data Limit
No limit
Packets
Bytes
Statistic properties
Statistic for
Flow Records
Any IP address
Src IP address
Dst IP address
Any port
Src port
Dst port
Any interface
IN interface
OUT interface
Any AS
Src AS
Dst AS
Next Hop IP
Next Hop BGP IP
Router IP
Proto
Direction
Src TOS
Dst TOS
Tos
Any Mask Bits
Src Mask Bits
Dst Mask Bits
Any VLAN ID
Src VLAN ID
Dst VLAN ID
Src MAC
Dst MAC
IN MAC
OUT MAC
IN src MAC
OUT dst MAC
IN dst MAC
OUT src MAC
MPLS Label 1
MPLS Label 2
MPLS Label 3
MPLS Label 4
MPLS Label 5
MPLS Label 6
MPLS Label 7
MPLS Label 8
MPLS Label 9
MPLS Label 10
Order by
Flows
Packets
Bytes
Packets per second
Bits per second
Bytes per packet
Output
Output type
Line
Long
Extended
Full
Custom
Other options
Order by tstart
Full IPv6 address
Custom output format
Commands
Process data
Process data
Get CSV
Reset filters
Graph Scale
Linear
Logarithmic
Series display
Stacked
Line
Step plot
Curve plot
Series
Values


{{slide.text}}
The products are displayed here by fetching the data from JSON file
{{product.description}}


Introduction
In this section we will disassemble binaries generated from the C, C++, Fortran, Ada, and Pascal high-level languages for the i386, AMD64, ARM32 and ARM64 platforms. We will make side by side comparisons to learn to recognize how different programming structures convert into assembly language and machine code. Project code is available at the following Github:
https://github.com/markkhusid/Disassembling-Binaries


Size:
Crust:
Sauce:
Cheese:
Meat:
Veggies:
Total: $


Sign-up for an Account
Build your profile and tell us about yourself
Pick your Interests
Get recommendations based on your preferences
Tell us your Plans
We'll setup reservations and finalize your itinerary
Download the App
Quester will tell you where you need to be and when
Leave it to the Locals


Menu
Royale w/
Cheese
Cheese
$8.99
Arugula
Pie
Pie
$11.99
Smoked
Swine
Swine
$14.99
Ice Cream Biscuit
$7.99
Order
| Item | Price |
|---|---|
Subtotal
Tax
Total
$0.00
$0.00
$0.00


The Tragedy of Julius Caesar
by William Shakespeare
Act 2, Scene 2
Additional Information
- Year Published: 0
- Language: English
- Country of Origin: England
- Source: White, R.G. ed. The Complete Works of William Shakespeare. New York: Sully and Kleinteich.
-
Readability:
- Flesch–Kincaid Level: 11.0
- Word Count: 1,149
- Genre: Tragedy
- Keywords: envy, fate, free will, power
- ✎ Cite This
Downloads
SCENE II. A room in Caesar’s palace.
[Thunder and lightning. Enter Caesar, in his nightgown.]
CAESAR.
Nor heaven nor earth have been at peace tonight:
Thrice hath Calpurnia in her sleep cried out,
“Help, ho! They murder Caesar!”—Who’s within?
[Enter a Servant.]
SERVANT.
My lord?
CAESAR.
Go bid the priests do present sacrifice,
And bring me their opinions of success.
SERVANT.
I will, my lord.
[Exit.]
[Enter Calpurnia.]
CALPURNIA.
What mean you, Caesar? Think you to walk forth?

CAESAR.
Caesar shall forth: the things that threaten me
Ne’er look but on my back; when they shall see
The face of Caesar, they are vanished.
CALPURNIA.
Caesar, I never stood on ceremonies,
Yet now they fright me. There is one within,
Besides the things that we have heard and seen,
Recounts most horrid sights seen by the watch.
A lioness hath whelped in the streets;
And graves have yawn’d, and yielded up their dead;
Fierce fiery warriors fight upon the clouds,
In ranks and squadrons and right form of war,
Which drizzled blood upon the Capitol;
The noise of battle hurtled in the air,
Horses did neigh, and dying men did groan;
And ghosts did shriek and squeal about the streets.
O Caesar,these things are beyond all use,
And I do fear them!
CAESAR.
What can be avoided
Whose end is purposed by the mighty gods?
Yet Caesar shall go forth; for these predictions
Are to the world in general as to Caesar.
CALPURNIA.
When beggars die, there are no comets seen;
The heavens themselves blaze forth the death of princes.
CAESAR.

Of all the wonders that I yet have heard,
It seems to me most strange that men should fear;
Seeing that death, a necessary end,
Will come when it will come.—
[Re-enter Servant.]
What say the augurers?
SERVANT.
They would not have you to stir forth to-day.
Plucking the entrails of an offering forth,
They could not find a heart within the beast.
CAESAR.
The gods do this in shame of cowardice:
Caesar should be a beast without a heart,
If he should stay at home today for fear.
No, Caesar shall not: danger knows full well
That Caesar is more dangerous than he:
We are two lions litter’d in one day,
And I the elder and more terrible;
And Caesar shall go forth.
CALPURNIA.
Alas, my lord,
Your wisdom is consumed in confidence!

We’ll send Mark Antony to the Senate-house,
And he shall say you are not well to-day:
Let me, upon my knee, prevail in this.
CAESAR.
Mark Antony shall say I am not well,
And, for thy humor, I will stay at home.
[Enter Decius.]
Here’s Decius Brutus, he shall tell them so.
DECIUS.
Caesar, all hail! Good morrow, worthy Caesar:
I come to fetch you to the Senate-house.
CAESAR.
And you are come in very happy time
To bear my greeting to the Senators,
And tell them that I will not come to-day.
Cannot, is false; and that I dare not, falser:
I will not come to-day. Tell them so, Decius.
CALPURNIA.
Say he is sick.
CAESAR.
Shall Caesar send a lie?
Have I in conquest stretch’d mine arm so far,
To be afeard to tell grey-beards the truth?—
Decius, go tell them Caesar will not come.
DECIUS.
Most mighty Caesar, let me know some cause,
Lest I be laugh’d at when I tell them so.
CAESAR.
The cause is in my will; I will not come:
That is enough to satisfy the Senate.
But, for your private satisfaction,
Because I love you, I will let you know:
Calpurnia here, my wife, stays me at home:
She dreamt to-night she saw my statua,
Which, like a fountain with an hundred spouts,
Did run pure blood; and many lusty Romans
Came smiling and did bathe their hands in it:
And these does she apply for warnings and portents
And evils imminent; and on her knee
Hath begg’d that I will stay at home to-day.
DECIUS.
This dream is all amiss interpreted:
It was a vision fair and fortunate.

This by Calpurnia’s dream is signified.
CAESAR.
And this way have you well expounded it.
DECIUS.
I have, when you have heard what I can say;
And know it now: The Senate have concluded
To give this day a crown to mighty Caesar.
If you shall send them word you will not come,
Their minds may change. Besides, it were a mock
Apt to be render’d, for someone to say
“Break up the Senate till another time,
When Caesar’s wife shall meet with better dreams.”
If Caesar hide himself, shall they not whisper
“Lo, Caesar is afraid”?
Pardon me, Caesar; for my dear dear love
To your proceeding bids me tell you this;
And reason to my love is liable.
CAESAR.

I am ashamed I did yield to them.
Give me my robe, for I will go.
[Enter Publius, Brutus, Ligarius, Metellus, Casca,
Trebonius, and Cinna.]
And look where Publius is come to fetch me.
PUBLIUS.
Good morrow, Caesar.
CAESAR.
Welcome, Publius.—
What, Brutus, are you stirr’d so early too?—
Good morrow, Casca.—Caius Ligarius,
Caesar was ne’er so much your enemy
As that same ague which hath made you lean.—
What is’t o’clock?
BRUTUS.
Caesar, ‘tis strucken eight.
CAESAR.
I thank you for your pains and courtesy.
[Enter Antony.]
See! Antony, that revels long o’nights,
Is notwithstanding up.—Good morrow, Antony.
ANTONY.
So to most noble Caesar.
CAESAR.
Bid them prepare within:
I am to blame to be thus waited for.—
Now, Cinna;—now, Metellus;—what, Trebonius!
I have an hour’s talk in store for you:
Remember that you call on me to-day;
Be near me, that I may remember you.
TREBONIUS.
Caesar, I will. [Aside.] and so near will I be,
That your best friends shall wish I had been further.
CAESAR.
Good friends, go in, and taste some wine with me;
And we, like friends, will straightway go together.
BRUTUS.
[Aside.] That every like is not the same, O Caesar,
The heart of Brutus yearns to think upon!
[Exeunt.]


REST Services
Number 1
Number 2
Call Groovy
Call Java
Call Lisp
Note: The first time you use Lisp it has to do some one-time initialization.
Thus the first call takes a long time but after the initialization is done, all of the calls thereafter are fine.


e
Academy
1
2
3
4
Finish
Advertisement save.
Your Ad have been save correctly.
You can go to your control panel to see or modify your Ads.
Go to my profile


--- layout: post date: 2011-05-02 time: "09:00:00" authors: ["Greg Wilson"] title: Managing Data tags: ["Content"] ---
We have just posted a screencast on managing data written by Orion Buske, a graduate student in bioinformatics at the University of Toronto (and former Software Carpentry TA). We hope you enjoy it.