text:
Branch Router QoS Design
Branch WAN Edge QoS Design
Unidirectional Applications
Branch Router WAN Edge (10-Class) QoS Baseline Model
Branch Router LAN Edge QoS Design
DSCP-to-CoS Remapping
Branch-to-Campus Classification and Marking
Source or Destination IP Address Classification
Verification Command: show ip access-list
Well-Known TCP/UDP Port Classification
NBAR Application Classification
Verification Command: show ip nbar port-map
NBAR Known-Worm Classification and Policing
NBAR Versus Code Red
NBAR Versus NIMDA
NBAR Versus SQL Slammer
NBAR Versus RPC DCOM/W32/MS Blaster
NBAR Versus Sasser
NBAR Versus Future Worms
Policing Known Worms
Cisco IOS Documentation
Cisco SAFE` Whitepapers
This chapter discusses Branch QoS considerations and designs, including the following:
•Unidirectional Applications
•Branch LAN edge ingress classification
•Branch NBAR policies for worm identification and policing
Chapter 3, "WAN Aggregator QoS Design," discussed the QoS design recommendations for WAN aggregators in detail. For the most part, theses designs also apply to branch routers located at the far end of the WAN links. However, at least four unique considerations must be made for branch router QoS design. This chapter examines in detail these considerations and their related designs.
One of the first considerations is whether to configure the QoS policies manually or to utilize the Cisco Automatic QoS for the Enterprise feature. AutoQoS—Enterprise can automatically detect and provision bandwidth for up to 10 classes of traffic. This feature is well suited to smaller WAN/Branch networks managed by administrators with moderate QoS expertise. However for larger WAN/Branch networks, where centralized policies are generally preferred, this feature may not be appropriate.
If QoS policies are to be defined manually, then other considerations must also be taken into account, such as the presence of unidirectional applications. Some applications, such as Streaming-Video (whether unicast or multicast), require bandwidth allocation only on the WAN aggregator's WAN edge, not on the branch router's WAN edge. Therefore, bandwidth allocated to unidirectional applications on the WAN aggregator WAN edge can be redistributed among other preferential classes on the branch router's WAN edge.
Another characteristic common to branches is that traffic destined to the campus might not be correctly marked on the branch access switches. These switches, which are usually lower-end switches, might or might not have the capabilities to classify by Layer 3 or 4 parameters and mark DSCP values for data applications. Therefore, classification and marking might need to be performed on the branch router's LAN edge in the ingress direction. Furthermore, branch routers provide the capability to use NBAR to classify and mark flows that require stateful packet inspection.
Related to classification and NBAR, another unique consideration to branch QoS design is that branch routers are a strategic place to deploy NBAR policies for worm identification and policing. NBAR policies can be used to identify and drop Code Red, NIMDA, SQL Slammer, RPC DCOM/W32/MS Blaster, Sasser, and other worms.
Figure 4-1 shows the QoS policies required on a remote branch router.
Figure 4-1 Branch Router QoS Policies
WAN edge considerations discussed in Chapter 3, "WAN Aggregator QoS Design" apply also to the branch router's WAN edge. This includes the following:
•Link-speed categories (slow, medium, and high) and their respective design implications
•Bandwidth-provisioning guidelines (at least 25 percent for Best-Effort traffic and no more than 33 percent for Real-Time applications)
•Link-specific caveats (such as the fact that tools such as LFI and cRTP, when enabled, must be enabled on both ends of the WAN link for them to function correctly)
Distributed platform idiosyncrasies are not as relevant for branch router designs because these platforms rarely are deployed at remote sites (although they can be used for site-to-site links, as discussed in Chapter 3, "WAN Aggregator QoS Design").
For small-to-medium businesses supported by administrators with moderate QoS expertise, Cisco AutoQoS—Enterprise may be an expeditious option to enable QoS for WAN/Branch networks. This advanced IOS feature detects and automatically provisions bandwidth for up to 10 classes of traffic on a link-by-link basis based on an analysis performed on sampled traffic rates. Some considerations to keep in mind when deciding whether to use the AutoQoS—Enterprise feature:
•Policies vary on a link-by-link basis—AutoQoS—Enterprise samples traffic rates by application classes on a link-by-link basis and then presents a configuration recommendation based on these sampled rates. These rates vary link-by-link, so the recommended policies also vary link-by-link. AutoQoS— Enterprise is not a suitable tool for enterprises that want to centralize QoS policies for consistent end-to-end service-levels for their traffic classes.
•Policies are reactive to traffic conditions during the sampling period, rather than administratively proactive—The sampled traffic rates, on which the AutoQoS—Enterprise feature bases its recommendations, may or may not be inline with the desired business objectives of the QoS deployment. For example, AutoQoS—Enterprise may detect and provision bandwidth for a Streaming-Video class, but perhaps Streaming-Video is not viewed by the enterprise as a critical application requiring explicit bandwidth guarantees; they might instead prefer to use the bandwidth to increase the service-levels to Transactional Data applications. In such a case, policies would have to be manually defined.
•AutoQoS— Enterprise does not support a Mission-Critical Data class—If an enterprise requires the support of a Mission-Critical Data class, which is a subjective evaluation of relative business priority of Transactional/Interactive applications (as discussed in Chapter 1, "Quality of Service Design Overview"), such a class would have to be manually defined.
•AutoQoS—Enterprise can be used as a template—The policies proposed by AutoQoS—Enterprise can be manually modified and tweaked to meet custom requirements. The configuration generated by AutoQoS—Enterprise is not an "all or nothing" option, but rather is modifiable and thus can be viewed as a template.
•Incremental CPU load of NBAR—Because AutoQoS—Enterprise relies heavily on NBAR—which generates a degree of incremental CPU load—we generally do not recommended that you enable it on large WAN networks, in particular on WAN Aggregation routers serving a large number of remote branches. AutoQoS— Enterprise is therefore more suitable for smaller WAN/Branch environments.
•Link-specific restrictions—AutoQoS— Enterprise has several link-specific restrictions, including:
–Serial Interface Restrictions—For a serial interface with a low-speed link, MLP is configured automatically. The serial interface must have an IP address. When MLP is configured, this IP address is removed and put on the MLP bundle. To ensure that the traffic goes through the low-speed link, the following conditions must be met:
•The AutoQoS for the Enterprise feature must be configured at both ends of the link.
•The amount of bandwidth configured must be the same on both ends of the link.
–Frame Relay DLCI Restrictions:
•This feature cannot be configured on a Frame Relay DLCI if a map class is attached to the DLCI.
•If a Frame Relay DLCI is already assigned to one subinterface, the AutoQoS for the Enterprise feature cannot be configured for a different subinterface.
•For low-speed Frame Relay DLCIs configured for use on Frame Relay-to-ATM networks, MLP over Frame Relay (MLPoFR) is configured automatically. The subinterface must have an IP address. When MLPoFR is configured, this IP address is removed and put on the MLP bundle. The AutoQoS for the Enterprise feature must also be configured on the ATM side of the network.
•For low-speed Frame Relay DLCIs with Frame Relay-to-ATM Interworking, the AutoQoS for the Enterprise feature cannot be configured if a virtual template is already configured for the DLCI.
–ATM PVC Restrictions:
•For a low-speed ATM PVC, the AutoQoS for the Enterprise feature cannot be configured if a virtual template is already configured for the ATM PVC.
•For low-speed ATM PVCs, MLP over ATM (MLPoATM) is configured automatically. The subinterface must have an IP address. When MLPoATM is configured, this IP address is removed and put on the MLP bundle. The AutoQoS for the Enterprise feature must also be configured on the ATM side of the network.
The AutoQoS for the Enterprise feature consists of two configuration phases, completed in the following order:
1. Auto-Discovery (data collection)—The Auto-Discovery phase can be configured to operate in one of two modes:
–Untrusted Mode—In untrusted mode (configured using the auto discovery qos interface command), the Auto-Discovery phase uses NBAR protocol discovery to detect the applications on the network and performs statistical analysis on the network traffic.
–Trusted Mode—In trusted mode (configured using the auto discovery qos trust interface command), the Auto-Discovery phase classifies packets based on DSCP values in the IP header and collects the statistics to calculate bandwidth and average rate/peak rate and passes that data to the template module.
2. AutoQoS Template Generation and Installation—This phase (configured using the auto qos command) generates templates from the data collected during the Auto-Discovery phase and installs the templates on the interface. These templates are then used as the basis for creating the class maps and policy maps for your network. After the class maps and policy maps are created, they are then installed on the interface.
AutoQoS— Enterprise discovers and classifies as many as 10 classes of traffic, based on the QoS Baseline model. The only traffic class not automatically detected and classified is the Mission-Critical Data class, as this class requires a subjective evaluation on relative business priority vis-à-vis other Transactional/Interactive Data applications (as described in Chapter 1, "Quality of Service Design Overview").
These AutoQoS classes are described in Table 4-1.
Table 4-1 AutoQoS for the Enterprise Feature Class Definitions
IP Routing
Network control traffic, such as routing protocols
Interactive Voice
Inactive voice-bearer traffic
Interactive Video
Interactive video data traffic
Streaming Video
Streaming media traffic
Telephony Signaling
Telephony signaling and control traffic
Database applications transactional in nature
Network Management
Network management traffic
Bulk Data
Bulk data transfers; web traffic; general data service
Casual entertainment; rogue traffic; traffic in this category is given less-than-best-effort treatment
Best Effort
Default class; all non-critical traffic; HTTP; all miscellaneous traffic
Additionally, the AutoQoS—Enterprise feature includes the following verification commands:
•show auto discovery qos
•show auto qos
The top-level processes for configuring and verifying the AutoQoS—Enterprise feature are illustrated in Figure 4-2.
Figure 4-2 Top-Level Processes for Configuring the AutoQoS for the Enterprise Feature
As noted, the AutoQoS— Enterprise feature is a handy alternative for automating QoS deployment in smaller WAN/Branch environments. For more information, see the IOS documentation:
If, on the other hand, all or some of the branch QoS policies must be defined manually, then additional considerations must be taken into account, as discussed below.
Some applications are completely symmetrical and require identical bandwidth provisioning on both ends of the WAN link. For example, if 100 kbps of LLQ are assigned to voice in one direction, 100 kbps of LLQ also must be provisioned for voice in the opposite direction (assuming that the same VoIP codecs are being used in both directions, and putting aside for a moment multicast Music-on-Hold [MoH] provisioning). Furthermore, having symmetrical polices on both sides of the WAN links greatly simplifies QoS policy deployment and management, which is an important aspect of large-scale designs.
However, certain applications, such as Streaming-Video and multicast MoH, most often are unidirectional. Therefore, it might be unnecessary and even inefficient to provision any bandwidth guarantees for such traffic on the branch router for the branch-to-campus direction of traffic flow.
Most applications lie somewhere in the middle of the scale, between the extremes of being fully bidirectional and being completely unidirectional. Most client/server applications lie closer to the unidirectional end of the scale because these applications usually consist of small amounts of client-to-server traffic coupled with larger amounts of server-to-client traffic. Such behavior can be reflected in the asymmetrical bandwidth provisioning for such types of applications.
For purely unidirectional applications, it is recommended that provisioning be removed from the WAN edge policies on branch routers and the allocated bandwidth be redistributed among other classes.
The inclusion or exclusion of the Streaming-Video class affects only those enterprises deploying complex QoS class models, such as the 11-Class QoS Baseline Model. When the Streaming-Video class is removed from this model (for branch router WAN edges), the bandwidth previously allocated to this class can be reallocated among the other preferential data classes, as illustrated in Figure 4-3. Notice that no class is provisioned for Streaming-Video in this model, and the bandwidth assigned to it from the 11-Class WAN edge model (from Figure 3-6 in the previous chapter) has been reassigned to the Mission-Critical Data class and the Transactional Data class.
The configuration for such a branch router (10-class) QoS Baseline policy on a dual-T1 interface is shown in Example 4-1. Notice that there is no Streaming-Video class and that the bandwidth for it has been distributed equally between the Mission-Critical Data class (now at 15 percent instead of 10 percent) and the Transactional Data class (now at 12 percent instead of 7 percent).
A bandwidth statement is used on class-default, precluding the use of fair-queue on the class for all nondistributed platforms. Also, a max-reserved-bandwidth 100 command must be issued on the interface before the service-policy output command.
Figure 4-3 Branch Router (10-Class) QoS Baseline WAN Edge Model Bandwidth Allocations Example (Dual-T1 Link Example)
Example 4-1 Branch Router (10-Class) QoS Baseline WAN Edge Model
class-map match-all VOICE
match ip dscp ef ! IP Phones mark Voice to EF
class-map match-all INTERACTIVE-VIDEO
match ip dscp af41 af42 ! Recommended markings for IP/VC
class-map match-any CALL-SIGNALING
match ip dscp cs3 ! Future Call-Signaling marking
match ip dscp af31 ! Current Call-Signaling marking
class-map match-all ROUTING
match ip dscp cs6 ! Routers mark Routing traffic to CS6
class-map match-all NET-MGMT
match ip dscp cs2 ! Recommended marking for Network Management
class-map match-all MISSION-CRITICAL-DATA
match ip dscp 25 ! Interim marking for Mission-Critical Data
class-map match-all TRANSACTIONAL-DATA
match ip dscp af21 af22 ! Recommended markings for Transactional Data
class-map match-all BULK-DATA
match ip dscp af11 af12 ! Recommended markings for Bulk Data
class-map match-all SCAVENGER
match ip dscp cs1 ! Recommended marking for Scavenger traffic
policy-map BRANCH-WAN-EDGE
class VOICE
priority percent 18 ! Voice gets 552 kbps of LLQ
class INTERACTIVE-VIDEO
priority percent 15 ! 384 kbps IP/VC needs 460 kbps of LLQ
class CALL-SIGNALING
bandwidth percent 5 ! Minimal BW guarantee for Call-Signaling
class ROUTING
bandwidth percent 3 ! Routing class gets 3% explicit BW guarantee
class NET-MGMT
bandwidth percent 2 ! Net-Mgmt class gets 2% explicit BW guarantee
class MISSION-CRITICAL-DATA
bandwidth percent 15 ! Mission-Critical class gets min 15% BW guarantee
random-detect ! Enables WRED on Mission-Critical Data class
class TRANSACTIONAL-DATA
bandwidth percent 12 ! Transactional-Data class gets min 12% BW guarantee
random-detect dscp-based ! Enables DSCP-WRED on Transactional-Data class
class BULK-DATA
bandwidth percent 4 ! Bulk Data class gets 4% BW guarantee
random-detect dscp-based ! Enables DSCP-WRED on Bulk-Data class
class SCAVENGER
bandwidth percent 1 ! Scavenger class is throttled
class class-default
bandwidth percent 25 ! Default class gets min 25% BW guarantee
random-detect ! Enables WRED on the default class
Verification commands:
•show policy
•show policy interface
Now that considerations and designs for the WAN edge of the branch router have been addressed, the next section discusses the LAN edge.
The LAN edge of the branch router can have egress and ingress policies. Because you have been dealing with egress policies since the WAN/branch discussion began, and because the egress policies are not only optional, but also considerably simpler, they are discussed first.
As previously mentioned, it is better to mark at Layer 3 (DSCP) instead of Layer 2 whenever possible because Layer 2 markings are lost when the transmission medium changes. This is the case with any Ethernet 802.1Q/p CoS values that have been set within the campus and are carried over a WAN (or VPN). In some cases, network administrators prefer to have these markings restored at the branch; DSCP-to-CoS mapping then can be performed on the branch router's LAN edge.
In the ingress direction, the branch router might be required to perform classification and marking of branch-to-campus traffic. This might be because the branch switch lacks the capability to classify and mark traffic, or because the traffic consists of stateful flows that require NBAR for classification. NBAR classification also is required at branch LAN ingress edges to identify (and immediately drop) known worm traffic.
Each of these types of polices is discussed in more detail in the following sections.
DSCP-to-CoS remapping is optional. Newer Catalyst switches perform QoS based on internal DSCP values that are generated either by trusted DSCP markings or by trusted CoS markings (coupled with CoS-to-DSCP mappings). In the case of legacy switches at the branch that perform QoS strictly by preset CoS values, CoS might need to be remapped on the branch router's LAN edge.
Enhanced packet marking (Cisco IOS Release 12.2[13]T or higher) is the optimal tool for resetting CoS values because it uses a table. In this manner, a default DSCP-to-CoS mapping can be used without having to configure explicitly a class-based marking policy that matches every DiffServ class and performs a corresponding set cos function.
In both cases, keep in mind that only Ethernet trunking protocols, such as 802.1Q, carry CoS information. Therefore, the policy works correctly only when applied to a trunked subinterface, not to a main Ethernet interface.
Example 4-2 presents an enhanced packet marking DSCP-to-CoS configuration for a branch LAN edge. Note that this DSCP-to-CoS remapping policy requires application to both the voice VLAN (VVLAN) subinterface and the data VLAN (DVLAN) subinterface on the branch router's LAN edge.
Example 4-2 Branch LAN Edge Enhanced Packet Marking for DSCP-to-CoS Remapping Example
ip cef ! IP CEF is Required for Packet Marking
policy-map BRANCH-LAN-EDGE-OUT
set cos dscp ! Enables default DSCP-to-CoS Mapping
interface FastEthernet0/0
no ip address
speed auto
duplex auto
interface FastEthernet0/0.60
description DVLAN SUBNET 10.1.60.0
encapsulation dot1Q 60
ip address 10.1.60.1 255.255.255.0
service-policy output BRANCH-LAN-EDGE-OUT ! Restores CoS for Data VLAN
interface FastEthernet0/0.160
description VVLAN SUBNET 10.1.160.0
encapsulation dot1Q 160
ip address 10.1.160.1 255.255.255.0
service-policy output BRANCH-LAN-EDGE-OUT ! Restores CoS on Voice VLAN
In keeping with the unofficial Differentiated Services design principle of marking traffic as close to its source as possible, IP phones mark voice-bearer traffic (to DSCP EF) and Call-Signaling traffic (currently, to DSCP AF31, but this will soon change to DSCP CS3) on the phones themselves. Some IP/VC devices mark Interactive-Video traffic to AF41 on their network interface cards (NICs).
However, as has already been discussed, it is generally not recommended that end-user PCs be trusted to set their CoS/DSCP markings correctly because users easily can abuse this (either unintentionally or deliberately).
Note There may be some exceptions to this general rule, such as PCs running applications like Cisco VT Advantage in controlled environments. A network administrator must make these policy decisions.
Therefore, application traffic that originates from untrusted hosts should be marked on branch access switches. However, in some circumstances, this might not be possible:
•The branch access switch does not have Layer 3 or Layer 4 awareness for traffic classification or does not support marking.
•Classification needs to be performed at the application layer (through NBAR).
In such cases, DSCP classification must be performed at the ingress interface of the branch router.
Administrators can identify and then mark application traffic based on the following criteria:
•Source or destination IP address (or subnet)—Typically, destination subnets are used when setting branch QoS policies. For example, the destination subnet for a group of application servers can be used to identify a particular type of client-to-server application traffic.
•Well-known TCP/UDP ports—It is important to know whether the well-known port is a source port or a destination port from the branch router's perspective.
•NBAR protocol (for example, Citrix or KaZaa) or application subparameter (for example, HTTP URL)—NBAR Packet Description Language Modules (PDLMs) also can be configured to identify stateful or proprietary applications, as well as worms.
Regardless of the method used to identify the application traffic, the inbound classification and marking policy needs to be applied only to the DVLAN subinterface. This is because only trusted IP Telephony applications, which mark their voice traffic correctly, are admitted onto the voice VLAN.
Note If the branch access switches support access-edge policers (as described in Chapter 2, "Campus QoS Design"), these likewise should be enabled on them. This adds another layer of defense to the network, mitigating DoS/worm traffic that originates from the branch through Scavenger-class QoS.If the branch access switches do not support such policing, compatible policers could be placed at the branch router access edge. This is in harmony with the principle of policing as close to the source as possible.Whenever possible, though, such policing should be done in Catalyst hardware rather than Cisco IOS Software.
Although it might be tempting to use the same class-map names (such as MISSION-CRITICAL, TRANSACTIONAL-DATA, or BULK-DATA) for ingress LAN edge classification and marking policies as are in use for egress WAN edge queuing policies, this might cause confusion in policy definition and troubleshooting. Therefore, for management and troubleshooting simplicity, it is beneficial to have similar yet descriptive names for these new classes (for example, branch-originated traffic might have class-map names prepended with "BRANCH-"). A description can also be added to the class maps with the description command.
Example 4-3 shows how traffic destined to a specific subnet (10.200.200.0/24)—which, in this case, represents a server farm of proprietary Mission-Critical Data application servers—can be identified and marked on ingress on the branch router's LAN edge.
Example 4-3 Branch LAN Edge Destination IP Classification and Marking Example
ip cef ! Required for Packet Marking
class-map match-all BRANCH-MISSION-CRITICAL
match access-group name MISSION-CRITICAL-SERVERS ! ACL to reference
policy-map BRANCH-LAN-EDGE-IN
class BRANCH-MISSION-CRITICAL
set ip dscp 25 ! (Interim) Recommended marking for Mission-Critical traffic
service-policy output BRANCH-LAN-EDGE-OUT ! Restores CoS on Data VLAN
service-policy input BRANCH-LAN-EDGE-IN ! Marks MC Data on ingress
ip access-list extended MISSION-CRITICAL-SERVERS
permit ip any 10.200.200.0 0.0.0.255 ! MC Data Server-Farm Subnet
•show ip access-list
When access lists are used as the filtering criteria for a class map, the show ip access-list command is helpful in identifying whether the access list is registering matches, especially for ACLs that have multiple lines of match criteria. This command provides granular visibility into which lines of an access list are registering matches. In Example 4-4, 464 matches are registered against the access list.
Example 4-4 show ip access-list Verification of Remote Branch LAN Edge Destination IP Classification Example
BRANCH#60-C3745#show ip access-list MISSION-CRITICAL-SERVERS
Extended IP access list MISSION-CRITICAL-SERVERS
10 permit ip any 10.200.200.0 0.0.0.255 (464 matches)
Most applications can be identified by their well-known TCP/UDP ports. Some of these ports have keywords within Cisco IOS Software to identify them when defining access lists.
Note The Internet Assigned Numbers Authority (IANA) lists registered well-known and registered application ports at http://www.iana.org/assignments/port-numbers.
Building on Example 4-4, Example 4-5 classifies and marks branch-originated FTP and e-mail traffic, both POP3 and IMAP (TCP port 143), as Bulk Data (DSCP AF11).
Example 4-5 Branch LAN Edge Well-Known Port Classification Example
match access-group name MISSION-CRITICAL-SERVERS
class-map match-all BRANCH-BULK-DATA
match access-group name BULK-DATA-APPS ! ACL to reference
set ip dscp 25
class BRANCH-BULK-DATA
set ip dscp af11 ! Bulk data apps are marked to AF11
service-policy input BRANCH-LAN-EDGE-IN ! Marks Data on ingress
permit ip any 10.200.200.0 0.0.0.255
ip access-list extended BULK-DATA-APPS
permit tcp any any eq ftp ! Identifies FTP Control traffic
permit tcp any any eq ftp-data ! Identifies FTP Data traffic
permit tcp any any eq pop3 ! Identifies POP3 E-mail traffic
permit tcp any any eq 143 ! Identifies IMAP E-mail traffic
At the time of this writing, Cisco IOS Software included NBAR PDLMs for 98 of the most common network applications, with the capability to define an additional 10 applications using custom PDLMs.
Of these protocols, 15 require stateful packet inspection for positive identification. Because NBAR operates in the IP Cisco Express Forwarding (CEF) switching path, only the first packet within a flow requires stateful packet inspection, and the policy is applied to all packets belonging to the flow. NBAR stateful packet inspection requires more CPU processing power than simple access control lists (ACLs). However, on newer branch router platforms, such as Cisco's 1800, 2800, and 3800 series Integrated Services Routers (ISRs), Cisco Technical Marketing testing has shown the overhead of enabling NBAR classification at dual-T1 rates to be quite minimal (typically 2 to 5 percent, depending on the traffic mix).
Building again on the previous example, Example 4-6 uses NBAR to identify several types of Transactional Data applications, Network-Management applications, and Scavenger applications.
In Example 4-6, Transactional Data applications include Citrix, LDAP, Oracle SQL*NET, and HTTP web traffic with "SalesReport" in the URL. In addition, a custom PDLM is defined to identify SAP traffic (by TCP ports 3200 through 3203 and 3600), and SAP also is included as a Transactional Data application.
Additionally, Network-Management applications, such as SNMP, Syslog, Telnet, NFS, DNS, ICMP, and TFTP, are identified through NBAR and marked to DSCP CS2.
Furthermore, Scavenger applications, such as Napster, Gnutella, KaZaa (versions 1 and 2), Morpheus, Grokster, and many other peer-to-peer file-sharing applications, are identified by NBAR and marked to DSCP CS1.
Example 4-6 Branch LAN Edge NBAR Classification Example
ip nbar port-map custom-01 tcp 3200 3201 3202 3203 3600 ! PDLM Mapping for SAP
ip cef ! IP CEF is required for both Class-Based Marking and for NBAR
class-map match-any BRANCH-TRANSACTIONAL-DATA! Must use "match-any"
match protocol citrix ! Identifies Citrix traffic
match protocol ldap ! Identifies LDAP traffic
match protocol sqlnet ! Identifies Oracle SQL*NET traffic
match protocol http url "*SalesReport*" ! Identifies "SalesReport" URLs
match protocol custom-01 ! Identifies SAP traffic via Custom-01 PDLM Port-Map
match access-group name BULK-DATA-APPS
class-map match-any BRANCH-NET-MGMT
match protocol snmp ! Identifies SNMP traffic
match protocol syslog ! Identifies Syslog traffic
match protocol telnet ! Identifies Telnet traffic
match protocol nfs ! Identifies NFS traffic
match protocol dns ! Identifies DNS traffic
match protocol icmp ! Identifies ICMP traffic
match protocol tftp ! Identifies TFTP traffic
class-map match-any BRANCH-SCAVENGER
match protocol napster ! Identifies Napster traffic
match protocol gnutella ! Identifies Gnutella traffic
match protocol fasttrack ! Identifies KaZaa (v1) traffic
match protocol kazaa2 ! Identifies KaZaa (v2) traffic
class BRANCH-TRANSACTIONAL-DATA
set ip dscp af21 ! Transactional Data apps are marked to DSCP AF21
class BRANCH-NET-MGMT
set ip dscp cs2 ! Network Management apps are marked to DSCP CS2
set ip dscp af11
class BRANCH-SCAVENGER
set ip dscp cs1 ! Scavenger apps are marked to DSCP CS1
service-policy input BRANCH-LAN-EDGE-IN ! Input Marking policy on DVLAN only
permit tcp any any eq ftp
permit tcp any any eq ftp-data
permit tcp any any eq pop3
permit tcp any any eq 143
Note The NBAR fasttrack PDLM identifies KaZaa (version 1), Morpheus, Grokster, and other applications. The NBAR gnutella PDLM identifies Gnutella, BearShare, LimeWire, and other peer-to-peer applications.
•show ip nbar port-map
When NBAR custom PDLMs are used to identify applications, it is useful to verify that the ports bound to the PDLM have been entered correctly. This information is obtained with the show ip nbar port-map command. In this (filtered) example, Example 4-7, the TCP ports given for SAP (3200 through 3203 and 3600) were bound correctly to the Custom-01 NBAR PDLM.
Example 4-7 show ip nbar port-map Verification Custom-PDLM TCP/UDP Port-Mapping Example
BRANCH#60-C3745#show ip nbar port-map | include custom-01
port-map custom-01 tcp 3200 3201 3202 3203 3600
Worms are nothing new. They've been around almost as long as the Internet itself (one of the first Internet worms was the Morris worm, released in November 1988). Typically, worms are self-contained programs that attack a system and try to exploit a vulnerability in the target. Upon successfully exploiting the vulnerability, the worm copies its program from the attacking host to the newly exploited system to begin the cycle again.
Note A virus, which is slightly different from a worm, requires a vector to carry the virus code from one system to another. The vector can be either a word-processing document, an e-mail, or an executable program.The main element that distinguishes a worm from a virus is that a computer virus requires human intervention to facilitate its spreading, whereas worms (once released) propagate without requiring additional human intervention.
Worms are comprised of three primary components (as illustrated in Figure 4-4):
•The enabling exploit code—The enabling exploit code is used to exploit a vulnerability on a system. Exploitation of this vulnerability provides access to the system and the capability to execute commands on the target system.
•A propagation mechanism—When access has been obtained through the enabling exploit, the propagation mechanism is used to replicate the worm to the new target. The method used to replicate the worm can be achieved through the use of the Trivial File Transfer Protocol (TFTP), FTP, or another communication method. When the worm code is brought to the new host, the cycle of infection can be started again.
•A payload—Some worms also contain payloads, which might include additional code to further exploit the host, modify data on the host, or change a web page. A payload is not a required component, and, in many cases, the worm's enabling exploit code itself can be considered the payload.
Figure 4-4 Anatomy of an Internet Worm
Some worms use unique TCP/UDP ports to propagate. These types of worms are fairly simple to block using access lists (when the ports are known). Such ACLs can be configured on the branch switch (whenever supported) or on the branch router's LAN edge.
Other worms hijack legitimate TCP/UDP ports to carry their harmful payloads. For these latter types of worms, NBAR can be used at the branch LAN edge to perform deep-packet analysis and drop any packets that are carrying the payloads of known worms. Some of these known worms include Code Red, NIMDA, SQL Slammer, RPC DCOM/W32/MS Blaster, and Sasser. The following sections discuss how NBAR can be used for each of these types of worms.
First released in July 2001, Code Red targeted Microsoft Internet Information Server (IIS) using a vulnerability in the IIS Indexing Service. Although the first variant of this worm did little damage because of a flaw in the random number-generator code used to generate addresses of hosts to exploit, a second variant appeared with the flaw fixed.
This worm, CodeRedv2, spread quickly and became the most widespread and damaging worm to hit the Internet since the Morris worm. CodeRedv2's success as a worm relied on the fact that the worm exploited the vulnerability in the IIS Indexing Service only as a means of gaining access to the host. This, coupled with the wide deployment of IIS as well as the large number of unpatched IIS web servers, contributed to the quick and wide-ranging spread of the worm. An estimated 360,000 hosts were infected within a period of 14 hours.
CodeRedv2 temporarily replaced the home page of the web servers that it struck with a new page. Additionally, the code of the worm indicated that it was programmed to begin a packet-flooding DoS attack against a hard-coded IP address. (At the time, this was the IP address of the White House web server at http://www.whitehouse.gov.)
The original Code Red payload is shown in Example 4-8. The initial infection attempt sends a large HTTP GET request to the target IIS server.
Example 4-8 Original Code Red Payload
2001-08-04 16:32:23 220.127.116.11 - 10.1.1.75 80 GET /default.ida NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
531b%u53ff%u0078%u0000%u00=a 403
The CodeRedv2 payload is shown in Example 4-9.
Example 4-9 CodeRedv2 Payload
2001-08-04 15:57:35 22.214.171.124 - 10.1.1.75 80 GET /default.ida XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a 403 -
Notice that the GET request in both cases is looking for a file named default.ida. However, this filename changes in newer variants of Code Red, such as CodeRedv3/CodeRed.C, as shown in Example 4-10.
Example 4-10 CodeRedv3 Payload
2001-08-06 22:24:02 126.96.36.199 - 10.1.1.9 80 GET /x.ida AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Although the filename has changed, the .ida suffix remains the same.
Code Red variants can include payloads that execute cmd.exe or root.exe functions to program scripts within the IIS scripts directory, thus providing a ready-made back door to the server for any attacker to use.
Therefore, to combat Code Red, NBAR policies can be configured to check the payload of HTTP packets for these criteria (.ida, cmd.exe, and root.exe), as shown in Example 4-11.
Example 4-11 NBAR Policies to Identify Code Red
class-map match-any CODE-RED
match protocol http url "*.ida*" ! Identifies HTTP GET .ida requests
match protocol http url "*cmd.exe*" ! Identifies HTTP with cmd.exe
match protocol http url "*root.exe*" ! Identifies HTTP with root.exe
Verification command:
Two months after Code Red struck the Internet, another large-scale worm, NIMDA, was released. Unlike Code Red, NIMDA was a hybrid worm because it contained the characteristics of both a worm and a virus. NIMDA spread using several vectors:
•Through e-mail as an attachment (virus vector)
•Through network shares (worm vector)
•Through JavaScript by browsing compromised websites (virus vector)
•Through infected hosts actively scanning for additional exploitable hosts (worm vector)
•Through infected hosts actively scanning for back doors created by Code Red (worm vector)
NIMDA did not appear to exhibit intentional destructive capabilities; to date, NIMDA's activities have been restricted to its self-propagation, which has the side effect of a DoS (flooding) attack.
NIMDA propagates itself by copying, downloading, or executing a file called readme.eml. Therefore, NBAR can be used to check the payload of HTTP packets to see if they are propagating this file, as shown in Example 4-12.
Example 4-12 NBAR Policies to Identify NIMDA
class-map match-any NIMDA
match protocol http url "*readme.eml*" ! Identifies HTTP with "readme.eml"
After the NIMDA infection subsided, the Internet saw the appearance of smaller infectious worms. In January 2003, a new worm infected the Internet at such a high rate that it was categorized as a flash worm. This worm, termed SQL Slammer, once again targeted Microsoft Windows servers; specifically, this worm targeted servers running Microsoft Structured Query Language (SQL) Server software. The vulnerability exploited by SQL Slammer had been published in July 2002, and a patch from Microsoft was available at that time as well. Even though this patch was available for almost six months, SQL Slammer spread with incredibly high efficiency.
SQL slammer is a 376-byte User Datagram Protocol (UDP)-based worm that infects Microsoft SQL servers through UDP port 1434. Example 4-13 shows a signature string from the SQL Slammer worm.
Example 4-13 SQL Slammer Worm Signature String
Because of its small size, the SQL Slammer worm is contained in a single packet. The fast scanning rate of SQL Slammer is achieved not only because of this small size, but also because the worm is UDP based. The worm does not have to complete a handshake (necessary with TCP-based worms) to connect with a target system.
SQL Slammer reached its full scanning rate of 55 million scans per second within 3 minutes of the start of the infection and infected the majority of vulnerable hosts on the Internet within 10 minutes of the start of the infection, with an estimated 300,000 infected hosts overall. A major consequence of such a fast scanning rate was that edge networks were overwhelmed by the amount of traffic generated by the worm. SQL Slammer's doubling rate was approximately 8.5 seconds. In contrast, CodeRedv2's doubling rate was about 37 minutes.
SQL Slammer does not carry an additional harmful payload (beyond its enabling exploit code), and its primary purpose is to cause DoS through exponential self propagation.
NBAR can be used to detect the SQL Slammer worm by mapping a custom PDLM to UDP port 1434 and matching on the packet length (376-byte worm + 8 bytes of UDP header + 20 bytes of IP header = 404 bytes). This is shown in Example 4-14.
Example 4-14 NBAR Policies to Identify SQL Slammer
ip nbar port-map custom-02 udp 1434 ! Maps a custom PDLM to UDP 1434
class-map match-all SQL-SLAMMER
match protocol custom-02 ! Matches the custom Slammer PDLM
match packet length min 404 max 404 ! Matches the packet length (376+28)
Note Because NBAR custom-01 PDLM has been used in previous examples to identify SAP traffic, another custom PDLM (custom-02) is used in this example. Subsequent examples similarly are defined with the next-available custom PDLM.
First released in August 2003, the Remote Procedure Call (RPC) Distributed Component Object Model (DCOM) worm exploited a flaw in a section of Microsoft's RPC code dealing with message exchange over TCP/IP, resulting in the incorrect handling of malformed messages. This flaw was a stack-based buffer overflow occurring in a low-level DCOM interface within the RPC process listening on TCP ports 135, 139, and 445.
The DCOM protocol enables Microsoft software components to communicate with one another. This is a core function of the Windows kernel and cannot be disabled. The vulnerability results because the Windows RPC service does not properly check message inputs under certain circumstances. By sending a malformed RPC message, an attacker can cause the RPC service on a device to fail in such a way that arbitrary code could be executed. The typical exploit for this vulnerability launches a reverse-telnet back to the attacker's host to gain complete access to the target.
Successful exploitation of this vulnerability enables an attacker to run code with local system privileges. This enables an attacker to install programs; view, change, or delete data; and create new accounts with full privileges. Because RPC is active by default on all versions of the Windows operating system, any user who can deliver a malformed TCP request to an RPC interface of a vulnerable computer could attempt to exploit the vulnerability. It is even possible to trigger this vulnerability through other means, such as logging into an affected system and exploiting the vulnerable component locally.
A variant of the RPC DCOM worm is termed W32 Blaster or MS Blaster. When MS Blaster successfully exploits a host, it attempts to upload a copy of the worm program to the newly exploited host. MS Blaster uses TFTP to copy the worm program from the attacking host to the target system. MS Blaster also starts up a cmd.exe process and binds it to TCP port 4444 of the newly exploited system. This provides any attacker with direct command-line access at the local system privilege level, as discussed previously.
To access the system, the attacker needs only to telnet to TCP port 4444 on the exploited host. If the worm is successful in copying the MS Blaster program to the target, the worm exploit code modifies the system registry to ensure that the worm is restarted if the system reboots. It then launches the worm program on the newly exploited host to begin the cycle again, starting with scanning for more exploitable hosts. MS Blaster also contained code for a DoS attack. This particular attack was targeted at www.windowsupdate.com.
NBAR can be used to combat the RPC DCOM/W32/MS Blaster worm by identifying communications on TCP/UDP ports 135, 139, and 445.
By default, the NBAR exchange PDLM is mapped to TCP port 135; therefore, this PDLM can be used as part of the MS Blaster worm policy definition. Similarly, the NBAR netbios PDLM is bound by default to TCP/UDP port 139 (in addition to TCP port 137 and UDP ports 137 and 138), so this PDLM also can be used within the policy definition; specifically, the netbios PDLM can have its port mapping expanded to include TCP port 445 and UDP ports 135, 139, and 445, as shown in Example 4-15.
Note Alternatively, a custom PDLM can be defined for these ports (TCP/UDP 135, 139, and 445), but before this could be done, you would have to map the exchange and netbios PDLMs ports away from their defaults, to avoid conflicting PDLM port mappings.
Example 4-15 NBAR Policies to Identify RPC DCOM/W32/MS Blaster
ip nbar port-map netbios tcp 137 139 445 ! Matches TCP 137/139/445
ip nbar port-map netbios udp 135 137 138 139 445 ! Matches UDP 135/137-139/445
class-map match-any MS-BLASTER
match protocol exchange ! Matches TCP port 135
match protocol netbios ! Matches MS Blaster NetBIOS PDLM
The next major worm after MS Blaster was the Sasser worm (and variants Sasser.A/B/C/D), which was released in late April 2004. Sasser exploits a flaw in the Windows Local Security Authority Service Server (LSASS) that can cause systems to crash and continually reboot, or allow a remote attacker to execute arbitrary code with local system privileges.
Sasser is very efficient in scanning: It can scan 1024 separate IP addresses simultaneously (on TCP port 445). When scanning reveals a vulnerable system, the worm exploits the LSASS vulnerability and creates a remote shell (RSH) session on TCP port 9996 back to the infecting system. Then Sasser starts an FTP server on TCP port 5554 to retrieve a copy of the worm.
Sasser can be identified through a custom NBAR PDLM listening for communication on TCP ports 445, 5554, and 9996, as shown in Example 4-16.
Note If TCP port 445 already has been bound to the netbios NBAR PDLM (as recommended previously in the MS Blaster worm definition), it is not necessary to include this port in the Sasser custom PDLM port mapping (because it will cause a conflict).
Example 4-16 NBAR Policies to Identify Sasser
ip nbar port-map custom-03 tcp 445 5554 9996 ! Matches on TCP 445/5554/9996
class-map match-all SASSER
match protocol custom-03 ! Matches Sasser custom PDLM
There is every reason to believe that new worms will be released in the future. These worms will be not only more complex, but also more efficient in their propagation, and thus more damaging in their scope.
A new NBAR feature (introduced in Cisco IOS Release 12.3[4]T) enables network administrators to extend the capability of NBAR to classify (and monitor) additional static port applications or to allow NBAR to classify unsupported static port traffic. Specifically, it enables administrators to define the strings that they want to search for in the application payload (for any application, not just HTTP URLs) to identify a given application.
This functionality can be used to identify proprietary applications that otherwise could not be matched. However, it also can be very useful in plugging holes that future worms might open.
For example, consider the example of a fictitious worm called Moonbeam. Moonbeam scans and propagates itself on randomly generated TCP ports within the range of 21000 through 21999. Furthermore, the worm carries the word Moonbeam within the payload, beginning with the ninth ASCII character of the string. Moonbeam's (fictitious) payload is shown in Example 4-17.
Example 4-17 Moonbeam Worm Payload
u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a 403 ...
Moonbeam could be identified by a custom NBAR PDLM that examines TCP packets within the range of 21000 through 21999, offsets the scan by 8 ASCII characters, and checks for the string "Moonbeam" (case sensitive), as shown in Example 4-18.
Example 4-18 NBAR Policies to Identify Moonbeam
ip nbar custom MOONBEAM 8 ascii Moonbeam tcp range 21000 21999 ! "Moonbeam" PDLM
class-map match-all MOONBEAM-WORM
match protocol MOONBEAM ! Matches the "Moonbeam" custom PDLM
These are just a few examples of known worms that can be identified using NBAR. After traffic generated by known worms has been positively identified, it should not be re-marked or limited; rather, it should be dropped immediately. This can be done on ingress on branch LAN edges, as shown in Example 4-19, which combines the policies for Code Red, NIMDA, SQL Slammer, RPC DCOM/W32/MS Blaster, and Sasser. Additionally, the fictitious worm Moonbeam has been included in the policy.
Note A recursive classification is required in this policy for SQL Slammer. This is because SQL Slammer requires a match-all criteria for its initial classification, but for policy-management purposes, it is desired that this initial classification of SQL Slammer be lumped under a single policy (with a match-any criteria) to identify and drop all known worms.
Example 4-19 NBAR Branch LAN Edge Ingress Policy for Known Worms
ip nbar port-map custom-02 udp 1434 ! SQL Slammer custom PDLM
ip nbar port-map custom-03 tcp 5554 9996 ! Sasser custom PDLM
ip nbar port-map netbios tcp 137 139 445 ! MS Blaster TCP 137/139/445
ip nbar port-map netbios udp 135 137 138 139 445 ! MS Blaster UDP 135/137-139/445
match protocol custom-02 ! Matches the SQL Slammer PDLM
class-map match-any WORMS
match protocol http url "*.ida*" ! CodeRed
match protocol http url "*cmd.exe*" ! CodeRed
match protocol http url "*root.exe*" ! CodeRed
match protocol http url "*readme.eml*" ! NIMDA
match class-map SQL-SLAMMER ! SQL Slammer class-map
match protocol exchange ! MS Blaster (TCP 135)
match protocol netbios ! MS Blaster NetBIOS PDLM
match protocol custom-03 ! Sasser custom PDLM
match protocol MOONBEAM ! "Moonbeam" PDLM
policy-map WORM-DROP
class WORMS
drop ! Drops all known worms
service-policy input WORM-DROP ! Drops known worms (DVLAN only)
•show policy map
•show policy-map interface
Note For a case study example of Branch Router QoS design, refer to Figure 14-4 and Example 14-20 of the Cisco Press book, End-to-End QoS Network Design by Tim Szigeti and Christina Hattingh.
Although the QoS design recommendations for branch routers are very similar to and are related to the QoS recommendations for WAN aggregators, this chapter examined four unique considerations of branch routers.
The first consideration was whether to define policies manually or automatically, via the AutoQoS—Enterprise feature. AutoQoS— Enterprise can automatically detect and provision bandwidth for up to 10 classes of traffic and is well suited to smaller WAN/Branch networks managed by administrators with moderate QoS expertise. However for larger WAN/Branch networks, where centralized policies are generally preferred, this feature may not be appropriate due to its limitations.
The second consideration is whether applications provisioned over the WAN are bidirectional or unidirectional. Some unidirectional applications, such as Streaming-Video, provisioned on the WAN aggregator WAN edge do not need to be provisioned correspondingly on the branch router's WAN edge. Bandwidth from unidirectional application classes can be redistributed among other preferential application classes on the branch router's WAN edge.
The third consideration unique to branch routers is that ingress marking might need to be performed on branch-to-campus traffic. This might be because the remote branch access switch does not have the capability to classify and mark traffic, or it might be because some applications require stateful packet inspection (NBAR) to identify them correctly. In either case, ingress marking policies would be required on the branch router's LAN edge, on the data VLAN's subinterface (the voice VLAN traffic markings are trusted). Branch-to-campus traffic can be identified by Layer 3 parameters (such as destination subnet), Layer 4 parameters (such as well-known TCP/UDP ports), or NBAR PDLMs. An example of each type of classification is provided. Additionally, optional DSCP-to-CoS mapping policies (for restoring 802.1p CoS markings that were lost when campus-originated traffic traversed the WAN media) can be set on the branch router's LAN edge.
A fourth unique consideration in branch QoS design is that branch router ingress LAN edges are a strategic place to deploy NBAR policies for worm identification and policing. NBAR policies can be used to identify and drop Code Red, NIMDA, SQL Slammer, RPC DCOM/W32/MS Blaster, Sasser, and other worms. This chapter discussed an extension of the NBAR feature that enables administrators to program the strings that they want NBAR to search packet payloads for; this feature enables NBAR policies to be used to identify new worms that undoubtedly will be released in the future.
•RFC 2474 "Definition of the Differentiated Services Field (DS Field) in the IPv4 and IPv6 Headers
•RFC 2597 "Assured Forwarding PHB Group"
•RFC 3246 "An Expedited Forwarding PHB (Per-Hop Behavior)"
•Szigeti, Tim and Christina Hattingh. End-to-End QoS Network Design: Quality of Service in LANs, WANs and VPNs. Indianapolis: Cisco Press, 2004.
•Class-based marking (Cisco IOS Release 12.1.5T)
•Enhanced packet marking (Cisco IOS Release 12.2.13T)
•NBAR overview (Cisco IOS Release 12.3)
•Network-Based Application Recognition (Cisco IOS Release 12.1.5T)
•Network-Based Application Recognition (Cisco IOS Release 12.2.8T)
•Network-Based Application Recognition (Cisco IOS Release 12.3[4]T)
•AutoQoS for the Enterprise (Cisco IOS Release 12.3[11]T)
•SAFE worm mitigation
•Using Network-Based Application Recognition and ACLs for blocking the Code Red worm
•How to protect your network against the NIMDA virus
•SAFE SQL Slammer worm attack mitigation
•SAFE RPC DCOM/W32/Blaster attack mitigation
•Combating the Internet worm Sasser


text:
Web cams are great. Your kids can Skype with their cousins or grandparents hundreds of miles away.
But, of course, the criminals have to try to ruin that, too.
It's estimated 170,000,000 people use laptops around the world. And many web cameras are so tiny and embedded in the design of your laptop that you forget it's even there, unless you use it a lot.
"You don't even have to look for it as a special feature anymore," said CNET's Dan Ackerman. "It just comes with the computer."
And the FBI has a warning:
"With the web cam comes the opportunity for people to use malicious software to control the web cam," said FBI Special Agent Justin Vellese.
So while you're going about your nightly routine, at home or in a hotel room, someone could be turning on your web cam without you knowing it and watching everything you do.
"Many laptops now have 3G or wireless capabilities built into them," said Vellese. "So being portable, they can be used anywhere and can be put in places that are private, places that people might not want to be seen."
Even if your web cam is supposed to have a light that comes on indicating when it's being used, you still may not be safe.
"There is malicious software that can turn-on the web cam. Turn it off. It's possible they can even turn-off the light that indicates the web cam is on," said Vellese.
A quick search on Google reveals all kinds of information for criminals looking to hack a web cam, security camera, or even a "nanny cam."
YouTube videos give them step-by-step instructions on how to do it.
So what can you do?
"Make sure your firewall is turned-on at all times and have your anti-virus, anti-malware apps running constantly," said Ackerman.
Plus, if you're not using the web cam, Special Agent Vellese says you may want to put a sticky note over the web cam or simply unplug it if it requires a USB cable.
The FBI considers the crime "cyber terrorism." If it happens to you, they advise getting help fast because odds are you are not the only victim.
"It's important to be able to reach out to law enforcement," said Vellese.
The FBI tells us young women are the most targeted for this kind of crime.
So parents will want to keep their kids' computers in open areas of the home so you can see what's going on. And you may want to have a conversation with your children about what they should do if someone contacts them saying they've been watching.
More info:
If you've been a victim, contact your local police department and the FBI's Cincinnati office at (513) 421-4310. You may also e-mail them at: email@example.com.
Most computer experts say you don't necessarily have to buy expensive anti-virus and anti-malware programs to keep your system safe. Just be sure to hit the "update" button every week so you have the latest level of protection.
Two free programs many computer experts like are AVG and Malwarebytes.
Our sister station, Hawaii News Now put together this amazing slideshow of viewer pictures from the islands. See the photos here. More>>
635 W. 7th Street Cincinnati, OH 45203 Switchboard: (513) 421-1919 Newsroom: (513) 421-0119 Press releases: firstname.lastname@example.com
FCC Public File firstname.lastname@example.com 513.421.1919 EEO Report Closed Captioning

subset: commoncrawl


text:
Facing the future
Good food for all
Enabling change
What is organic?
Farmers & growers
Latest blogs
Follow our bloggers
Trill Farm seed variety field lab update
Trill Farm:
Parsnips - Varieties sown are Student, Imperial Crown, Hollow Crown and the control is Tender and True. On the first visit on 21 May the parsnips were only just beginning to show.
03 September 2013 |
0 Comments
| Recommended by 2
Community Farm field lab - second visit
The Community Farm:
The Parsnip trial, sown 9 April, was overrun with weeds due to delays in field operations caused by the early cold weather and then the sudden change to warm dry conditions, leading to difficult choices having to be made about priority jobs. The varieties planted were Student and Imperial Crown. Control varieties are Tender & True and Pixie. No comparisons were possible and it was uncertain whether the crops could be rescued.
28 August 2013 |
0 Comments
| Recommended by 0
Trill Farm seed field lab in leafy Devon
Trill Farm:
My first visit was on Tuesday 21 May to record the progress of seed varieties, donated by various vegetable seed breeders. The trial is managed by Ashley and Kate Wheeler at Trill Farm near Axminster Devon. Ash and Kate are running their own business within a larger 300 acre organic farm on a level site of yellow clay loam incorporating several multi-span poly tunnels. Their main crops are salads intended to local restaurants and shops, including Hugh Fearnley-Whittingstall's River Cottage Café in Axminster.
31 May 2013 |
3 Comments
| Recommended by 5
Tweets by @SoilAssociation
Follow @soilassociation
Our bloggers
Kathie Auton
Anna Louise Batchelor
Lynda Brown
Helen Browning
Helen Carey
Margaret Finlay
Emma Heseltine
Jim Kitchen
Amy Leech
Traci Lewis
Ben Raskin
Charles Redfern
Tim Young
Log In


text:
Got no time and need to learn
new programming skills?
- More than just canned video
- Theory + Practice + Demos + Downloads + Resources + …
- Clear path to learning: increasing difficulty, milestones, assessments…
- Solid one-to-one tutoring support
- Keeping an eye on your progress: we'll push you forward if you lag behind
- Exclusive corporate features for your company: your own look & feel, supervisor accounts…
Any problem watching or listening to this video? Click here
Popular courses
Creating Business Web Apps with ASP.NET 4.0 Web Forms
$197,00 Add to cart -
Data Access with Entity Framework 5: Up & Running
$297,00 Add to cart -
Expert Web Development with ASP.NET MVC 4
$470,00 Add to cart -
Hands on SQL Server 2012: Expert Programming and Design
$397,00 Add to cart -
Jump to Windows Presentation Foundation (WPF)
$197,00 Add to cart
Join other 7000+ happy developers trained by campusMVP.NET
Keep calm
and really learn online
250,000+ real online training hours delivered
7,000+ happy coders trained
91% of our students give us an "A" in evaluations
These courses are as close to the experience of studying the topic at a university as possible.
Damir Arh
Where else can you get a certification in 3 months and have an expert on call?
Johnny Graber
I was pleasantly surprised by the quality and clarity of the course.
Sébastien Alves
Follow us
"Like" us
Google +


text:
Copyright © 2009 All rights reserved.
Current Biology, Volume 19, Issue 3, R93-R94, 10 February 2009
News focus
Add/View Comments (0)New energy thrust
Nigel Williams
- A new international agency aiming to promote renewable energy was set up last month. Nigel Williams reports.
Main Text
The United Nations held its most recent meeting in an effort to replace the expiring Kyoto protocol on climate change in Poznan, Poland in December. The culmination will be at a meeting in Copenhagen at the end of this year. But many are increasingly concerned that progress is too slow and that other measures are needed to speed things up.
So, at side meetings at the UN Poznan meeting, plans were firmed up for a proposed renewable energy agency which was formally launched last month. It marks the first worldwide lobby group designed to ensure the sector has a clear voice at the Copenhagen meeting and can bolster developments worldwide.
The agency says there is an institutional gap whereby the renewable energy industry is not adequately represented at the UN's climate change talks and other international negotiations relating to energy and climate change
Originally proposed by the German government and supported by Denmark, Spain, Poland, India and Ethiopia, the International Renewable Energy Agency (Irena) invited other governments to join the group, which will aim to promote the industry and advance the most effective models and technologies for renewable energy capacity in both developed and developing economies.
The agency says there is an institutional gap whereby the renewable energy industry is not adequately represented at the UN's climate change talks and other international negotiations relating to energy and climate change. Representatives from more than 100 countries turned up for the inaugural meeting of Irena in Bonn late last month.
The new agency "is an important step forward in fighting climate change. Irena will help us make informed decisions and to use renewable energy in a cost-effective way," said Connie Hedegaard, the Danish minister for climate and energy. "Support for Irena will make it much easier for us to reach an ambitious and truly global climate agreement in Copenhagen," she said.
And the plans have had broad appeal. In India, more than 50 per cent of the population is without access to electricity, and India hopes Irena will help develop rural electricity supplies from stand-alone, rather than centralised, sources.
Ethiopia, which is well endowed with potential renewable energy resources, is backing Irena as it seeks strategic help to develop these resources to help eradicate poverty in the country.
Sigmar Gabriel, Germany's environment minister, welcomed the launch of the new agency, arguing that it would help promote the emerging sector at a time when the global economic downturn has led to fears that some capital-intensive alternative energy projects may find it increasingly difficult to attract funding.
"This is precisely the right time for Irena," he said. "Climate change and the financial crisis demands a clear focus on future-oriented and sustainable technologies such as renewable energies."
But, at a meeting of the World Future Energy Summit last month in Abu Dhabi, there was disappointment that the UK and the US, then under President Bush, seemed unwilling to join up. The UK's reluctance appeared the more surprising as it has claimed to be seeking major renewable energy goals and has an ambitious wind-energy programme.
Britain is thought to be hesitant to put its name to the new agency because it is viewed with suspicion by the International Energy Agency. The IEA, established by the UK and the US in the aftermath of the 1970s oil price shock, does not want to see its role eroded. But many in the green energy sector have become more critical of the Paris-based IEA, claiming that it is more focused on oil and less concerned about new renewable energy sources. A recent report by the IEA was deemed by some critics to have underplayed the role of renewable energy sources, something it denies.
Britain wants to see itself as a leader in the fight against climate change and has trumpeted London as a centre for carbon trading and other clean technology innovation. But its results have often fallen short of the rhetoric and the credit crunch is having an impact. Other countries have been stealing the march in implementing renewable energy technologies.
The German environment secretary in Abu Dhabi called on the European Union to hold its nerve and stick to carbon reduction targets in the face of the credit crunch. James Alix Michel, president of the Seychelles, attacked the west for failing to do enough to tackle an issue which could put his entire country under water.
"The time for straddling the fence is over. We can save these communities if only we have the will."
And policies in the US may be set for major change. President Obama has made a pledge to pursue policies to develop renewable energy technologies so the US may soon turn out to be a major player in this newly expanding field.


text:
Genre: Dramatic Fantasy
Directed by: Federico Fellini
Starring: Marcello Mastroianni, Claudia Cardinale, Anouk Aimee, Barbara Steele
One of the undisputed classics of modern international film, 8 1/2 (its title literally meaning that it was Federico Fellini's eight-and-one-halfth film -- seven full features and a couple short segments of omnibus films precede it) is the movie where the greatest of all Italian filmmakers moved completely away from traditional realism toward a more personal approach to cinema. His goal was to reach a greater reality by eschewing reality in the conventional sense. The degree to which that approach succeeds probably depends more on the viewer than the filmmaker.
At bottom, 8 1/2 is a fantasy about a filmmaker, Guido Anselmi (Marcello Mastroianni), spending time at a health spa while trying to sort out his personal, artistic and spiritual life. Intensely personal, 8 1/2 basically depicts Fellini making a movie about trying to decide what movie he wants to make! "I really have nothing to say," Guido realizes, adding, "but I want to say it all the same." That may sound confusing, but it's really not -- it's merely self-revelatory in a way that few filmmakers (Jean Cocteau, Ingmar Bergman, and Ken Russell come to mind) have ever dared to be.
Rich in detail, humor and humanity, it's a deeply layered work that raises as many questions as it answers. Endlessly fascinating, brilliant even in its occasional flaws, 8 1/2 rewards first-time viewers and seasoned veterans alike with its introspection, invention and sheer joy of filmmaking. No one who genuinely cares about the art of film can afford not to see it.
-- reviewed by Ken Hanke
Read more articles in:
MoviesSubscribe to XpressMail. Free Sneak Peek. Every Week.
Related Articles
No commments yet.
Make a comment


text:
CD/LP/Track Review
Brad Goode: Hypnotic Suggestion (2006)
The rhythm section, comprised of Hall, pianist Adrean Farrugia (whose advanced harmonic conception and lyricism recalls Herbie Hancock) and bassist Kelly Sill, shifts gears seamlessly on Thelonious Monk's "Bemsha Swing. The rhythmic juxtaposition is excellent, especially during Farrugia's spot. Goode's fresh interpretation of the head is a delight; the opening theme statement and the restatement of the theme at the close of the piece differ significantly.
Another instance of Goode transforming a familiar tune is "Crazy Rhythm. Here he utilizes, as Harvey Pekar mentions in the liner notes, the "top half of a juice jug for a mute, which creates an interesting sound. He shows off some expert chops on this one, utilizing some double-tonguing and half-valving on the cute opening theme. Creative ideas seem to pour out of Goode's horn here and, again, he relishes his musical conversation with Hall.
Goode is at his fleetest on "Thinking of You, where his unexpected accents and sophisticated rhythmic approach yield a madly swinging solo. Indeed, everyone delivers excellent bop-infused solos on this piece. Other highlights include Goode's frenzied flurry of notes, growling phrases and glissandos on "Just A Thought, and a relatively free-form version of "Beautiful Love.
Brad Goode's ability to incorporate many different, often daring, elements in his playing sets him above many others who choose to play it safe. Recommended.
Track Listing: Hypnotic Suggestion; Once Upon A Summertime; Bemsha Swing; Just A Thought; Thinking of
You; Beautiful Love; Detroit Scene; I Can't Forget About; Crazy Rhythm.
Personnel: Brad Goode: trumpet; Adrean Farrugia: piano; Kelly Sill: bass; Dana Hall: drums.
Record Label: Delmark Records
Style: Straight-ahead/Mainstream


text:
Storing items under a bed is a brilliant use of under utilized space, but it can sometimes be tricky to access what you've placed there. Our Sliding Underbed Shoe Organizer solves that dilemma beautifully. It can hold up to six pairs of shoes, folded clothes and small handbags. Felt strips are included to protect floors and make it easy to slide out.
We can help! Click here to chat with an expert.
Item | Enter your zip code for product availability and pickup options at your nearest store. | Quantity | Price |


text:
Dammit Darwin, You Let Us Down: Idiot Moron Electrocutes Himself In Science Class, He & His Parents Want To Sue His Teacher, School
Nikola Tesla Jr. here decided it would be a good idea to attach two electrical clamps to his nipples in science class one day and stop his heart. But now he wants to sue his teacher for never informing him APPLYING LIVE ELECTRICAL CURRENT TO YOUR NIPS ISN'T SAFE. But you know what is safe? The chair. Here -- take a seat, dipshit.
[Kyle] Dubois (18) and his parents claim teacher Thomas Kelley did not tell him and other students of the dangers of the demonstration power cords in their electrical trades class.
They are seeking compensation for medical expenses, lost income due to time away from work and other damages related to the incident, which occurred on March 11.Dubois attached an electrical clamp to one nipple while another student attached another clamp to the other. A third student plugged in the cord.
Dubois was critically injured and his legal team claim he has suffered permanent brain damage.
Listen, I hate to break it to you but Kyle's brain was permanently damaged long before getting his balls shocked off. And to Kyle's parents: you ought to be ashamed of yourselves. If your child hasn't learned ELECTRICITY IS DANGEROUS AND SHOULD NOT BE APPLIED TO TITS by the time they're 18-YEARS OLD, you didn't do your job. If I was the school I'd counter-sue to make his parents build a time machine, go back in time, and never procreate. *banging gavel* This is the word of Judge GW.
U.S. student who electrocuted his nipples sues teacher...for not warning him it was dangerous [dailymail]
Thanks to Rob, who agrees Darwin must have phoned this one in.
Sad burglar is sad. Seen here looking like the sad idiot moron that he is, 25-year old stupid Cody Wilkins has been charged with a string of burglaries in Montgomery County, MD (MOCO FOR THE WIN -- GO QO COUGARS!) after leaving his cell phone charging at a house he was robbing... / Continue →
I'm not gonna lie bro, you wouldn't stand a chance at 'The Most Dangerous Game'. Some dipshit moron shot a fox and, having not killed it because he sucks at aiming, decided to try beating it to death with the butt of his rifle. Only thing was, the sly fox wasn't having it. T... / Continue →
Somewhere, a new universe was just born. Okay maybe not, but only because DK here chose to play Pokémon instead of his self-titled release. Way to go. On August 6, amateur photographer Chris Spicuzza was spending her day at the San Francisco Zoo, taking photos of the gori... / Continue →


text:
We kind of can't believe we haven't featured Kate Moss in a Style Crush yet, but the day after the supermodel announced that she intends to design her own wedding dress seems as good a time as any. Kate's a bonafide fashion icon who manages to mix masculine and feminine elements like no one else on the planet. Leather! Blazers! Shorts over tights! Man, we love this lady's style.
Style Crush: Kate Moss!
- 3 years ago by Liana Maeby
- No Comments »
- Share a Tip
Recommended by Crushable:
What We're Reading:


text:
CHARLESTON, W.Va. -- School systems in five West Virginia counties face severe budget shortfalls at the end of this fiscal year on June 30.
Those counties — Braxton, Calhoun, Mason, Monroe and Preston — have deficits in their operating budgets that are termed "more than casual" by the state Office of Education Performance Audits.
The deficits in each county is greater than 3 percent of the revenue the school system can expect from its voter-approved property tax, or have been a recurring theme in the county. They range from a little over $88,000 in Mason County to just under $2.5 million in Preston County.
In January, each county's school system submitted plans to the state Board of Education to reduce and eventually eliminate those deficits. The board approved those plans during a regular meeting Wednesday.
Board member Lloyd Jackson said budget problems could swiftly lead to larger problems in a county. To remedy budget issues is to avoid a state of disarray that requires intervention from the state Department of Education. Currently, six West Virginia county school systems are under state control: Grant, McDowell, Fayette, Gilmer, Mingo and Preston.
"Ultimately it hurts everybody when that happens," he said. "If you stay on top of this, you can avoid taking these counties over in most cases.
In at least one county, Preston, the budget shortfall can be partly attributed to a specific incident: in November Preston County voters rejected a renewal of the excess levy proposed by their local school system, leaving school officials scrambling to come up with the $1.7 million they expected to collect from that tax each year.
In other counties, though, the shift was more gradual.
Gus Penix, director of the Office of Education Performance Audits, said many of West Virginia's rural counties have seen gradual declines in enrollment, resulting in less funding from the state. Some school systems have neglected to decrease personnel in tandem with that shift, resulting in budget shortfalls.


text:
Non-greasy cream gel works overnight for nourished, smoothed and easy to style hair
For unmanageable, frizzy hair
This lightweight night treatment puts frizzy, unruly hair to rest. Featuring Olive and Argan oils, it nourishes and conditions the hair fiber overnight for easier styling in the morning. Wake up to beautifully smooth, manageable hair.
Incell: patented multi-dimensional ceramide that strengthens and conditions the hair.
Polymer AR: tames undisciplined hair with Argan and Olive oils, creating a moisture-safe seal against humidity
- Apply at night time
- Warm 1 or 2 hazelnut sized drops of product in the palm of the hands and apply the treatment through the mid-lengths and ends of dry or towel-dried hair
- In the morning, style as usual. Do not rinse.


text:
Hello GradCafe,In this somewhat chilly afternoon, I am trying to produce some progress before I head home for thanksgiving. I haven't visited this site (and the blog) for a while, it's a good time to take a moment and write something.After my journey with numerous rotations (let's say, more than 3, to remain anonymous on the internet), I settl...
Welcome to The GradCafe
Hello! Welcome to The GradCafe Forums.You're welcome to look around the forums and view posts. However, like most online communities you must register before you can create your own posts. This is a simple, free process that requires minimal information. Benefits of membership:
Guest Message © 2014 DevFuse |
Tall Chai Latte's blog
First year of grad school is almost over. Although I don't like the class I'm taking (ugh what a passive aggressive prof... whatev just let me pass), things are alright. Comparing to the first semester, It seems we are more on track. Rotation project accomplished, boss man has no complaints, looks like we are good for the next 3-4 years (I hope)....
So I'm writing once again to vent. One more month until the end of this semester, our program already sent out information regarding declare a thesis lab and a home department.Things did improve a lot compared to the last semester, which I'm glad. While fully engaged into science, what's lacking this time is the human interaction. A brand new...
The first semester as a grad student has come and gone. Seeing another round of application season coming upon us just made me realize how fast time flies, I was just in these applicants' shoes last year!Honestly, I didn't like my experience this semester at all. I followed the recommendation of our program director to sign up for 3 courses, w...
10/7 marks the first month of my grad school career. Over the past month, I saw a lot of things and experienced a lot of things. One of those is speed in research progress. My fellow scientists on this forum probably understand well that research is never a speedy process. Rather, it's an iterative process of observation, hypothesis, trial and error....
So school has started for two weeks. Settled into my apt, getting familiar with bus routine, talked to perspective rotation mentor... ok, sounds like we are moving along. This is my first rotation. First day in the new lab, I was asked to do a 5 minute presentation on what my project will be, given short notice. Within the following four days, I found tha...
It has nothing to do with graduate school admission, but that tension accumulates to a point that I can't hold it in anymore.The trigger of this emotional day was a scenario happened last Friday. I don't want to revisit the scene, but what happened was I took the ironic humor of my boss personal. It hurt.This is a lesson: how to take work as work...
I know people in my immediate surrounding are nice and wanting to help me with this decision of which school to attend. But it's getting too much, it really is. Can you guys just give me a break? I really haven't made up my mind yet, okay? I wish April is here.
It's been a while since I heard anything from schools. I've begun a series of emailing to different PIs, engaged in different conversations with PIs from my two admits so far. One reject but no big deal, the rest is... silence. On the result page, I did see someone posting interview notices to the places I'm still waiting to hear back. I wonde...
A little summary of events so far... and many thanks.
Posted by Tall Chai Latte,
22 January 2010
158 views
Grad school application process has been a roller coaster ride for me. Before I began filling out the apps, I had a huge fear that I might got rejected across the board because of my close-to-minimum-requirement GPA. I was totally aiming at my safety school, nevertheless, I picked a couple ambitious choices and notified my recommenders in mid september.Th...
← March 2014 →
1 | ||||||
2 | 3 | 4 | 5 | 6 | 7 | 8 |
9 | 10 | 11 | 12 | 13 | 14 | 15 |
16 | 17 | 18 | 19 | 20 | 21 | 22 |
23 | 24 | 25 | 26 | 27 | 28 | 29 |
30 | 31 |
Recent Entries
Back for an entry20 November 2011
Finally committed.... I guess?21 April 2011
Another dilemma30 March 2011
First semester blues12 December 2010
Slowing down12 October 2010
Recent Comments
Back for an entryMedievalmaniac - Dec 08 2011 06:09 PM
Back for an entrywaddle - Nov 22 2011 06:22 AM
Finally committed.... I guess?Amalia222 - May 07 2011 10:10 PM
Finally committed.... I guess?DrKT - May 03 2011 11:06 PM
Finally committed.... I guess?Tall Chai Latte - Apr 21 2011 01:38 PM


text:
The Emily Ann Gajek, N'96 and Marianne Gajek, B'97, Library Endowment Fund
The Emily Ann Gajek and Marianne Gajek Library Endowment Fund was established in May 1997 by Emily and Marianne's parents, Sarah and Marion Gajek, in honor of their daughters' academic careers at Georgetown. The fund is used for the general needs of the library, including the acquisition, maintenance, preservation of, and access to information resources.
[img_assist|nid=771|title=|desc=Emily Ann Gajek, N'96|link=none|align=none|width=147|height=209]
[img_assist|nid=772|title=|desc=Marianne Gajek, B'97|link=none|align=none|width=147|height=209]
- Information for:
- Undergraduates
- Graduate Students
- Faculty
- Staff
- Alumni
- Library Associates
- Visitors


text:
Daily tip from the lady archive
"The power of suggestion is potent. We ourselves know that. We feel better at once if we are greeted by a cheerful friend who remarks how well we are looking."
The Lady. The Power of Suggestion. 23rd May, 1929CARER/HOUSEKEEPER
Our client, a Wheelchair bound lady who works within healthcare is looking for a like-minded, supportive and flexible carer / companion to assist with her daily requirements and her full, personal and physical Care/Support.


text:
For the first time, researchers quantify the mechanical forces cells exert on one another.
For the first time, researchers quantify the mechanical forces cells exert on one another.
Scientists map the partial proteome of a common lactic acid bacterium.
With a single gene, scientists reprogram supporting cells in the spines of living mice into new neurons.
Researchers reveal the molecular mechanisms of Streptomyces platensis's defense from its own antibiotics, which inhibit fatty acid synthesis in other microbes.
The timing of meals affects the levels of lipids in the livers of mice, according to a study.
Molecular and Cellular Biology pulls five papers from endocrinologist Shigeaki Kato.
Some 1,300 species of microbes, including some associated with allergies and lung disease, are adrift in Beijing's thick smog.
In Chapter 1, "A Science Sutra," author David Barash describes how the ancient philosophy might form the perfect link between science and religion.
Me, Myself, and Why, RedDevil 4, Neanderthal Man, and Science from Sight to Insight
Fueled by her love of visual data and addicted to chromosomes, Abby Dernburg continues to study how homologous chromosomes find each other during gamete formation.


text:
NEW: Platinum Service
As a topbonus Platinum Card holder, your needs, queries and suggestions are very important to us. You can reach your personal topbonus agent on the exclusive Platinum Hotline between 8 am and 7 pm, Mondays to Fridays – all for the cost of a local call in Germany, Austria or Switzerland. Of course, the Platinum Service can also be reached by fax or email. At times when the Hotline is not available, our topbonus team staff will make it their priority to look after you.
This benefit can only be enjoyed by Platinum members.
Online services
topbonus cards
topbonus News
airberlin's frequent flyer program – register online now free of charge and get up to 500 Welcome-Miles!
Register now »
Forgotten your online password?
No problem! We will send you a new password for the topbonus Comfort Log-in via e-mail.
Forgotten online password »


text:
Vitals - A MultiCare Blog
Search The Blog
Media Contacts
Edwards Media Relations Manager 253-403-1716 253-222-5850 Email Marce |
Cosgrove Media Relations Coordinator Email Cole |
Health news feed
Health Insurance Rights for Same-Sex Couples ClarifiedHealth Insurance Rights for Same-Sex Couples ClarifiedFeds Extend High-Risk Insurance PoolsTom Arnold on losing 100 pounds: My son saved my lifeNew Pacemaker Can Be Inserted Without SurgeryTwins' Fate Highlights Anguish of Syrian RefugeesBack To Blog
Heart test that saved baby in Tacoma recommended for all newborns
A baby's heart defect was detected before he even left the Family Birth Center thanks to a newborn heart test offered to all healthy-appearing newborns at MultiCare Tacoma General Hospital.
"I feel very lucky that we decided to do the test. I feel very lucky that we were at Tacoma General," the boy's mother told KING 5 TV (see video below). "I think the stars aligned. Somebody was looking out for us, for him, and it essentially saved his life."
Called pulse oximetry, the painless test detects low levels of oxygen in the blood, which may be indicative of a heart defect. From 2008 until this year, Tacoma General Hospital was the only hospital in the state to offer the test to every healthy-appearing newborn. More than 9,000 day-old babies have been screened at Tacoma General.
Earlier this year, MultiCare Tacoma General Hospital's Family Birth Center and the MultiCare Mary Bridge Pediatric Heart Center were chosen to receive the 2011 Warren Featherstone Reid Award for Excellence in Health Care for their pioneering work in screening newborns for heart defects.
Posted on Dec 21, 2011 in In the News, Cardiac, Women's Health, Video & Photos, Voice of the Patient, Tacoma


text:
Jay Kay
This article's lead section may not adequately summarize key points of its contents. (March 2011) |
Jay Kay | |
Jay Kay at the 2007 Gumball 3000 rally
Background information | |
Born | 30 December 1969 |
Origin | Stretford, Lancashire, England |
Genres | Funk, acid jazz, pop, rock, R&B, soul, dance, disco, reggae |
Occupations | Musician, singer-songwriter |
Instruments | Vocals |
Years active | 1992–present |
Associated acts | Jamiroquai |
Jay Kay (born Jason Luís Cheetham;[1] 30 December 1969) is a Grammy Award-winning English musician, best known as the lead singer of the British funk/acid jazz band Jamiroquai.
Early life[edit]
Kay was born in Stretford, Lancashire, England.[2] Kay's mother, Karen Kay (born Adrianne Judith Pringle),[2] is a former cabaret singer and television personality. Kay's biological father is Luís Saraiva, a Portuguese former professional guitarist,[3] whom Kay did not meet until 2001.
After Jay Kay's identical twin, David, died some weeks after they were born,[4] Karen brought Kay up largely alone, which gave him "an itinerant childhood, half of it living in 'rural Suffolk and rural Devon'", according to his 2010 The Daily Telegraph interview[5] and his 1994/1999 television interviews.[6] It is stated in the 1997 Lancashire Evening Telegraph article that Kay "moved with his mother and step-father Mervyn Kay to Manchester as a youngster."[7] James Royal, often misidentified as Kay's stepfather, is Karen Kay's former manager with whom she had a relationship some time during Kay's childhood years. Royal had stated in his 2002 interview in News of the World about 13-year-old Kay's six-month stay in Thailand that he never married Karen Kay, but "still regards" Kay as his "stepson".[8]
Kay attended Oakham School in Rutland.[9]
Kay formed Jamiroquai with members Toby Smith (keyboards), Stuart Zender (bass), Nick Van Gelder (drums) and Wallis Buchanan (didgeridoo) together with guest appearances by Gavin Dodds (guitar), Maurizio Ravelico (percussion) and Johnny Thirkell (horns) amongst others, both on the band's debut album and on their first tour.
Jamiroquai has sold over thirty million albums, and has spent a collective 162 weeks on the UK singles chart between 1992 and 2006 with Kay's personal wealth said to be around £40 million.[10] He appeared on the Sunday Times Rich List 2004 at joint-950th. The Sunday Times Rich List 2008 has him tied for #1,794, with £40 million.
After the huge success of Jamiroquai's first single, When You Gonna Learn, a US$1.9 million, eight album deal was signed with Sony Music Entertainment. The band's first album was Emergency on Planet Earth. The relationship with Sony ended in 2007.[11]
The band's third album, Travelling Without Moving, generated international attention with the ground breaking video of Virtual Insanity which earned Jamiroquai four MTV Video Music Awards. Since then, their fourth album, Synkronized, has done just as well; it was recorded in Kay's home studio located in the garden of his 500-year-old, 11-bedroom Buckinghamshire mansion.
Kay has previously stated that he would like his band to continue writing music for another 15–20 years. However it was reported in February 2007 that Kay had wanted to quit music.[11] This was denied on Jamiroquai's official website the day after.
Kay is well known for his array of elaborate hats and headgear. When appearing professionally (in concerts, interviews etc.) he has been referred to as "the mad hatter" for his love of headgear.[12] It is said that he has many different hats that he wears at concerts and in public.[13] He has stated publicly that some of them were made by his own mother.[citation needed]
Kay's most recognizable headgear is his mirrored "feather headdress" seen on the cover of High Times: Singles 1992–2006.
TV performances[edit]
Kay appeared in an episode of the BBC series The Naked Chef alongside chef Jamie Oliver. He has also performed on the series Strictly Come Dancing singing Canned Heat. He also appeared four times in the BBC car show Top Gear. The first appearance was in Series 1 episode 2, where he set a lap time of 1:48.1 for the show's "Star in a reasonably priced car", becoming the leading highscorer for the rest of the current and most of the next series. His second appearance was in Series 3 episode 4, where he drove his Lamborghini Miura with Richard Hammond as passenger. The third appearance was in Series 11 episode 6, where he came in to beat the top time held by Simon Cowell. He succeeded with a lap time of 1:45.8. Jay Kay won Top Gear's "John Sergeant Award" for the best dance after learning his time on the Top Gear test track and the fastest lap time in 2008.
The day before Jamiroquai performed their new single, White Knuckle Ride, on The X Factor on 31 October 2010, Kay was quoted by The Sun as saying of the show's judges Cheryl Cole and Dannii Minogue: "What are they going to tell me about fucking music? ... When have you ever done anything? You're useless. The pair of you. I mean you look great and I'd like to fucking shag you but that's all." During his performance on the show, the pair talked continuously and refused to applaud at the end. Notably, neither of the other two judges stood up either.[14]
Paparazzi confrontations[edit]
In 2001, Kay was charged with assaulting a photographer and damaging his camera outside a nightclub. Kay pleaded not guilty and the charges were later dropped.[15] On 12 September 2006, Kay was cautioned by police over an incident outside a London nightclub. He allegedly assaulted two photographers.[16]
Personal life[edit]
Kay is anti-religious.[17]
From 1998 to 2001, Kay dated Denise Van Outen. They were engaged and reported to be on the verge of marriage,[18] but split up in 2001; Jamiroquai's album A Funk Odyssey is mostly about their breakup.
In a 2010 interview, Kay indicated that at one time he had a "substantial" cocaine habit. He has however been free of drugs since 2003.[19]
Kay continues to support the Burma Campaign UK and the need for democracy in Burma. He is also a patron of the Captive Animals Protection Society, a charity campaigning for an end to the use of animals in circuses, zoos and exotic pet trade. He has spoken out against animal exploitation for entertainment.[20]
Cars and vehicles[edit]
Kay has a strong interest in exotic cars and has owned over 60 luxury cars, mainly sports cars. His love of cars was expressed with the release of the album Travelling Without Moving. The album's cover featured an adaptation of the "Buffalo Man" logo and the Ferrari crest, In 2011 he visited Maranello for an exclusive viewing of the then-new Ferrari 458 Spider.[21] Three of his cars appeared in the video for the song Cosmic Girl. In total he has 68 vehicles, including what he calls "staff cars" and a 'one off' Ferrari.[22]
A combination of cars and music is also evident in the song Black Devil Car on the album Dynamite which is a tribute to his black Ferrari Enzo. The Enzo suffered damage to the windows after an altercation with hotel chef Aaron Billington at the Brudenell Hotel in Aldeburgh, Suffolk.[23]
In addition to his well-known large collection of Ferraris, Kay has more recently professed to becoming a fan of Porsche cars. He now owns a black 356 Speedster, a blue 911 Carrera RS, and a 911 GT3 RS in orange livery. A 1973 Porsche Carrera RS has been used in the clip of "White Knuckle Ride", one of the last singles of the band, included in their last album.
Kay's love of fast cars has occasionally landed him in legal trouble. In May 1998, Kay was caught driving at 111 mph (179 km/h) and his licence was suspended for 42 days. He said in an interview: "I should count myself lucky. I've clocked up 175 mph on a public road. If I'd been caught doing that, it would have been a prison sentence." He appeared in court in Scotland to face charges for speeding after being clocked at 105 mph (169 km/h) in a Mercedes-Benz G-Class, on 26 February 2004. The speed limit for the road was 70 mph (110 km/h). He was later banned from driving for six months.
Kay participated in the 2007 Gumball 3000 rally as part of Team Adidas in a brand new Maserati Quattroporte. In 2010 he took part in the Mille Miglia in his Maserati A6G/54.
He holds the record on the BBC show Top Gear for the fastest lap in the (now retired) Chevrolet Lacetti on the "Star in a Reasonably-Priced Car" segment. His time of 1:45.83 was four-hundredths of a second ahead of Kevin McCloud, one-tenth of a second ahead of Brian Johnson, lead singer of the rock band AC/DC, and one tenth of a second above then-leader, Simon Cowell. He was invited back as Cowell had been "on the top for long enough". Kay also competed in the Celebrity Challenge race at the 2012 Silverstone Classic finishing third behind Brian Johnson and Kelvin Fletcher.
Kay is also a motorcycle enthusiast and attended the Ace Cafe to see Charley Boorman off for his television series By Any Means. He rides a Rizla Suzuki GSXR-600. He owns a motorhome, and holds a C LGV (class 2) driving licence in order to legally drive it. He reportedly persuaded his close friend James Martin to also purchase one. Kay also leases a Robinson R44 helicopter, registration G-JKAY.
See also[edit]
- List of number-one dance hits (United States)
- List of artists who reached number one on the U.S. Dance chart
- ^ Schmidt, Veronica (3 March 2009). "Jamiroquai frontman Jay Kay's Ferrari Enzo smashed up". The Times (UK). Retrieved 31 May 2011.
- ^ a b "Star's secret past (From This Is Lancashire)". thisislancashire.co.uk. Retrieved 6 December 2010.
- ^ Jeremy Hart (7 September 2003). "Me & my motors: Jay Kay". The Sunday Times (UK). Retrieved 10 December 2010.
- ^ "Interview: Jamiroquai singer/songwriter Jason Kay - News". Scotsman.com. 2010-10-21. Retrieved 2013-06-27.
- ^ "Jay Kay interview". Telegraph. Retrieved 2013-06-27.
- ^ [1][dead link]
- ^ "Archive | Homepage". This Is Lancashire. 1997-03-10. Retrieved 2013-06-27.
- ^ [2][dead link]
- ^ "The 'fact' merry-go-round undermining Wikipedia". Channel 4 News. 18 Jan 2012. Retrieved 2012-07-08.
- ^ "Jay Kay". The Sunday Times. UK.
- ^ a b "Jay Kay quits music". Digital Spy.
- ^ "Mad hatter". The Sydney Morning Herald. 25 November 2005.
- ^ Ozler, Levent (3 July 2005). "Jamiroquai to Launch Fashion Line". Dexigner. Retrieved 17 November 2011.
- ^ "Cheryl & Dannii 'Snub' Jamiroquai's Jay Kay". MTV UK. 1 November 2010. Retrieved 17 November 2011.
- ^ Joe D'Angelo and Gideon Yago (20 November 2001). "Jamiroquai's Jay Kay Is A-OK After Assault Charges Dropped". MTV News. Retrieved 18 March 2009.
- ^ "Jay Kay cautioned after attacking paparazzi". Daily Mail (UK). 12 September 2006. Retrieved 18 March 2009.
- ^ Robert Copsey (1 November 2010). "Jay Kay: 'Album is anti-religion'". Digital Spy. Retrieved 7 July 2012.
- ^ "Jay Kay: 'I will marry Denise'". BBC News. 19 November 1999. Retrieved 17 November 2011.
- ^ Craig McLean (19 October 2010). "Jay Kay Interview". Telegraph. Retrieved 23 October 2010.
- ^ "Exclusive: The Jay Kay interview". Captive Animals' Protection Society.
- ^ "Jay Kay Checks Out Ferrari 458 Spider". 13 September 2011.
- ^ "Top Gear, Series 11, Episode 6, during the interview in the segment, Star in a Reasonably-Priced Car". 27 July 2008.
- ^ "Angry Chef Trashes Rock Star's Ferrari Enzo". 4 March 2009.
- Alumni of the University of West London
- Blue-eyed soul singers
- British funk musicians
- Car collectors
- English atheists
- English male singers
- English people of Portuguese descent
- English rhythm and blues singers
- English singer-songwriters
- English soul singers
- Grammy Award-winning artists
- Ivor Novello Award winners
- Jamiroquai members
- Living people
- People educated at Oakham School
- People from Stretford
- Twin people from England
- 1969 births


text:
Sur La Table® Stainless Steel Slotted Spoons
- $12.95 - $14.95
This durable, non-corrosive 18/10 stainless steel spoon allows you to drain liquids effortlessly. It has an ergonomic handle for easy use during cooking and serving. 12½" l x 2¼" w. Dishwasher safe.
- Care: Dishwasher safe
- Dimensions: 12½" l x 2¼" w
- Material: 18/10 stainless steel
- We've capitalized on our familiarity with the world's top brands to select the best features
- Designed with all types of cooks in mind
- Exceeds expectations of both accomplished and beginning cooks
- Constructed of durable, non-corrosive 18/10 stainless steel
- Drain liquids effortlessly
- Ergonomic handle for easy use during cooking and serving
- Made in China


text:
Fun Wheels Wheel Cover 007-18
Evo Bearing Cap 36x10
PR200 Chain W15120010012
View Full-Size Image
Ask a question about this product
PR200 Chain W15120010012
Pocket Rocket Parts
Razor Motors, Chains and Belts
Customer Reviews:
There are yet no reviews for this product.
Please log in to write a review.
Write a review for this product!
First: Rate the product. Please select a rating between 0 (poorest) and 5 stars (best).
Now please write a (short) review....(min. 0, max. 4000 characters)
First Name
Last Name
Characters written:


text: A source tells Hollywoodlife.com, "I don't know what the white girl was doing. I mean she was trying to push up on him real tough but she wasnt a problem. She was just real damn funny and talking and being wild. All Chris could do was laugh. I mean,she didn't have no shoes on either. She was drunk having a good time and when she got in the car and sat on my man's lap, it was all over! He was like 'what is going on' but in the end, it was just fun.''


text:
West Virginia Firearms Protection Act
Make law a "Firearms Protection Act" bill would make any federal law banning semi-automatic firearms or limiting the size of gun magazines unenforceable within the state's boundaries. Anyone trying to enforce a federal gun ban could face felony charges under the proposal. Add new laws as necessary laws to uphold the peoples 2nd amendment constitutional rights. Abolish any old laws infringent upon our 2nd constitutional rights
Recent signatures
nelson kesnerUnited States
1 year ago -
stephanie kinnamonUnited States
1 year ago -
RANDY RITCHIEUnited States
1 year ago
Petition highlights
There are no highlights yet.


text:
His mother escaped her murdering husband just before he was born. Now the son of Bluebeard must break his father's curse.
Your strange travels continue in this sequel to the exciting game that took you on an Amaranthine Voyage…
Something wicked has taken over Fate's Carnival!
An epic adventure to save your father and the kingdom!
Defend your base and win the war!
Lend a helping hand!


text:
Free Shipping over $75 | Low Price Guarantee | No Sales Tax except CA |
Ecotrition Canary Moulting Food is a unique nutritional blend enriched with vitamins and minerals essential for maintaining optimum health during stressful moulting periods.
Join Us! Email Sign Up |
Customer Service |
Pet Shops |
Contact Us |
Follow Us |
© Copyright 2014 PetMountain.com |