text:
Challenge-response and probative methods together or independent of each other enable detection of devices participating in denial of service (DOS) and distributed DOS (DDOS) attacks upon a network resource, and upon identification of devices participating in attacks, minimize the effect of the attack and/or minimize the ability of the device to continue its attack by placing the attacking devices in a state of reduced or denied service.
1. A computer implemented method for detecting denial of service attacks, comprising the steps of:
issuing a bit encoded login challenge composed of human viewable images not composed of machine readable text in response to a login request to said computer from a requester of services; and
responsive to an incorrect response to said challenge, said computer placing said requester in a state of limited service.
2. The computer implemented method of
filtering out to said state of limited service iterative connection requests from a network address of a hacker device.
3. The computer implemented method of
responsive to speed, latency and average queuing network delay of connection requests, detecting and placing in a state of limited service repetitive login requests from a hacker device.
4. The computer implemented method of
determining from said speed, latency and average queuing network delay a time-out value; and
detecting as a request from a hacker device a request that does not complete within said time-out value.
5. The computer implemented method of
issuing further challenges to subsequent requests for service from said requester and selectively responding to successful responses by continuing service at the same or improved level and to unsuccessful responses by further reduction or complete denial of service.
6. The computer implemented method of
periodically issuing said challenges throughout connection to a requester successfully responding.
7. The computer implemented method of
8. The computer implemented method of
9. The computer implemented method of
10. The computer implemented method of
11. A computer implemented method for detecting denial of service attacks, comprising the steps of:
executing a bit-encoded challenge and response login procedure and a network probing test frame transmission and analysis procedure to detect a hacker denial of service attack, said bit-encoded challenge comprising human viewable images not composed of machine readable text;
said network probing test frame transmission and analysis procedure including defining a signature of discrete speed, streaming speed, and latency of the connecting device failing said bit-encoded challenge-response login procedure, and adding said signature to a router based filter for filtering out login requests from said hacker responsive to said signature; and
responsive to detecting said denial of service attack,
placing said hacker in a lower level of service state.
12. A computer implemented method for detecting denial of service attacks, comprising the steps of:
selecting sending and receiving probative test packets through a network;
responsive to said packets, determining network evaluation parameters for said network;
responsive to said network evaluation parameters, determining presence of network denial of service attacks, said network evaluation parameters including response time and throughput characteristics of said network, said throughput characteristics including capacity, utilization, and performance; and
executing a bit-encoded challenge and response procedure to discourage and repel said attacks, said bit-encoded challenge comprising human
viewable images not composed of machine readable text.
13. The computer implemented method of
determining a latency and speed fingerprint of an offending device;
responsive to said fingerprint, operating a router filtering system to reject packets from said offending device.
14. The computer implemented method of
15. A computer implemented probative test and analysis method for detecting and responding to denial of service attacks on a network resource, comprising the steps of:
creating a template of attack patterns;
determining historical, current, and predicted states of said network for each of a plurality of types of network traffic;
responsive to said attack patterns, determining if a spike in network traffic is a distributed denial of service attack and, if so, determining its source; and
denying full service to sources associated with said service attack.
16. The computer implemented method of
determining unique speed and latency network attachment characteristics of devices attempting to connect to said network resource; and
responsive to detection of an abusive behavior from a said device, responding to subsequent requests for service from said device by denying said full service to said device.
17. A computer program product for detecting denial of service attacks, comprising:
a computer readable medium;
first program instructions to issue a bit encoded login challenge comprising human viewable images not composed of machine readable text in response to a login request from a requester of services;
second program instructions, responsive to an incorrect response to said challenge, to place said requester in a state of limited service; and wherein
said first and second program instructions are recorded on said computer readable medium.
18. The computer program product of
third program instructions for filtering out to said state of limited service iterative connection requests from a network address of a hacker device; and wherein
said third program instructions are recorded on said computer readable medium.
19. The computer program product of
third program instructions, responsive to speed, latency and average queuing network delay of connection requests, for detecting and placing in a state of limited service repetitive login requests from a hacker device; and wherein
said third program instructions are recorded on said computer readable medium.
20. The computer program product of
third program instructions for determining from said speed, latency and average queuing network delay a time-out value;
fourth program instructions for detecting as a request from a hacker device a request that does not complete
within said time-out value; and wherein
said third and fourth program instructions are recorded on said computer readable medium.
21. The computer program product of
third program instructions for issuing further challenges to subsequent requests for service from said requester and selectively responding to successful responses by continuing service at the same or improved level and to unsuccessful responses by further reduction or complete denial of service; and wherein
said third program instructions are recorded on said computer readable medium.
22. The computer program product of
third program instructions for periodically issuing said challenges throughout connection to a requester successfully responding; and wherein
said third program instructions are recorded on said computer readable medium.
23. The computer program product of
third program instructions for issuing said bit-mapped challenge as logon image from which a user must select or enter a response; and wherein
said third program instructions are recorded on said computer readable medium.
24. The computer program product of
fourth program instructions for occasionally shifting the input area for a valid response to said challenge; and wherein
said fourth program instructions are recorded on said computer readable medium.
25. The computer program product of
third program instructions for slowing acceptance from and response to systems in a degraded service category; and wherein
said third program instructions are recorded on said computer readable medium.
26. The computer program product of
third program instructions for counterattacking by executing a denial of service response to attacking systems; and wherein
said third program instructions are recorded on said computer readable medium.
27. A computer program product for detecting denial of service attacks, comprising:
a computer readable medium;
first program instructions for executing a network
probing test frame transmission and analysis procedure including requiring response of a user to presentation of human viewable images not composed of machine readable text to detect a hacker denial of service attack;
second program instructions, responsive to detecting a denial of service attack, for placing said hacker in a state of lower level of service; and wherein
said first and second program instructions are recorded on said computer readable medium.
28. A computer program product for detecting denial of service attacks, comprising:
a computer readable medium
first program instructions to selectively send and receive probative test packets through a network;
second program instructions, responsive to said packets, to determine network evaluation parameters for said network;
third program instructions, responsive to said network evaluation parameters, to determine presence of network denial of service attacks, said network evaluation parameters including response time and throughput characteristics of said network, said throughput characteristics including capacity, utilization, and performance;
fourth program instructions to execute a bit-encoded challenge and response procedure to discourage and repel said attacks, said bit-encoded challenge comprising human viewable images not composed of machine readable text; and wherein
said first, second, third, and fourth program instructions are recorded on said computer readable medium.
Copending U.S. patent application Ser. No. 09/746,183, filed Dec. 21, 2000 by F. K. Klassen & R. M. Silverman, entitled "System and Method for Determining Network Throughput Speed and Streaming Utilization" (hereafter, Silverman 1), and Ser. No. 09/746,179, filed Dec. 21, 2000 by F. K. Klassen, R. M. Silverman, and H. R. Gail, entitled "System and Method for Determining Network Discrete Utilization" (hereafter, Silverman 2) are assigned to the same assignee hereof and contain subject matter related, in certain respect, to the subject matter of the present application. The above-identified patent applications are incorporated herein by reference.
1. Technical Field of the Invention
This invention relates to monitoring and analyzing a communications network for the purpose of detecting "hacker" attacks and computer terrorism, and to providing for defense and counterattack. More particularly, the invention relates to measuring and monitoring of network performance and throughput, including detection of abnormal conditions indicating presence of computer hacker denial of service attacks and reaction to such attacks by a variety of means of depriving required resources to the hacker.
2. Background Art
Managers of information systems for public and private enterprises are required to provide ever increasing network access to their information systems. As business requirements for connection to the Internet grow, system security concerns increase in lock step.
In implementations of information systems prior up to the mid-1960s, no remote system access was possible. Data was fed into and out of computers from consoles, card punches, and card readers all of which were direct-cable attached into the computer. No one outside of the "glass house" (i.e., computer room) had access to the system. The art of data-communications network security did not exist. Security was a local issue enforced by password protection, so that without the proper password, access to the data processing application would be denied. Password protection ensured that no changes could be made to the system or its contents by unauthorized parties.
Later in the 1960s, remote console and remote card read and punch system access became possible using permanent leased line or dial telephone facilities. A user of the system no longer needed to be physically present in the computer room in order to view or to modify information or programs stored in the system. In order to protect information systems from unwanted access and modification, either of which could damage or destroy a business or organization, new means of protection were devised.
For leased lines, security was ensured by identifying to the computer's operating system the specific communications port to which the leased line was connected. Since the communications port on the computer was telephone wired (by telco modem) directly to the phone company's switching station and thence through other switching stations to the modem and communications port of the console or card/read punch at the remote location, it was extremely difficult for someone to achieve unauthorized access to a computer through its communications port. Specifically, to breach the leased line security at the operating system level would require tapping into the phone line, mimicking the remote device, and having the valid application password.
Unlike a leased line connection which is permanently "hard wired" end to end by the telephone company, anyone with a telephone handset can dial the phone number of a computer system that accepts incoming dial calls. So security for computers in dial environments was achieved by either allowing only outgoing calls (and refusing all incoming calls) or else by accepting dial calls and then using a dial-back method. In the dial-back method, a user of a remote console or card device desiring access to the central computer would dial into the system over a public dial network number, providing the remote user's own phone number. The computer at the data center would then terminate the call, check to see if the remote caller's phone number was on the approved phone number list, and, if it were, then the data center's communications equipment would dial the remote user so that communication could occur. As with leased line connections, operating system-level security together with application program-level password security effectively prevented unauthorized access to the computer system. Overall then, in systems of the 1960s and through the 1980s, the user's i.d., the user's device, the user's network connection, and/or the user's password uniquely identified the user for purposes of authorization for system access.
While the dial-back method helped ensure system security at levels comparable to that of the hardwired leased line environment, the dial environment had a security issue peculiar to it and from which leased line systems did not suffer. Anyone who knew the central computer's dial port phone number(s) could repeatedly dial into the system, thereby tying up all of the computer's dial access ports and preventing access by legitimate users. Moreover, system resources would be occupied by the burden of repeatedly checking authorization and rejecting the unauthorized caller, thereby consuming valuable computer system resources, farther disrupting the computer services of the organization. For this reason, armed forces and police agencies kept computer dial access numbers strictly confidential, revealing them only on a "need to know" basis. Businesses learned to do this as well. For example, during the oil shortages of the 1970s, when petroleum product prices skyrocketed, oil companies became highly conscious of ensuring that their computer access dial numbers were kept in strictest confidence for fear that disgruntled parties would "jam" their computer systems with unwanted calls. So, where systems were exposed to general access through the public dial network, the art of network security consisted in part of simply keeping the dial numbers secret in order to prevent disruptive jamming attacks.
In the 1990s businesses and organizations of all types found themselves with a requirement to attach to the Internet in order to engage in commerce with or provide information to the public. The primary purpose of communications systems prior to the Internet was to enable the members of an organization to connect to their own organization's computer systems. In the Internet environment, organizations connect to the worldwide web often for the express purpose of allowing anyone from anywhere to connect to their system. The procedures for system security that predated the Internet, namely, end-to-end hardwired leased line connections, dial-back, and application password protection that had worked well for intra-organization communication needed upgrades to meet the challenges of the new, open environment. In particular, the procedures of leased line connections, dial-back mechanisms, keeping access numbers (network addresses) secret, and operating system definitions and authorization lists were designed specifically to prevent "strangers" from accessing the organization's computer systems. In the Internet environment, it is often desirable for the organization to make its systems known to worldwide web search engines precisely for the purpose of ensuring that anyone, anywhere can locate the systems, traverse the Internet, and gain access to the organization's computing systems.
With "strangers" everywhere able to access the systems of virtually every major organization across the Internet, new procedures were developed for protecting the computer-resident resources of organizations. The new procedures included use of the TCP/IP protocol and firewall technology.
TCP/IP protocol includes the addressing of network transmission packets by means of sockets. A socket consists of an IP network-level address (representing the address of the device's network adapter) plus a TCP application-level address. Each network packet contains a "from" socket and a "to" socket. These sockets represent the originating device's network address and application identifier and the target device's network address and application identifier. Sockets provide a basis for network security because they identify the location of the packet's originator as well as the service (i.e., application) being requested. At the destination site, incoming packets can be examined and it can be determined, for example, whether or not the incoming packet's source address is that of a device that belongs to the organization, and whether or not the application service being requested is a secure (private) or non-secure (public) service. A special device can be set up to "filter" incoming requests by examining their source and destination sockets and thus serve as a gatekeeper that protects an organization's internal processing systems from intruders while allowing all corners to access to the organization's public processing systems. These special devices are called "firewalls," and they examine incoming packets' source and target sockets and determine from customized tables whether the request should be forwarded or discarded. A firewall would be used by, say, an automobile manufacturer to make sure that anyone can connect to its systems through the Internet to get general information about the models it sells and currently available rebates, while also making sure that only authorized parties can access the systems that process that company's accounts payable systems. Often firewalls are set up "behind" the organization's publicly accessible systems so that they only examine packets addressed to the organization's private, restricted-access systems in order to deny service to unauthorized parties. In this design, firewall devices are thus spared the overhead of examining packets targeted for the publicly accessible systems and only examine packets targeted for the organization's private systems and applications.
However, the current art for network and system security, which uses TCP/IP socket protocol and firewall technology does not provide complete protection for an organization's systems. Just as systems with dial ports have an exposure to "jamming" by anyone with a telephone, Internet connected systems have a similar exposure to anyone with an Internet-connected computer. Exacerbating the problem is that while it is possible and desirable for an organization to keep its computer dial access numbers secret, it is usually not desirable to do so with web addresses of systems designed for public access. This leaves the systems of Internet-connected organizations open for attacks, including jamming attacks known as denial of service (DOS) attacks or distributed denial of service (DDOS) attacks, in which streams of traffic are directed at an organization's Internet-connected systems.
An article from the New York Times illustrates the magnitude of the problem and the current helplessness of even state of the art facilities to cope with such attacks:
As this article illustrates, the current art contains no effective means of defending public web sites from DDOS attacks.
Initially, DOS attacks came from individual machines from which individual hackers streamed data (e.g., ping echo packets) to web-attached servers in an effort to flood the network and burden the server with the overhead of handling the stream of data. Attacked parties learned how to diagnose, stop, and take network traces (a log of all network traffic) of DOS attacks by "lone wolf" hackers.
Today, hackers have the upper hand, because they have learned how to take control of or "borrow" multiple web-attached computers in different organizations ("masters"), use these master machines to infiltrate many more computers in different organizations ("zombies"), embed DOS attack code scripts (or, trojan-horses) in the zombies through the masters, and then issue commands from the masters to the zombies to run the scripts directed at the server(s) of a targeted organization.
The hackers, twice removed from the attacking zombie machines, are difficult to trace. The attacks coming from many different zombies in many different networks comprise DDOS attacks that are hard to detect and control. The scripts run by the zombies are a nasty assemblage of echo packet floods, status requests, incomplete logins, deliberate causes of connection error conditions, false reports of errors, and transmissions of packets requiring special handling. These vicious scripts, run from hundreds or thousands of zombies, are designed to flood the network, tie up system control blocks, and siphon web server computing power to the point that the attacked webserver network and system can no longer provide service to legitimate users. All the while, the zombie computers causing the damage are owned by legitimate organizations which have no idea that their systems are being used in attacks on other organizations.
The current best procedure for defending against such attacks, as documented in the CERT web site, consists of owners of web sites monitoring the network and server equipment they own for conditions of abnormally high utilization. When detected, high utilization is reported to the Internet Service Providers (ISPs) through which the organization connects to the Internet. Each ISP network connects to a large number of organizations. The ISPs then search their networks in order to find areas of low utilization. The ISPs trace (i.e., record) all user traffic in that area of low utilization, and then scan the recorded traces looking for devices that are issuing sequences of commands of type and frequency that attacking zombies would issue. Zombies are easier to locate in areas of lower as opposed to higher utilization because the zombies contribute a relatively higher proportion of the records in the trace log, so their activity is more readily identified. Once a zombie is located, the ISP can trace all traffic from that zombie to the attacked system, thereby enabling those fighting the attack to better understand its nature. And although commands from the master computers to the zombies are not necessary once an attack has started, an ongoing trace of the zombie's activity can, with luck, record commands being sent from the zombie's master (the computer which has loaded attack code scripts into the zombie and activated the attack) . When a master is found, it is possible not only to regain control of the master, but also to reclaim all of the zombies under its control. With very good luck, it may also be possible to take traces from a master computer and locate the hacker controlling the master, although skilled hackers usually perform "hit and run" operations in which they start and stop attacks and erase their footprints in a matter of hours, long before the currently available problem diagnosis and identification processes can be effectively employed . A sixteen year old Canadian boy who brought down the sites of Amazon.com, Yahoo, e-Bay, and Charles Schwab, was identified months after his attacks not as a result of the extensive forensic diagnostic effort undertaken in response, but rather because the youth bragged in an online chat group (Ellen Messmer and Denise Pappalardo, Network World, Feb. 12, 2001).
The current procedure thus has deficiencies in the speed with which attacks are detected and the speed and efficacy of reaction to such attacks. In the future, the weak security functions and administration processes that allow hackers to take over innocent systems will be improved, making creation of armies of zombies by hackers a much more difficult task. In addition, filtering intelligence, which currently runs at the processor level and is therefore too slow and expensive to apply in a sophisticated manner to all traffic entering a web site, will be embedded into the microcode on the router cards that control individual network interfaces.
The distribution and lowering of cost of router function can be expected to improve early recognition of attacks and quick reaction by invocation of filtering to slow or stop DDOS attacks. And in the future environment in which distributed filtering prevents attacks involving floods of administrative requests, it can be anticipated that hackers will attempt DDOS non-administrative flooding of servers.
In response to the current DDOS environment, it is an object of the invention to provide system and method for faster, more effective detection of utilization spikes associated with DDOS attacks.
It is a further object of the invention to provide a system and method for prevention of both administrative and non-administrative message flooding DDOS attacks.
In accordance with the a first aspect of the invention, a system and method is provided for detection of DDOS (distributed denial of service) attacks, including issuing a bit mapped challenge in response to a login request from a requester of services; and responsive to an incorrect response to the challenge, placing the requester in a state of limited service.
In accordance with a second aspect of the invention, a system and method is provided for detection of DDOS attacks, including executing a network probing test frame transmission and analysis procedure to detect a hacker denial of service attack; and responsive to detecting a denial of service attack, placing the hacker in a lower level of service state.
In accordance with an aspect of the invention, there is provided a computer program product configured to be operable to detect and respond to distributed denial of service attacks.
Other features and advantages of this invention will become apparent from the following detailed description of the presently preferred embodiment of the invention, taken in conjunction with the accompanying drawings.
In pending patent applications Silverman 1 and Silverman 2, methods are provided for determining the discrete speed and utilization of a network and the streaming speed and utilization of a network. Discrete (i.e., individual) packets and streams of packets travel at different speeds across any given multihop connection. The stream has a rate approaching the bottleneck facility speed in the connection, while discrete packets travel at a slower speed. End-to-end discrete utilization increases incrementally for each hop with competing traffic in the connection, whereas streaming utilization has effect only on that hop having the lowest available throughput.
By means of the system and method described in the predecessor patent applications, the end-to-end discrete and streaming speeds and utilizations of the network can be computed for any connection.
One level of DDOS detection consists of using the system and methods described to detect spikes in streaming and discrete utilization. Since this method works across both the network of the web server under attack and the network of the ISPs across which the attack is occurring, the attacked party will (1) recognize the attack more quickly than before; (2) recognize areas of higher network utilization and lower utilization in both the intranet and in the connecting ISP networks so that the organization under attack can provide fast guidance to the ISPs as to the location of areas of low utilization (where traces can be taken with a degree of probability of locating instances of zombies) and high utilization (where defensive ISP router filtering scripts may most profitably be invoked) instead of relying on the ISPs to perform this activity; and(3) be able to "fingerprint" the utilization patterns of zombies and identify their occurrences thus enabling faster recognition of attacks and faster diagnosis of the origin of the attacks.
In accordance with a preferred embodiment of the invention, a system and method is provided for preventing DDOS attacks. DDOS attacks are accomplished by hackers who infiltrate sets of computers (masters) and then use each master to infiltrate "trojan-horse" code scripts into a large number subservient computers (zombies). The zombies' scripts are then activated at some point of time in a coordinated attack on an organization's web server system. Zombies are "borrowed" machines that run scripts to attack.
Referring to
Organization 1 has a set of three web servers S1–S3 in its intranet 20 that are connected to Internet 22. In this instance, although it is not necessary, they are depicted as being protected by a firewall 24. Since servers S1–S3 are intended for public access, firewall 24 is optional. Not depicted is a possible connection between this intranet 20 and a more secure intranet which would house servers belonging to Organization 1 that are not intended for public access. These latter servers, which might house applications such as accounts payable and receivable, would certainly be protected by a firewall which filters traffic in an effort to allow only authorized parties to access those secure servers.
Three test stations T1–T3 are depicted in Org 1's intranet 20. Not all three are required. However, T2 depicts that a test station can be located within an application server S3, T3 within or adjacent to the firewall 24, or T1 anywhere else within intranet 20.
The application service provider (ASP) intranet 26 has the same setup. This is a third party entity that for a fee hosts web services for organizations such as Organization 1. Akamai is an example of an ASP.
Test stations T1–T3 can perform testing within the Org 1 intranet 20. Test stations T6–T8 can perform testing within the ASP intranet 26. For example, T1 can test T2, T3, S1, S2, and S3. T4 belongs to Org 1 but sits outside the Org 1 firewall and is not part of the Org 1 intranet. T4 is connected to internet 22 without firewall separation. It can perform testing anywhere in and across the internet up to any firewall. So T4 can test Z4, T5, and T9.
Testing is ordinarily performed by means of ICMP pings. ICMP is part of the TCP/IP protocol stack, so nearly all Internet connected devices respond to pings. Ordinarily, firewalls do not allow pings to pass, so testing is normally easy within networks and up to their firewalls. Firewalls that do not pass pings can be successfully passed through for testing if there is a port (an application address) for which the firewall does not block traffic and for which the testing station and receive station are programmed to communicate. Such programming is also required for one way pinging, as described in Silverman 1 and Silverman 2.
By way of example, in operation, suppose a hacker has taken over and zombified (that is, infected with a trojan-horse code) Z1, . . . ,Z4. Suppose Organization 1 services web users through servers S1, . . . ,S3 in its intranet 20 as well as through S4, . . . ,S6 in the ASP intranet 26. Org 1 pays a fee to the ASP and both the ASP and Org 1 have test equipment running the test code.
Suppose also that zombies Z1, . . . ,Z4 contain no cooperative code for testing, and that they will only respond to pings. Suppose further that Organization 2, which is the unwitting owner of Zombies Z1, . . . ,Z3, has programmed its firewall so that pings do not get through it. The hacker has set a timer, and now the attacks begin.
T3 and T6 have been monitoring their respective intranets 20, 26, so there is a record of average utilization (per time of day). If the zombies are successful, a utilization increase will be observed.
T4, T5, and T9, (T9 is owned by Org 1 but connected directly to the internet, possibly from an employees home or a remote Org 1 office) monitor Internet 22. They can detect areas of abnormally high utilization and can probe to find hot spots. Areas of low utilization can be reported to internet service providers (ISPs) so that they can perform tracing. In this case, T9, T4, or T5 might detect that ISP 2 (or a specific portion of ISP 2) is an area with some connections to its web site but with relatively low activity. Thus, the ISP 2 could be directed rapidly to trace and locate sources of suspicious activity. Testing could be performed possibly up to firewall 30 to determine that it is a hotbed of zombie activity. Various protective actions could then be taken, such as notifying Organization 2 and, possibly, invoking filtering at firewalls 24 and 32 to deny access to organization Org 1 and ASP organization 2 resources.
Referring to
Hacker servers 40 are often well-known devices with addresses available through Internet chat-rooms. As shown in
T1, . . . ,T3 are network testing devices running the code described in this application and in Silverman 1 and Silverman 2, which measures network speed, latency, and utilization. Successive tests can be run to see the utilization patterns of individual zombies and groups of zombies to fingerprint the patterns of traffic generated by different, well-known attack scripts, or trojan-horse code.
This will aid in recognition of attacks and identification of stations involved in attacks.
Two notes. First, many organizations already have such test networks in place in order to test new releases of code and to assist in capacity and change tests. So a test station such as T2 could be used to determine and record the patterns of a normal system load as well as how that load changes when an attack is launched. Second, without loss of generality, a firewall (not shown) could be set up between Test Net 50 and Test Net 54, and the patterns of traffic from the zombies could be observed from both Test Net 1 and Test Net 2.
The attack prevention system and method of a preferred embodiment of the invention includes a bit-mapped challenge issued by the web server to any login request. Preferably, the challenge contains no EBCDIC or ASCII text. All text and pictures are bit-mapped, so that without a human operator's intervention, the simple challenges to the login request (e.g., "click on the picture of the cow to continue," with 20 different types of animals pictured, or "enter the result of adding two plus two in the box to the left") cannot be correctly answered by the zombie except by blind luck. Devices that respond incorrectly to the challenge are placed into a state of "purgatory" in which they receive lower or reduced service, such as very limited service or none at all. Devices with human operators will easily answer the challenge, and receive first-class service. This method will prevent zombies from asking for repetitive services from the web site servers from within a connection. From a system perspective, this prevents the zombies from causing connection-supporting control blocks to be maintained and server resources to be used in sufficient quantity to deny service to others.
However, it is still possible that a zombie will iteratively request connection to a web site, even if it will not be able to connect. In this case, the network address of the zombie device will be known to the firewall and/or load balancing software (load balance server 64,
In some instances of attacks, zombies will repeatedly request connections that their controlling scripts will not complete, thereby tying up the attacked system's control blocks, denying system access to others, and will give a new false address for each such attempt. For such cases, the system and methods of Silverman 1 and 2 provide a method for determining the speed, latency, and average queuing delay of the network. This information is then used to help set a timeout value tailored to each login request, so that if the user does not complete the login within the time limit, the control blocks are freed. Repetitive efforts from a station which masquerades under fictitious addresses can be pinpointed by the unique speed and latency of their connection and ejected immediately, or placed into limited service or purgatory category, such as cutting off entirely or providing a lower level of service, thereby freeing prime web site service for legitimate users. Using the methods of Silverman 1 and 2, a plurality of network evaluation signals, or probative test packets, are selectively sent and received through the network. Responsive to these evaluation signals, selective network evaluation parameters are determined and stored. Algebraic, statistical, and queuing theory analysis, responsive to these parameters, determines the response time and throughput characteristics, including capacity, utilization and performance, of the network. Responsive to network evaluation parameters that are determined and stored, a system and method for determining presence of network "hacker attacks" and for lessening the effect of, discouraging, and repelling such attacks by a "challenge-response" is provided.
The system and method of the preferred embodiment of the invention combines a challenge-response login procedure with use of a network probing test frame transmission and analysis procedure. The challenge-response procedure and the network probing test frame transmission procedure can run separate from each other or together for the purpose of DDOS detection and deterrence and further for improving system performance and system management.
The challenge-response procedure of a preferred embodiment of the invention is provided for detecting and preventing robotic logins to public web servers.
The probative test and analysis procedure of a preferred embodiment of the invention provides for (1) creating template fingerprints or signature patterns of attack patterns; (2) establishing the historical, current, and predicted future of states of a network for all types of network traffic; (3) determining if a spike in traffic is a distributed denial of service (DDOS) attack; and if so, determining its sources; (4) determining the unique speed and latency network attachment characteristics of devices when they attempt to connect or when it is determined that the connection will not be successful or after connection when a pattern of abusive behavior is observed; and (5) using that pattern to deny service or give lower service to that device when it requests additional service.
The challenge-response and probative methods together or independent of each other enable or assist in enabling detection of devices participating in DOS and DDOS attacks and upon identification of devices participating in attacks, minimize the effect of the attack and/or minimize the ability of the device to continue its attack.
The system and method of the preferred embodiments of the invention complement and strengthen other techniques for defeating DDOS attacks. Other techniques for suppression of DDOS attacks include (1) shoring up "backdoor" access to web-attached servers through which hackers install "trojan-horse" code from which they can commence DDOS attacks; and (2) implementing filtering technology on router cards so that attacks can be recognized and inhibited at the edge of the network thereby protecting the servers and the network.
Shoring up backdoor access will rely on implementation of new technology and management processes on millions of computers. Any such effort will take years to be fully effective. In the meantime, hackers will be able to commandeer multitudes of web-attached computers from which they can launch DDOS attacks. Such filtering techniques will be developed for detection of attacks based upon non-login, pre-login, or incomplete login flooding, and these filtering mechanisms will be implemented on router cards at low expense, with a predicted high degree of success in limiting this type of DOS and DDOS attack.
In other words, future attack suppression technology is focused on preventing devices not connected to servers from pestering these servers repeatedly and from many sources with administrative requests, error reports, and deliberately incomplete login requests, all of which can deplete resources to the point that the attacked system can no longer function. Future attacks may therefore take the form of creating scripts that complete login connections and then repeatedly ask for service within the legitimate connection in order to bypass the filters in routers programmed to discard excess traffic that is not associated with a validly logged-in connection.
In a preferred embodiment of the invention, the challenge-response method, web servers respond to login contacts with a challenge to which it is trivially simple for a human operator to successfully respond correctly, but to which a programmed machine will have minimal odds of successfully responding. When implemented, any login activity that does not complete successfully can be shunted to a limited resource web server system component that will service all further requests originating from that requester. The decision process regarding level of service can be provided by the load balancing software typically found in medium and large web server sites (see
The challenge-response mechanism works by making it very difficult for a machine without an extremely high degree of artificial intelligence installed to respond meaningfully to simple invitations to input data that a human operating the equipment would have no trouble completing. This will make it nearly impossible for a hacker who can install trojan-horse code on a large number of web-attached devices to make these devices capable of successfully logging in to a particular site and overwhelming that site with requests for service from within a connection.
In accordance with an exemplary embodiment, a challenge-response procedure works as follows. Users connect to a web site by identifying the target web site through an Internet browser, or equivalent. To connect to "XYZ Company," the user (or zombie script) enters "www.xyzco.com" and, in return, receives the initial login screen from the XYZ Company's web server. Under this challenge-response method, the logon screen contains no computer (language) recognizable text, such as EBCDIC or ASCII encoded characters. Rather all text, or at least that text related to the challenge, is a bit-mapped image of text, easily readable by a human. The text which is readable by humans but not machines, invites the user to continue the connection (logon) by clicking on one of several possible "radio buttons," or by entering text into a designated area or equivalent. There may be only one correct response and correct screen input area for that response, and the input area for the response can be randomly shuffled to further decrease the odds of a correct response by a zombie. The response from the device goes to the web's load balancing system, or other dedicated or shared resource available for evaluating the response, which assigns normal service to responses with the correct selection, and either rejects or connects end devices with incorrect responses to lower priority services, possibly including deliberate service delays. The incorrect response is logged and saved, with a record of the address of the requesting station being stored, as well as the discrete speed, streaming speed, and latency of the connecting device. Additional requests from that device will be recognizable as coming from a possible zombie and can be afforded even slower service or denied service completely.
After a user-defined number of incorrect responses, the address of an offending system and/or its latency and speed fingerprint can be added to the router-based filtering system so that packets from the offending device will be rejected and not reach the web server at all. In this manner, the web server can be protected from repetitive requests from non-human driven attacking systems from within connections or when establishing connections.
In the future, router filtering will be so efficient and powerful that DDOS attacks based upon pinging, spurious error messages, incomplete logins, and requests for status by non-logged in devices will be recognized and such traffic discarded before affecting the targeted web site and its servers. It can thus be predicted that DDOS attacks will be attempted from within validly logged in connections. This is because routers will very likely not be programmed to examine and interpret the contents of valid connections.sessions because of the difficulty and overhead involved, as well as for reasons of privacy and security. An example of an attack from within a validly logged-in session would take the form of enrolling armies of devices to connect to a server and periodically request a service, such as going to the Ford web site and pricing a red Crown Victoria, then a blue, diesel F-150, then a green 2 door Focus, etc. Such zombies would appear as normal users, and could consume huge amounts of resource. A non-zombie version of such an attack is possible, but it would require hundreds of humans coordinating their actions over a long period of time to accomplish this.
The method for discovering and diagnosing DDOS attacks by recognizing abnormal increases in utilization works as follows. Pending patent applications Silverman 1 and Silverman 2 describe a system and method for transmitting probative packets across a network and analyzing their transit times to determine the capacity of the network to handle streaming, discrete, and burst traffic, and their utilizations for these types of traffic. Zombie machines run scripts over and over, such scripts consisting of a variety of requests for service designed to flood a targeted web server and consume the web server's and/or its network's resources to the point that service to legitimate users is severely degraded or entirely prevented. As such, the zombie will have a rhythm or pattern of transmissions of discrete, burst, and stream packets that can serve as a fingerprint. There are known web sites from which hackers can download DDOS methods, such as:
It is thus possible to download known attack methods, scripts, and tools and run them on systems in a test network, record their rhythmic patterns, and extrapolate the effect that any number of such systems would have on a network, for networks, while bursty in nature, have characteristic utilization patterns (for example, peaks of utilization at 10 AM and 1 PM are common in commercial networks). The mathematics for the overlaying of a new traffic load introduced by n zombie attacking devices on an existing network is:
Silverman 1 and 2 describe end to end network testing, and in their implementation in any end to end test a Tracroute command may be issued with which to locate all routers along that end to end path. The path from the test station (which can be installed in or co-located with any web server or router in the path) to any device or router in the path can thus be tested.
These advances make possible detection of hacker DDOS attacks regardless of whether or not the attacking devices are logged in to a site's servers, and also to pinpoint the location of the attacking devices, especially when teamed with fingerprinting of individual devices by means of their speed and latency characteristics.
By using the techniques in Silverman 1 and 2, both the pattern of current utilization and the projected effect of zombies on that segment of the network are tested. Each router along the path is thus be identified, and utilization spikes are identified and, by examining segments along a path, utilization increases are tracked to an origin point and thus attacks and individual zombies are identified without the extensive overhead, skill, and time-consumption required for reading traces and without needing to locate areas of low utilization. Moreover, the testing is performed from the web server site or from the ISP's network. This provides the additional advantage of allowing the manager of the web site to identify attacks and test for the locations of attackers without needing the cooperation of the ISP.
When attacking systems that have logged in are recognized, TCP window tuning may be used to slow down the connection. Silverman 1 and 2 formulas are used:
To provide degraded service by window manipulation, the connection window size (expressed as Wb or Wm) is reduced to whatever fraction of the optimum is desired.
Additional methods for slowing the connection from attackers are:
By way of example, the following mathematical calculation of utilization spike recognizes an attack and provides for decomposing the unitary end-to-end utilization measure into utilization by hop in a network. This routine answers the question, what is effect of change in utilization on response time?
This estimation result is then used in the following way. The load imposed on the system by n zombies executing a known attack, such as a trinoo attack script, is estimated by testing for various values of n. From the network perspective, this load is expressed as a number of bits per second. For each link connection from the web site to the Internet, there is obtained an expected utilization, a fixed speed, and an estimated number of bytes on queue. (Bytes on queue is average wait time*discrete speed/8.) From utilization (denoted here as U), number of messages on queue is calculated by U/(1−U). Dividing queue depth in bytes by number of messages on queue the average message size is derived. Average service time for a message=average message size/conversational speed. Arrival rate=U/service time for average message. Arrival rate*average message size=bits per second in network system.
Applying the derivation of bits per second in network from utilization to the trinoo script for n users and for the expected network load allows summing the two to estimate the total bits per second on the Internet connection when attacked by n zombies. Thus is estimated the projected effect of zombie attacks under particular known attack scripts.
Referring to
The advantages of the system and method of the preferred embodiment of this invention include providing an improved system and method for detection and prevention of DOS (Denial of Service) and DDOS (Distributed Denial of Service) attacks.
The preferred embodiment provides a means for web site owners to locate areas of lower and higher utilizations within ISP networks, so that faster detection of DDOS attacks is possible and faster location by the ISP of specific attacking devices is possible.
It is a further advantage of the preferred embodiment that utilization patterns of known attack scripts can be identified and numbers of attackers can thus be estimated for each Internet interface, thus providing a new means for detection of attacks and estimation of the magnitude of the attack on each interface.
It is a further advantage of the preferred embodiment that detection of individual attacking machines is made possible by causing login invitations to be sent in bit-mapped form as opposed to text, thereby defeating zombie machines from being able to login to the webserver site, thereby preventing attacks from within connected sessions.
It is a further advantage that machines identified as attackers can be further profiled by the streaming speed, discrete speed, and latency of their network connection, even if they try to masquerade by repeatedly changing their network address.
It is a further advantage that having identified attacking devices, a lowered level of service can be offered, service can be denied, or counterattacking measures can be implemented against the attackers.
It will be appreciated that, although specific embodiments of the invention have been described herein for purposes of illustration, various modifications may be made without departing from the spirit and scope of the invention. In particular, it is within the scope of the invention to provide a computer program product or program element, or a program storage or memory device such as a solid or fluid transmission medium, magnetic or optical wire, tape or disc, or the like, for storing signals readable by a machine, for controlling the operation of a computer according to the method of the invention and/or to structure its components in accordance with the system of the invention.
Further, each step of the method may be executed on any general computer, such as IBM Systems designated as zSeries, iSeries, xSeries, and pSeries, or the like and pursuant to one or more, or a part of one or more, program elements, modules or objects generated from any programming language, such as C++, Java, Pl/1, Fortran or the like. And still further, each said step, or a file or object or the like implementing each said step, may be executed by special purpose hardware or a circuit module designed for that purpose.
Accordingly, the scope of protection of this invention is limited only by the following claims and their equivalents.
Patent Citations
Non-Patent Citations
Referenced by
Legal Events
Original Image


text:
15th C. Californians Were Not Welcomed Home
Monday, October 21, 2013
DAVIS, CALIFORNIA—Scientists from the University of California, Davis, have analyzed the bones and teeth of three men whose remains were discovered on a California farm in 1964. The men had been buried some 560 years ago, in a mass grave without grave goods, and each of them had arrow points in his rib cage. Two of the men also had obsidian points in their spines. The chemistry of the bones indicates that the men had grown up in the region, but had moved away as adults. "For us, the interesting thing was that while they lived as adults somewhere else, as children, they were from the area where they were killed. So that opens up a whole set of new questions surrounding the circumstances of their death," said anthropologist Jelmer Eerkens. Why were the men treated as enemies when they returned to the Sacramento floodplain? According to Eerkens, the next step in the research involves looking at their DNA to see if the men had been related to one another.
From the Trenches
A Spin through Augustan Rome
Off The Grid
The First Toolkit
Anglo-Saxon Jewelry Box
Wrecks of the Pacific Theater
The Environmental Cost of Empire
One Ring to Bind Them
Cosmic Rays and Australopithecines
Bison Bone Mystery
Rome's Earliest Fort
A Parisian Plague
Finding Lost African Homelands
Neanderthal Necklace
Slime Molds and Roman Roads
Open House
World Roundup
Civil War booze, world's oldest pretzels, Austria's war camels, coral tombs of the Pacific, and a 2.8-million-year-old human
Styling hair in Bronze Age Wales
Recent Issues

subset: commoncrawl


text:
Dawgapedia 2 years, 10 months ago on THE BLITZ: Predicting the season not that easy
THE BLITZ: Predicting the season not that easy
Not bad, Brandon. Just two mistakes in there that I can see. The All-County QB will be whoever wins between Norcross and North Gwinnett, which will be North. Sphire is holding Michael Haynes and co back, waiting for the right moment to unleash those Dawgs, which will be on September 14. Just wait and see! REGION CHAMPS x 4!!! Go DAWGS!!!


text:
from The Open University
Alternatively you can skip the navigation by pressing 'Enter'.
Health, Sports & Psychology menu item
Childhood & Youth
Education menu item
History & The Arts menu item
Languages menu item
Money & Management menu item
Nature & Environment menu item
The Environment
Science, Maths & Technology menu item
Engineering and Technology
People, Politics & Law menu item
TV, Radio & Events menu item
Coming up
The Met: Policing London: Episode OneFriday, 3rd July 2015 01:50 - BBC TwoThe first episode of The Met: Policing London looks at the verdict surrounding the killing of Mark Duggan by an armed... Read more: The Met: Policing London: Episode One
The Met: Policing London: Episode OneFriday, 3rd July 2015 02:20 - BBC Two
The Bottom Line: Summer 2015: The Bottom Line - Burger BattlesSaturday, 4th July 2015 17:30 - BBC Radio 4
Thinking Allowed: Factory music and volunteering post-recessionMonday, 6th July 2015 00:15 - BBC Radio 4
Catch up
The Met: Policing London: Episode OneAvailable until Friday, 10th July 2015 02:50The first episode of The Met: Policing London looks at the verdict surrounding the killing of Mark Duggan by an armed... Read more: The Met: Policing London: Episode One
The Bank: Love and MoneyAvailable until Sunday, 2nd August 2015 00:50
The Bottom Line: Summer 2015: The Bottom Line - Burger BattlesAvailable for over a year
The Met: Policing London: Episode FourAvailable until Monday, 6th July 2015 22:00
Get Started menu item
Welcome to OpenLearn
Get the most out of OpenLearn - Sign in
OpenLearn is the home of free learning from the UK's largest university, The Open University. We have over 800 free courses available for you to study right now. More about this site
Inspire me
Video and Transcript - ItalianAs part of an international project to get our International Year of Light animation... Watch now: Video and Transcript - Italian
Take the photographic memory testCan you capture scenes just by looking at them? Find out with our photographic memory test. Launch now: Take the photographic memory test
Free courses
Start writing fictionHave you always wanted to write, but never quite had the courage to start? This free course,... Try: Start writing fiction now
Succeed with maths – Part 1If you feel that maths is a mystery that you want to unravel then this short 8-week course is for... Try: Succeed with maths – Part 1 now
Become an OU student
Learning to learnTry our free course and get the most out of all our free courses Try: Learning to learn now
Protocols in multi-service networks
The internet, like the telephone system which preceded it, depends for its existence on...
The internet, like the telephone system which preceded it, depends for its existence on communications networks. This unit examines these networks as the means of interconnecting devices so that two-way communication is possible. Examining protocols like HTTP, TCP/IP and ATM as well as the OSI reference model, it provides and overview of the topic for learners who have significant prior knowledge of the subject.
After studying this unit you should be able to:
- evaluate technical descriptions of communication protocols and demonstrate your understanding of their operation;
- describe the characteristics of circuit-switched and packet-switched networks, and of connectionless and connection-oriented modes in packet-switched networks;
- describe the role played by primitives in the OSI reference model;
- explain how 'vertical' and 'horizontal' communication takes place in the OSI reference model;
- describe the main functions of the principal protocols in the TCP/IP architecture;
- describe how application software interacts with the TCP/IP protocol software through application program interfaces;
- find the network and host addresses from IPv4 addresses;
- describe the main functions of each of the layers of the ATM reference model;
- explain the role that virtual path identifiers and virtual channel identifiers play in forwarding ATM cells;
- describe how label switching can support IP over ATM.
- Duration 30 hours
- Updated Monday 18th July 2011
- Masters level
- Posted under Systems (Computer)
- Current section: Introduction
- Learning outcomes
- 1 Overview
- 2 OSI reference model
- 3 TCP/IP protocol architecture
- 4 ATM protocol architecture
- 5 Summary
- References
- Module team
- Acknowledgements
Study this free course
Enrol to access the full course, get recognition for the skills you learn, track your progress and on completion gain a statement of participation to demonstrate your learning to others. Make your learning visible!
Protocols in multi-service networks
People have always communicated with each other – initially by face-to-face communication through gestures and sounds, then over a distance through written messages and signals in the form of fires, lights or flags. Technology, for instance in the form of electrical signals, has reduced many of the limitations of distance. Communication networks have become very important, and modern society depends on them for the smooth operation of economic and social activities. In this unit we regard a communication network as the means of interconnecting devices so that two-way communication is possible, and we shall focus on networks that interconnect telephones or computers. However, you should bear in mind other forms of network such as television and radio networks, which are primarily one-way, broadcast networks. In the future the separation between types of network may be less clear.
This unit is from our archive and is an adapted extract from Multi-Service Networks: Structures (T822) which is no longer taught by The Open University. If you want to study formally with us, you may wish to explore other courses we offer in this subject area [Tip: hold Ctrl and click a link to open it in a new tab. (Hide tip)] .
Archive content
This is an extract from an Open University course which is no longer available to new students. If you found this interesting you could explore more free Systems (Computer) courses or view the range of currently available OU Systems (Computer) courses.
Copyright & revisions
Publication details
Originally published: Monday, 18th July 2011
Copyright information
- Creative-Commons: The Open University is proud to release this free course under a Creative Commons licence. However, any third-party materials featured within it are used with permission and are not ours to give away. These materials are not subject to the Creative Commons licence. See terms and conditions. Full details can be found in the Acknowledgements section.
- This site has Copy Reuse Tracking enabled - see our FAQs for more information.
If you enjoyed this, why not follow a feed to find out when we have new things like it? Choose an RSS feed from the list below. (Don't know what to do with RSS feeds?)
Remember, you can also make your own, personal feed by combining tags from around OpenLearn.
Alternative formats
Tags, Ratings and Social Bookmarking
Page Tags
Sign in or create a free account to add tags to your OpenLearn profile
About this site
OpenLearn: free learning from The Open University


text:
'King and I' Star Deborah Kerr Dies
Kerr, who suffered from Parkinson's disease, died on Tuesday, Oct. 16 in Suffolk, England, says her agent, Anne Hutton, according to news reports.
Kerr was born in Helensburgh, Scotland on September 30, 1921 to a naval architect and his wife. She originally trained as a ballet dancer before switching to acting and appearing in regional British productions and entertaining the troops during
She began her film career in the 1940s in films such as "Major Barbara," "Hatter's Castle," "The Adventures of Colonel Blimp" and "Black Narcissus," which earned her the attention of major Hollywood producers.
Thus began her more illustrious career, starring in the Allan Quartermain adventure "King Solomon's Mines," the historical film "Quo Vadis," the screen adaptation of "The Prisoner of Zenda," "Julius Caesar," the film that had her kissing on a beach with
In her film career, she received six Academy Award nominations, and eventually snagged an honorary Oscar in 1993 for her body of work. She also received a CBE and a star on the Hollywood Walk of Fame. Later in her career, she switched to TV and theater work.
Kerr is survived by her husband Peter Viertel and two daughters, Melanie Jane and Francesca Ann, from her first marriage to Anthony Bartleby, and three grandchildren.


text:
When I assign a database find to an instance variable in Rails, why do future requests to that variable also hit the database? Can this be avoided?
For example, I have 3 models: User, Resource, Opinion, with has_many :through on Opinion
1. Calling for resource_id directly does not hit the database:
@opinions = current_user.opinions # pulls in all of the user's opinions, which include respective resource ids
2. Performing a query does hit the database (even though variable has been assigned):
@opinions.each do |opinion|
opinion.resource_id # does not hit the database (as expected)
@opinions.find_by_resource_id(1) # DOES hit the database
Why does #2 hit the database? Is there a way to perform the same find without hitting the database?
The information is already contained in the @opinions variable, so a db call does not seem necessary.


text:
J.D. Buck Savage "Stop and Rob"
This is Buck Savage's first video. This police training cult classic was developed in the 1980's by survival trainer Dave Smith.
Join the discussion
PoliceOne top 5
- 1 Video: Cops, medic, firefighters brawl at T-ball game
- 2 2nd inmate in prison break shot, captured
- 3 Former LA cop involved in OIS shares lessons on deadly force
- 4 Video: Mich. cop cleared in fatal OIS, footage released
- 5 NY Gov. Cuomo: Escaped prisoners planned on Mexico


text:
Bubba Watson spazzes over pace of play at US Open (Video)
Things started out rough for Bubba Watson at the U.S. Open on Thursday, and he was caught on camera blaming the pace of play at one point. After hitting a poor second shot at the par-5 18th, Watson swung his club in frustration and complained about the speed of his round. Bubba Watson just shouted…Read More


text:
Can't decide which of the many moving companies in Cazenovia to choose from?
Receive the service you expect when you turn to Allied Van Lines, who will make your move a breeze.
We're confident in the service we provide our customers because we adhere to strict safety standards and our agents employ dedicated, punctual professionals.
You can stop your search for moving companies and call Allied Van Lines, now!
Call us for a free quote or to schedule a service, today.
Get a free moving quote from Allied Van Lines!
When you turn to the Allied family of moving companies, you'll be happy to know that we're not only one of the largest networks in the world, but we're also backed by 80 years of professional experience.
For a free quote or to book your moving service in Cazenovia, contact Allied Van Lines today!
Fox Hollow Movers, LLC
799 E. Hiawatha Blvd., Syracuse, NY 13208
Request an Estimate
18.17 Miles
The excellent job that they provided. They hire professional movers. They are professional in handling the belongings.
The excellent job that they provided. They hire professional movers. They are professional in handling the belongings.
I had to do a lot of communication. Also I had to know what and where things would go and keep in contact with people. But they were flexible with my hours. The driver was held up in traffic but I had to call him. The driver actually helped me it was not Allied initially.
The overall satisfaction with the move in general. I didn't have to do too much. It was great. He went through a major snow storm and made it on time .The driver and crew delivered belonging earlier than expected. He notified me at least four times because of the weather.
The agent was not the most attentive and I had to call repeated times to figure out the scheduling of arrival. The moving guys were great. My very expensive silk dress was put into a box with metal
They came when they said they were, they were flexible, and the men that helped with the packing and moving were great.
The driver did a very good job and I liked the care that was shown to me during the move. Everything went well, the only issue I had was that the delivery was almost delayed.
The attitude, the professionalism, the cost was fair and they would response right away to our quesitions.
Every interaction that I had with the people who coordinated my move was prompt, helpful, and informative.
The driver and Michelle were very kind, they had good communication in keeping me informed. Also, I had a good experience and I would tell anyone that. I thought the driver did a good job packing but some of the crew members didn't do as well.
The delivery was on time, and the way they handled the furniture was impressive. So far, everything looks fine.


text: http://ubuntuforums.org – Hello, I've run into a bit of a puzzle and haven't had much luck finding a solution. Right now I am (sadly) connected to the net via Verizon 3G. They filter all incoming traffic so it is impossible for me to open ports to accept connections. I currently have a linux virtual machine at linode.com, and the thought crossed my mind to install pptpd and attempt to do some iptables port forwarding. I have pptpd installed and my home machine connects happily. That said, here's some general info: Server WAN IP: x.x.x.x on eth0 pptpd IP: 192.168.3.1 on ppp0 Client VPN IP: 192.168.3.100 To (Hardware)


text:
StartUpHire is the place to find Senior Software Engineer (Java) jobs. Review the list of Senior Software Engineer (Java) career opportunities to the left. These Senior Software Engineer (Java) jobs represent some of the most rewarding careers available.
You can refine your job search for Senior Software Engineer (Java) career opportunities by adding a job title, company name, or keyword to the search box above … or click the "Advanced Search" link for more options.
Don't see the employment opportunity you're looking for? Check back soon for more Senior Software Engineer (Java) jobs, or sign up for an email alert (link below) to receive periodic updates on new Senior Software Engineer (Java) jobs.
Location: Portland, OR, United StatesAPPLY ABOUT JIVE SOFTWARE Jive Software is the leading provider of modern communication and collaboration solutions for business. Our products empower people and organizations to work better together, using technology that adapts to their4/26/2015 Portland, UT Save This Job
ON24 is committed to one area of expertise: providing industry-leading webcasting solutions which are designed to meet performance, value, and reliability requirements for businesses of all types and sizes. ON24 is the market-share leader globally in providing webcasting4/28/2015 San Francisco, CA Save This Job
Location: Acton, MA Type: Full Time Virsec is looking for a software engineer with advanced working knowledge of Java Want to be on the front lines of advancing a powerful new cyber defense technology? Do you see yourself in a role that will help reshape the world of data4/27/2015 Acton, MA Save This Job
Socialware is seeking a Senior Software Engineer to join our team. This will be a key position to create new innovation as well as our platform to scale to a dramatically increasing user base. Qualified candidates should consider themselves both smart and humble, and have the5/18/2015 Austin, TX Save This Job
More information about this job: Overview: Digital Signal Corporation is seeking Senior Software Engineers specializing in Java (with some C/C++) for their Chantilly, VA location. Digital Signal Corporation (DSC) is the technology startup opportunity you?ve been looking for.6/26/2015 Chantilly, VA Save This Job
Location: San Mateo, CA Description: As a senior member of our core product development team in Engineering, you will lead enhancements to one or more components of our multi-channel personalization solution such as the MySite Recommendations, MyMail Alerts, MyMail6/3/2015 San Mateo, CA Save This Job
Location: San Mateo, CA Description: As a senior member of our core product development team in Engineering, you will lead enhancements to one or more components of our multi-channel personalization solution such as the MySite Recommendations, MyMail Alerts, MyMail6/3/2015 San Mateo, CA Save This Job
Today?s web and cloud applications are complex distributed systems, sometimes spanning hundreds of servers. The companies that design and manage these applications wage a daily war against outages and performance problems. You?ve probably experienced this for yourself, for4/14/2015 Morrisville, NC Save This Job
Department:Product Operations- Software Engineers Location:Dulles, VA Click Here to Complete Your Application Responsibilities A senior .Net developer will be involved in the design and development of various products. Experience with n-tier web application development using5/5/2015 Dulles, VA Save This Job
Senior Software Engineer - Android Game ClientWe're looking for Android engineers (at all levels: Senior/Lead/Principal) to join our game studios You'll work on new gameplay features, optimizations and improvements, and more for our live titlesSan Francisco, CA Save This Job
Quantcast seeks Senior Engineer to lead fraud and brand safety efforts.6/15/2015 San Francisco, CA Save This Job
Quantcast is hiring Senior Engineers for the Brand and Inventory Quality team.6/16/2015 San Francisco, CA Save This Job
Our Platform Engineers write, design and maintain scalable software that is used by all of our game teams and partners. Our team works on to improve and scale internal tooling and shared services. Some of the tools, services includes A/B testing, game datSan Francisco, CA Save This Job
Job Description The Software Engineer?s primary responsibility is for presentation-tier and middle-tier development tasks. The Software Engineer works closely with other members of the Connecture software development team to deliver high quality web-based sales support solutions5/30/2015 Raleigh, NC Save This Job
Engineering Campbell, CA, United States Senior Software Engineer ? Mobile Platform Are you interested in building the future of customer service interactions? Are you excited by the opportunities that mobile has opened up for simplifying customer experience? We are looking5/11/2015 Campbell, CA Save This Job
Department: Product and Technology Location: Indianapolis, IN Employment Type: Full Time About BidPal Inc. BidPal is the leading provider of technology that helps charities raise more money while adding fun and excitement to fundraising events. The company's commitment to5/3/2015 Indianapolis, IN Save This Job
Title:Senior Software Engineer Department: Location:Cincinnati, OH Type:FullTime Position #:193722 Description: Jenzabar, a leader in educational enterprise software development, is looking for a Sr. Software Engineer to be part of the team discovering an exciting future where5/6/2015 Cincinnati, OH Save This Job
Team Description:Role Responsibilities:Requirements:6/2/2015 New York, NY Save This Job
Team Description:Role Responsibilities:Requirements:5/20/2015 New York, NY Save This Job
Position Invoke Solutions is seeking a talented Senior Software Engineer to add to our Waltham-based team. A successful candidate will be a talented and curious self-starter who enjoys small teams and startups. This is a full stack engineer role in a Java/web application6/24/2015 Waltham, MA Save This Job


text:
News 46 - 60 of 198
Amal Alamudin Visits Alexander McQueen Ahead of Wedding to George ClooneySeptember 05, 2014 01:09:57
The future Mrs. Clooney was accompanied by her mother when visiting the headquarters of the designer who created Kate Middleton's wedding gown.
George Clooney to Direct Phone Hacking Scandal MovieSeptember 04, 2014 08:09:45
'Hack Attack' is adapted from a book by journalist Nick Davies who spent six years investigating the Rupert Murdoch scandal.
George Clooney Visited Hospital for Back Injury Check-UpSeptember 01, 2014 02:09:02
The 53-year-old actor seemingly still had lingering effects of his injury after injuring his spinal cord while filming 'Syriana' almost ten years ago.
George Clooney's Fiancee Amal Alamuddin Turns Down UN's Offer to Investigate War Crimes in GazaAugust 12, 2014 04:08:01
The British-Lebanese human rights lawyer has refused United Nations' offer to examine possible violations of the rules of war in the Gaza Strip because of her hectic work schedule.
Amal Alamuddin 'Happy' but 'Worried' About Marriage to George ClooneyAugust 09, 2014 09:08:14
Despite having reportedly 'secured' an entire island for the upcoming nuptials, the future Mrs. Clooney's worried about 'the press finding out' the wedding date.
George Clooney and Amal Alamuddin Obtain Marriage License in LondonAugust 07, 2014 01:08:50
The 'Up in the Air' star and his British girlfriend's marriage license is displayed in front of the town hall for all to see.
George Clooney on Tabloid Fight: 'It's Fun to Slap Those Bad Guys'July 22, 2014 11:07:13
In addition to talking about his recent fight with U.K. tabloid Daily Mail in a new interview, the 'Gravity' actor says of his engagement to Amal Alamuddin, 'I'm marrying up.'
George Clooney's Fiancee Amal Alamuddin Officiates WeddingJuly 16, 2014 09:07:29
A photo from the wedding which took place in Florence, Italy shows the lawyer sporting a purple dress and flowers on her hair.
George Clooney Rejects Daily Mail's Apology Over Report About His FianceeJuly 11, 2014 02:07:40
In the second op-ed, the actor writes, 'I thank the Mail for its apology. Not that I would ever accept it, but because in doing so they've exposed themselves as the worst kind of tabloid.'
Mail Online Apologizes to George Clooney for Story About His Fiancee's MotherJuly 10, 2014 09:07:42
After Clooney blasts Daily Mail for publishing a 'fabricated' report about his fiancee, the news outlet apologizes to him, his fiancee and her mother 'for any distress caused.'
George Clooney Slams 'Fabricated' Report on His Fiancee's MotherJuly 09, 2014 03:07:09
The 'Monuments Men' actor blasts Daily Mail for publishing a report suggesting that his fiancee's mother opposes their plan to get married, saying, 'This lie involves larger issues.'
Brad Pitt Is Allegedly Considered to Be George Clooney's Best Man at His WeddingJune 20, 2014 04:06:07
George's aunt Staria spills details of the 'Gravity' actor upcoming wedding with Amal Alamudin and says that his BFF will likely be the groomsman.
George Clooney Plays Pick-Up Game With Student From His High SchoolJune 14, 2014 12:06:24
The 'Gravity' star surprised a high school basketball player when he appeared out of nowhere and joined a pick-up game.
'Hail Caesar' Lands Josh Brolin, George Clooney and UniversalJune 10, 2014 07:06:02
The Coen brothers will direct the film about a Hollywood fixer in the 1950s who works to keep a studio's stars in line.
George Clooney and Amal Alamuddin Host Star-Studded Engagement PartyMay 12, 2014 01:05:35
The pair are joined by some famous names such as U2's frontman Bono, Cindy Crawford and her husband Rande Gerber at the party.


text:
Thanks for redeeming.{{else}}
Success! Thanks for repurchasing.{{/if}} {{else}} {{#if Expired}}
Increase my visibility!{{else}} {{#if IsMultiPack}}
{{#if HasMultiPack}} You have {{MultiPackCount}} top spot(s) left. Now loading you into the search listings... {{else}} You have used all top spots. Now loading you into the search listings... {{/if}}{{else}}
We are loading you into the search listing pages...{{/if}} {{/if}} {{/if}} {{/if}}
{{Current}} just saw you!{{/if}} {{#if LastTopSpotPurchaseIsMulti }} {{#if HasAnyTopSpot}}
{{#if HasFreeTopSpot }} {{ UnclaimedTopSpotFree }} Free {{/if}} {{#if HasPaidTopSpot }} {{#if HasFreeTopSpot }} & {{/if}} {{ MultiPackCount }} {{/if}} Top Spot{{#if Plural}}s{{/if}} Left{{else}}
0 Top Spot{{#if Plural}}s{{/if}} Left{{/if}} {{else}} {{#if HasFreeTopSpot }}
{{ UnclaimedTopSpotFree }} Top Spot{{#if Plural}}s{{/if}} Left{{/if}} {{/if}} {{else}} {{#if HasResults}}
{{Current}} see you now!{{else}} {{/if}} {{/if}}
You can now invite anyone to meet at your favorite Starbucks.
Limited-time feature
51 year old woman | Lakewood, CO, USA | Seeking men 48-60 within 100 miles
Active within 24 hours
I'm looking for a fun loving, honest and trustworthy man.
I am a very outgoing, energetic person who enjoys running, walking and exercising. I love working out and keeping fit. I like to eat healthy foods but have difficulties turning down frozen yogurt. I enjoy spending time with my kids. I have a daughter in college and a son in High School. . I enjoy driving through small mountain towns, looking through the shops. I love almost all kinds of music (can't handle rap or heavy metal). I really enjoy country music. I am very affectionate and passionate person. I love cats and dogs. I enjoy most sports, watching on tv and attending sporting events. I don't spend a lot of down time, I'm usually always on the go. Don't get me wrong, I do like spending time at home relaxing too. I like working in my yard. I enjoy cooking and baking and love to BBQ (year round). I would love to find someone that would enjoy doing all of these things with. I also really love the ocean and the mountains. I try to make it to the beach at least once a year and travel to the mountains as frequently as possible. Life has so many things to offer and it would be so nice to enjoy it with someone that has similar interest.
Coffee and conversation , Cooking , Dining out , Gardening/Landscaping , Movies/Videos , Music and concerts , Exploring new areas , Performing arts , Playing sports , Shopping/Antiques , Travel/Sightseeing , Watching sports , Wine tasting
Auto racing / Motorcross, Baseball, Basketball, Dancing, Football, Golf, Running, Swimming, Tennis / Racquet sports, Walking / Hiking, Yoga
I exercise 5 or more times per week.
I have Cats
I like Dogs
Middle of the Road
The ocean is absolutly my favorait place. I love hot, sunny weather. I prefer the Atlantic over the pacific, but any beach will do. I like the Outer Banks of NC, love the Carribean and Hawaii. I reallly enjoy the Mountains, Steamboat Springs.
I like almost all types of music..I can't handle rap or heavy metal head banging music I really enjoy country, top 40, and Jazz. I don't watch alot of TV (mostly the news). I eat healthy, LOVE salad!! One of my downfalls is frozen yogurt.
I enjoy exercising/running/walking/weights. I enjoy taking drives up to the mountains. I like to cook, BBQ and enjoy being with family and friends.
Nicholas Sparks novel, emails and a health food magazine.
Z{{Cta}} {{#if HasMoreInfo}} ?{{CtaSecondary}} {{/if}}
|What she is looking for
|5'5" (165cms)
|5'9" (175cms) to 6'5" (195cms)
|Body type:
|Athletic and toned
|About average, Athletic and toned
|No preference
|Light brown
|Black, Light brown, Dark brown, Salt and pepper, Silver, Grey
|No Way
|No preference
|Social Drinker
|Social Drinker, Moderately
|Sales / Marketing
|No preference
I am in International/Domestic sales.
|$50,001 to $75,000
|$100,001 to $150,000, $150,001+
|No preference
|Have kids:
|Yes, and they sometimes live at home (2)
|No preference
|Wants kids:
|No, but it's OK if my partner has kids
|No, but it's OK if my partner has kids
|White / Caucasian
|White / Caucasian
|Christian / Other
|Christian / Protestant, Spiritual but not religious, Christian / Other
|Some college
|No preference


text:
'Y&R' Looking for a Name Actor for Contract Role
on Wednesday, February 16, 2011 @ 11:24 AM
(SoapOperaNetwork.com) -- CBS' "The Young and the Restless" is actively seeking a Caucasian or Latino actor with "experience or a name" and in the age range of 35-47 for a contract role they are looking to cast.According to a breakdown provided to Soap Opera Network, the characters name will be Clay. "Clay is grizzled and sexy, he is a cowboy living on a ranch in a rural western town. A strong but silent, salt of the earth type, he is a smart guy who chooses to live a simple life working with his hands."According to Soap Opera Digest, the...
Shocking Shakeup at 'DAYS:' Livingston OUT! Braun IN!
on Tuesday, February 15, 2011 @ 4:41 PM
(SoapOperaNetwork.com) -- Soap Opera Digest is reporting that NBC's "Days of our Lives" has let actress Natalia Livingston go after just three weeks on the air portraying the role of Taylor Walker and replaced her with her former "General Hospital" co-star (and "DAYS" alum herself) Tamara Braun."It was decided to take the character of Taylor in a new direction," said Co-Executive Producer Gary Tomlin. "Natalia Livingston is an amazing actress and a consummate professional. She is a class act and everyone at the studio adores her."According to Digest, Braun began taping today and will first air in late April....
Kim Zimmer in 'Love, Loss, and What I Wore'
on Monday, February 14, 2011 @ 8:55 PM
(SoapOperaNetwork.com) -- Famous for her roles on "Guiding Light" and "One Life to Live," Kim Zimmer is joining the cast of the hit Off Broadway show "Love, Loss, and What I Wore" begining with the Wednesday, February 16 performance.Zimmer, who currently portrays the role of Echo DiSavoy on "One Life," willl be joined by actors Katrina Bowden ("30 Rock"), Sabrina Le Beauf ("The Cosby Show"), Orfeh ("Legally Blonde"), and Barbara Rhoades ("The Goodbye Girls") in the play written by Nora Ephron and Delia Ephron, which is based on the best-selling book by Ilene Beckerman. The show comprises an intimate collection of stories from the book and...
Gossip Girl PreVUE: Monday, February 14 Edition
on Monday, February 14, 2011 @ 6:52 PM
(SoapOperaNetwork.com) -- A Look at What's Happening on the Monday, February 14 Episode of The CW's "Gossip Girl.""It-Girl Happened One Night" CHUCK FIGHTS TO SAVE BASS INDUSTRIES / MICHAEL BOATMAN ("SPIN CITY") & TIKA SUMPTER ("ONE LIFE TO LIVE") GUEST STAR — With Russell Thorpe (Boatman) poised for a takeover attempt of Bass Industries, Chuck (Ed Westwick) makes one last-ditch effort to save his family's company. Blair (Leighton Meester) is given a challenging assignment at W Magazine with the promise of a possible promotion. Serena (Blake Lively) struggles with her feelings for Ben (guest star David Call). Penn Badgley, Chace...
Kate Linder Joins 'Vagina Monologues'
on Monday, February 14, 2011 @ 2:51 PM
(SoapOperaNetwork.com) -- If you happen to be in the Los Angeles area at some point this upcoming weekend, you might want to stop by the Barnsdall Gallery Theatre where "The Young and the Restless'" Kate Linder (Esther) will be performing "The Vagina Monologues" alongside Alison Arngrim ("Little House on the Prairie") and Diane Amos (best known as "The Pinesol Lady").Considered "one of the most important pieces of political theatre" by the NY Times, "The Vagina Monologues" has been a focal point in the V-Day activists movement, which was created to generate a broader awareness in the fight to stop...
'One Life': From Morocco with Love?
on Monday, February 14, 2011 @ 1:00 AM
(SoapOperaNetwork) -- With Clint Buchanan's many secrets being exposed one by one, it's not a matter of if Bo (Robert S. Woods) will learn the truth about what big brother Clint (Jerry verDorn) did with his illegitimate son David Vickers (Tuc Watkins), but when. Soap Opera Network has learned that Omar Koury has been cast as a prison warden, in more Moroccan prison scenes that were taped earlier this month. But there's more to the story... Still reeling from the fact that the ruthless Clint Buchanan, and not good guy Charlie Banks (Brian Kerwin) is his biological father, Rex Balsom...
Y&R PreVUE: Week of February 14 Edition
on Monday, February 14, 2011 @ 12:37 AM
(SoapOperaNetwork.com) -- A look at what's happening on "The Young and the Restless" during the week of February 14, 2011.THIS WEEK ON:THE YOUNG AND THE RESTLESSOn Valentine's Day, Monday, February 14, Gloria works her magic in getting Kevin and Chloe back together. That same day, Nikki and Deacon shock everyone by making it clear that they are a couple. Tucker and Katherine have heated words regarding his treatment of Cane. Traci returns home Wednesday, February 16 Victoria keeps Abby in the dark, and on Friday, February 18 Nick must make a decision: stand by his father,...
GH Teasers: Week of February 14 Edition
on Sunday, February 13, 2011 @ 5:00 PM
(SoapOperaNetwork.com) -- "General Hospital" Teasers for the Week of February 14, 2011.GENERAL HOSPITAL: Teasers Monday: (Episode #12241) -- Sonny's wedding ring goes missing. Dante and Lulu reconnect. Sam and Jason learn if they will be having a baby. (Rated: TVPG L) Tuesday: (Episode #12242) -- Sonny figures out who is trying to ruin his wedding. Lucky and Siobhan stumble upon a clue. Lulu falls under Dante's spell. (Rated: TVPG L) Wednesday: (Episode #12243) -- Lucky is in danger. Jason and Sam give Dante their opinion of Theo. Lulu helps bust tables. (Rated: TVPG L, V) Thursday: (Episode #12244) -- Spinelli works hard...
OLTL Teasers: Week of February 14 Edition
on Sunday, February 13, 2011 @ 5:00 PM
(SoapOperaNetwork.com) -- "One Life to Live" Teasers for the Week of February 14, 2011.ONE LIFE TO LIVE: Teasers Monday: (Episode #10868) -- Joey and Aubrey get married on the spur of the moment. Ford gets some shocking news. Charlie's loved ones are concerned for him. Jessica loses control. (Rated: TVPG D, S) Tuesday: (Episode #10869) -- Todd catches Dani and Nate in bed together. John and Kelly talk about their miserable love lives. Blair and Cristian have a heart-to-heart. (Rated: TVPG D, S) Wednesday: (Episode #10870) -- Tess introduces herself to Ford. Todd flies off the handle. Brody and Natalie have it...
AMC Teasers: Week of February 14 Edition
on Sunday, February 13, 2011 @ 5:00 PM
(SoapOperaNetwork.com) -- "All My Children" Teasers for the Week of February 14, 2011. ALL MY CHILDREN: TeasersMonday: (Episode #10557) -- Annie snaps. Ryan is floored by Madison's revelation. Will Ryan and Greenlee say "I do?" (Rated: TVPG)Tuesday: (Episode #10558) -- Ryan learns Emma has gone missing. David claims he's a new man. Colby makes things difficult for Asher. (Rated: TVPG)Wednesday: (Episode #10559) -- Bianca and Reese have relationship issues. Cara and Griffin discuss Kendall. Caleb and Asher begin to bond. (Rated: TVPG)Thursday: (Episode #10560) -- Tad tells Jake that Cara may run into problems if...
Listen: 'One Life's' 'The Sound of a Kiss'
on Sunday, February 13, 2011 @ 3:00 AM
(SoapOperaNetwork) -- Have you purchased your copy of "One Life to Live's" new Valentine's Day album from iTunes yet? If not, then here's a preview of what you're missing. The CD, which features tracks from Kassie DePaiva (Blair), Kristen Alderson (Starr), Kelley Missal (Dani), Brittany Underwood (Langston), and David A. Gregory (Ford). Click here to listen each of the songs on the album (with the exception of the bonus track -- a piano version of DePaiva's song "Dream of Our Own"). And remember that you can follow along with "Hard to Give," Alderson's song on the album, by finding the lyrics...
Jacob Young and John-Paul Lavoisier Head to Tulsa, OK Valentine's Weekend
on Saturday, February 12, 2011 @ 2:37 AM
(SoapOperaNetwork.com) -- ABC Daytime viewers living in or around the area of Tulsa, Oklahoma and are fans of Jacob Young (JR Chandler) and/or John-Paul Lavoisier (Rex Balsom) should get their scrapbooks ready as the two will be appearing this weekend at the Women's Living Expo.The two will be on hand this weekend for a Q&A and autograph signing session with fans with Young up first on Saturday, February 12 followed by Lavoisier on Sunday, February 13. The event kicks off at 1:00 PM on Saturday for Young and 2:00 PM on Sunday for Lavoisier.Tulsa Women's Living Expo, presented by...
Jeff Branson Heading to 'CSI: Miami'
on Friday, February 11, 2011 @ 10:48 PM
(SoapOperaNetwork.com) -- "The Young and the Restless'" Jeff Branson is joining a large list of soap stars appearing in CBS' primetime procedurals with his upcoming appearance on "CSI: Miami," including David Fumero (see: David Fumero Leaves the Cold Winter of New York for 'CSI: Miami') and Leven Rambin (ex-Lily Montgomery, "All My Children"), who will both appear in upcoming episodes of the series.A show representative tells Soap Opera Network that Branson, who portrays the role of Ronan Malloy on "Y&R," will appear in the Sunday, March 6 episode entitled "Blood Lust" in the role of Dennis Baldwin. "Dennis is...


text:
Phyllis Margaret Thorold (née Russell); Leopold Oliver Ampthill; Margaret (née Lygon), Lady Ampthill
1 portrait of Margaret (née Lygon), Lady Ampthill
© National Portrait Gallery, London
Phyllis Margaret Thorold (née Russell); Leopold Oliver Ampthill; Margaret (née Lygon), Lady Ampthill
by Bassano Ltd
whole-plate glass negative, August 1920
Given by Bassano & Vandyk Studios, 1974
Photographs Collection
NPG x75152
Click on the links below to find out more:
Sittersback to top
- Margaret (née Lygon), Lady Ampthill (1874-1957), Lady of the Bedchamber to Queen Mary; wife of 2nd Baron Ampthill; daughter of 6th Earl Beauchamp. Sitter in 9 portraits.
- Leopold Oliver Ampthill (1907-1988), Director-General of Cement and Concrete Association. Sitter in 2 portraits.
- Phyllis Margaret Thorold (née Russell) (1900-1998), Lady-in-waiting to H.R.H the late Princess Royal; wife of William George Preston Thorold. Sitter in 6 portraits.
Artistback to top
- Bassano Ltd (active 1901-1962). Artist associated with 42708 portraits.
Portrait setback to top
Exhibitions and displays
- Old Titles and New Money: American Heiresses and the British Aristocracy
Until 2 August
- Women and the First World War
Until 25 October
- Curators' Choice: Photographs from the Terence Pepper Gift
Until 24 January 2016


text:
The Journal Sentinel's team of Packers beat writers provide the latest news, notes and analysis
Cobb juggles football, school
Green Bay — Green Bay Packers rookie wideout/returner Randall Cobb has been called a jack-of-all-trades on the football field.
Cobb is proving to be quite the multi-tasker off the field, as well.
Cobb has spent large chunks of his days immersed in the Packers' playbook. Considering Cobb wasn't given a playbook until July 28 — after the NFL lockout ended — he's swimming upstream there.
In addition, Cobb is taking a three-credit political science class at the University of Kentucky. Cobb's final exam in the on-line class must be completed by the end of the day, and he plans to take the test after tonight's practice ends.
Cobb, who left Kentucky after his junior year, is roughly 30 credits away from graduating.
"Yeah, it's been a lot," said Cobb, Green Bay's second round draft choice in April. "But I'm doing pretty good in (the class)."
Cobb has also impressed early this camp.
Cobb (5-10, 191) was viewed as strictly a slot receiver by many scouts prior to the draft. But he's practiced all over the field and wants to play both inside and on the perimeter.
In addition, Cobb figures to add life to Green Bay's sub-par return games.
"I don't really see myself just being a slot guy," Cobb said. "I can go outside too. All it is is making sure I understand the plays.
"I don't want to be considered a great slot guy. I want to be considered a great football player, and that's what I go for. That's my motivation every day is to get better."
That — and to ace his Political Science final.
Comments »
Read and share your thoughts on this story.