text:
Weidong Cui
Jayanthkumar Kannan
Helen J. Wang
Application-level protocol specifications are useful for many security applications, including intrusion prevention and detection that performs deep packet inspection and traffic normalization, and penetration testing that generates network inputs to an application to uncover potential vulnerabilities. However, current practice in deriving protocol specifications is mostly manual. In this paper, we present Discoverer, a tool for automatically reverse engineering the protocol message formats of an application from its network trace. A key property of Discoverer is that it operates in a protocol-independent fashion by inferring protocol idioms commonly seen in message formats of many application-level protocols. We evaluated the efficacy of Discoverer over one text protocol (HTTP) and two binary protocols (RPC and CIFS/SMB) by comparing our inferred formats with true formats obtained from Ethereal [5]. For all three protocols, more than 90% of our inferred formats correspond to exactly one true format; one true format is reflected in five inferred formats on average; our inferred formats cover over 95% of messages, which belong to 30-40% of true formats observed in the trace.
Application-level protocol specifications are useful for many security applications. Penetration testing can leverage protocol specifications to generate network inputs to an application to uncover potential vulnerabilities. For network management, protocol specifications can also be used to identify protocols and tunnelings in monitored network traffic. Generic protocol analyzers (GAPA [1] and binpac [16]) are important mechanisms for intrusion detection or firewall systems to perform deep packet inspection. These analyzers take protocol specifications as input for their analyses.
To date, protocol specifications for the above applications are specified from documentation or reverse engineered manually. Such efforts are painstakingly time-consuming and error-prone. It took the open-source SAMBA project 12 years to manually reverse engineer the Microsoft SMB protocol [18]. In another example, the Yahoo messenger protocol has also been persistently reverse engineered, despite which, the open source clients [6] regularly require patching to support proprietary changes in the Yahoo protocol. Sometimes, the period between the availability of an official client and an open-source client has been a month, with some open-source projects simply abandoning the effort due to the frequent changes initiated by Yahoo.
To address this pain, we tackle the problem of automatic protocol reverse engineering. There can be two sources of given input for the reverse-engineering task: network traces and application code. In this paper, we present our tool, Discoverer , which performs automatic reverse engineering from network traces. We leave application-code-based reverse engineering as future work.
In Discoverer, we focus on reverse engineering the message format specification and leave the protocol state machine inference to our future work. To automatically reverse engineer message formats for a wide range of protocols, we face three main challenges: (1) We have very few hints from the network trace. The only evident information from the trace is the directionality of byte streams. (2) Protocols are significantly different from each other. (3) Protocol message formats are often context-sensitive where earlier fields dictate the parsing of the subsequent part of the message.
To make our tool general, we base our design on inferring protocol idioms commonly seen in message formats of many protocols. To cope with the few hints, we dissect the formless byte streams into text and binary segments or tokens as a starting point for clustering messages with similar patterns, where each cluster approximates a message format. By comparing messages in a cluster and observing the characteristics of known cross-field dependencies (such as a length field followed by a string of the length), we infer additional properties for the tokens, which in turn can be leveraged to refine and divide the clusters of messages, where each subcluster approximates a more precise format. This process continues recursively until we can no longer divide up any message clusters based on the newly finished inference. After this recursive clustering phase, we look at all message clusters globally through a type-based sequence alignment algorithm, and merge similar clusters into one. This way, we can produce more concise message formats.
We have evaluated Discoverer over traces of a representative set of protocols consisting of one text protocol (HTTP) and two binary protocols (RPC and CIFS/SMB). We calibrated our design over some of these traces, and used the remaining for validation. The three main metrics for our tool are correctness (``does one inferred format correspond to exactly one true format?''), conciseness (``how many inferred formats is a single true format reflected in?''), and coverage (``how many messages are covered by the inferred formats?''). Across all protocols we tested, more than 90% inferred formats correspond to exactly one true format; one true format is reflected in five inferred formats on average; our inferred formats cover over 95% messages, which belong to 30-40% of true formats observed in the trace. Such significant difference between message and format coverage is due to the heavy-tail distribution of message format popularity commonly seen in practice.
Although our reverse-engineered message formats are imperfect, we anticipate them to be still practical for the aforementioned applications. For instance, penetration testing guided by our reverse-engineered formats is likely to be much more effective than that with random inputs. Protocol fingerprinting and tunneling detection probably do not require perfect protocol specifications. For applications like firewalls which would err with imperfect specifications, our tool could still serve as a help to ease the manual protocol specification process.
We organize the rest of the paper as follows. We discuss common protocol idioms and the scope of Discoverer in Section 2. We describe the design of Discoverer in detail in Section 3. We present our evaluation methodology and results in Section 4. We discuss related work in Section 5, and limitations and future work in Section 6. Finally, we summarize the paper in Section 7.
Many application-level protocols share common protocol idioms which correspond to the essential components in a protocol specification. To make our reverse-engineering algorithm applicable to many protocols, we base our design on inferring the common protocol idioms. In this section, we first describe these idioms and then explain the scope of Discoverer.
Most application-level protocols involve the concept of an application session, which consists of a series of messages (also known as Application-level Data Units or ADUs) between two hosts that accomplishes a specific task. The structure of an application session is determined by the application's protocol state machine, an essential component in a protocol specification that characterizes all possible legitimate sequences of messages. The structure of an application message is determined by the application's message format specification, another essential component in a protocol specification. A message format specifies a sequence of fields and their semantics. Common field semantics include length (reflecting the size of a subsequent field with a variable length), offset (determining the byte offset of another field from a certain point like the start of the message), pointer (a special offset that specifies the index of a field in an array of arbitrary items), cookie (session-specific opaque data that appears in messages from both sides of the application session; session IDs are an example of cookie fields), endpoint-address (encoding IP addresses or port numbers in some form), and set (a group of fields that can be put in an arbitrary order).
One particular type of fields is the Format Distinguisher (FD) field. The value of this field serves to differentiate the format of the subsequent part of the message, which reflects the context-sensitive nature in the grammar of many application-level protocols. A message may have a sequence of FD fields, particularly when multiple protocols are encapsulated. For instance, a CIFS/SMB message consists of a NetBIOS header encapsulating an SMB header, which in turn may encapsulate a RPC message. This implies that the applications need to scan a message from left-to-right, decoding a FD field before parsing the subsequent part of the message.
In this paper, we focus on deriving the message format specification and leave protocol state machine inference to our future work. We assume synchronous protocols to identify message boundaries. A message is a consecutive chunk of application-level data sent in one direction. It spans one or more packets in a TCP or UDP connection, where a UDP connection is a pair of unidirectional UDP flows that are matched on source/destination IP address/port number. We only aim to deal with applications that do not obfuscate their payloads. We do not aim to capture timing semantics (e.g., ``message 1 usually follows message 2 within 10 seconds'').
In this section, we first present an overview of Discoverer, then describe the three main phases of Discoverer in detail, and finally give a concrete example of a message format inferred by Discoverer.
Figure 1: Overview of Discoverer's architecture. In the example, we assume there is a single true message format which has two fields: the first binary field of a single byte represents the length of the second text field. There are two token patterns because, when the text field is shorter than a threshold, it is treated as binary. In the merging phase, this kind of tokenization errors is corrected.
The basic idea of Discoverer is to cluster messages with the same format together and infer the message format by comparing messages in a single cluster. We achieve this in three main phases (illustrated in Figure 1).
A key design rationale for Discoverer is to be conservative: it may scatter messages of the same format into more than one cluster, but it should not collate messages of different formats into the same cluster. This rationale is to ensure the correctness of inferred formats because, if there are messages of more than one format in a cluster, the inferred format might be too general by trying to capture multiple message formats at once.
A token is a sequence of consecutive bytes likely to belong to the same application-level field. We require that the tokenization process works without any particular distinction between text and binary protocols, since our tool is intended to be fully automatic and we wish to spare the user from the manual effort required to distinguish between text and binary protocols. Further, it is hard to declare a protocol as purely text or purely binary, since text protocols can contain binary bytes (e.g., an image file transferred over HTTP) and most binary protocols contain a few text fields (e.g., the name of a file).
Our tokenization procedure generates two classes of tokens: text and binary. A text token is intended to span the several bytes of a single message field representing some text (such as ``GET'' in an HTTP request). Our procedure for finding text tokens is as follows: we first identify text bytes by comparing them with the ASCII values of printable characters, and then consider a sequence of text bytes sandwiched between two binary bytes as a text segment. To avoid mistaking binary bytes for text bytes, we require this sequence to have a minimum length. Then we use a set of delimiters (e.g., space and tab) to divide a text segment into tokens. We also look for Unicode encodings in messages. For binary fields, identifying field boundaries is very hard; so we instead simply declare a single binary byte to be a binary token in its own right. Note that this procedure can admit errors: consecutive binary bytes with ASCII values of printable characters are wrongly marked as a text token; a text string shorter than the minimum length is wrongly marked as binary tokens; a text field consisting of some white space characters is wrongly divided into multiple text tokens. We correct this kind of errors in the merging phase (see Section 3.4).
Byte-wise sequence alignment based on the Needleman-Wunsch algorithm [15] has been used in previous studies [3,11,17] for aligning and comparing messages. We find that byte-wise sequence alignment, while ideally suited to align messages with similar byte patterns, is not suitable for aligning messages with the same format. For instance, fields with variable lengths may lead to mis-alignment of two messages of the same format. Further, parameter selection for sequence alignment is also hard as shown in [3].
To avoid aligning messages, we cluster messages based on their token patterns. The token pattern assigned to a message is a tuple, (dir, class_of_token_1,class_of_token_2,…), where is the direction of the message (client to server or vice versa), followed by the classes of all tokens in the message. We consider the message direction because messages in opposite directions tend to have different formats. An example of a token pattern is (client_to_server,text,binary,text).
Note that this initial clustering is coarse-grained since messages with different formats may have the same token pattern. For instance, SMTP commands typically have two text tokens (``MAIL receiver'', ``RCPT sender'', ``HELO server-name''). In the recursive clustering phase, we improve the granularity of this clustering by recursively identifying FD tokens and dividing clusters.
Our recursive clustering relies on identifying format distinguisher (FD) tokens. To find FD tokens, we need to invoke both format inference and format comparison. In this section, we first explain these procedures before describing how we recursively identify FD tokens and divide clusters.
The format inference phase takes as input a set of messages and infers a format that succinctly captures the content of the set of messages. Our inferred message format is defined to be a sequence of token specifications which include not only token semantics but also token properties. We introduce token properties because we cannot infer the semantic meaning for every token and certain token properties are useful for describing the message format. Token properties currently cover two perspectives: binary vs. text and constant vs. variable. The first property reflects the token class, and the second decides if a token takes the same value across all messages of the same format (i.e., constant token) or different values in different application sessions (i.e., variable token). We also define the type of a token to be the sum of its semantic and property.
We now describe how token properties and semantics are derived.
Property Inference: Token class is already identified during the tokenization phase. Constant or variable tokens can also be easily identified. Since the set of messages come from a single token-pattern cluster, tokens in one message can be directly compared against their counterparts in another message by simply using the token offset. Thus, constant tokens are those that take the same value across the entire set of messages, and variable tokens are those that take more than one value.
Semantic Inference: We currently support three semantics: length, offset, and cookie (see Section 2.1 for definitions). We will discuss how it may be possible to support other semantics in Section 6. We identify cookie fields at the end of the merging phase since it requires correlating multiple messages in the same session. We employ the heuristics in RolePlayer [3] for doing this. Our heuristics for identifying length and offset fields are an extension of those in RolePlayer [3]. The intuition for identifying length fields is that, for a specific pair of messages, the difference in the values of potential length fields (at most four consecutive binary tokens or a text token in the decimal or hex format) reflects the difference of the sizes of the messages or some subsequent tokens. We thus simply check for a match between the value difference and the size difference. If a match holds for all pairs of messages in the cluster, the potential length field is declared to be a length field. For offset fields, we compare the value difference with the difference of the offsets of some subsequent tokens.
The goal of this procedure is to decide if two inferred message formats are the same. Given two formats, it scans these two formats token-by-token from left-to-right and matches the inferred type (i.e., semantic and property) of a token from one format against its counterpart from the other. If all tokens match, the two formats are considered to be the same.
Ideally, two tokens can be considered to match if their semantics match. However, since there are always tokens that we do not have semantics for, we need to compare their values (they have the same token class since the two formats have the same token pattern). We allow a constant token to match with a variable token if the latter takes the value of the former at least once. We also allow a variable token to match with another if there is an overlap in the two sets of values taken by them. Note that these policies are conservative, which is in line with our design rationale.
We identify FD tokens with the following algorithm. First, we invoke format inference on the set of messages in a cluster. Then, we scan the format token by token from left to right to identify FD tokens. We use three criteria in determining if a token is a FD:
This process is recursively performed on each of the subclusters because a message may have more than one FD token. We find the next FD token by scanning further down the message towards the right (end) of the message. It is necessary to scan all the way to the end because we need to recognize all FDs to obtain a good clustering and format inference.
When looking for the next FD token, the format inference is invoked again on the set of messages in each subcluster. This is because the inferred token properties and semantics might change because the set of messages has become smaller, and it is possible for stronger properties to hold. For instance, a previously variable token might now be a constant token; a previously variable token might now be identified as a length field.
In the tokenization and recursive clustering phases, we are conservative to ensure that the format inference procedure operates correctly on a set of messages of the same format. However, this leads to a new problem of over-classification, namely, messages of the same format may be scattered into more than one cluster. This problem can be quite severe; for instance, over a CIFS/SMB trace of almost four million messages, there are about 7,000 clusters/formats as input to this phase, while the total number of true formats is 130. The goal of the merging process is to coalesce similar formats from different clusters into a single one.
The key observation behind our merging phase is that, while sequence alignment [15] cannot be used for clustering messages of the same format, it can be used to align formats for identifying similar ones across different clusters. This is because we can leverage the rich token types (i.e., semantics and properties) inferred in the recursive clustering phase. For instance, knowing that a particular token is a length field in a format necessitates that its counterpart in another format is also a length field for these two formats to be considered a match. We refer to our algorithm for aligning formats as type-based sequence alignment.
In our type-based sequence alignment, we only allow two tokens of the same class (binary or text) to align with each other. We claim two aligned tokens are matched if they either have the same semantic or share at least one value (see Section 3.3.2 for details).
To compensate for tokenization errors, we allow gaps in our type-based sequence alignment. In addition to using gap penalties to control gaps, we introduce extra constraints to avoid excessive gaps. First, consecutive binary tokens in one message format are allowed to align with gaps if they precede or follow a text token in the other message format in the alignment, and the number of binary tokens is at most the size of the text token if the text token is aligned with a gap, or the size difference if it is aligned with another text token. This constraint is for handling the case of mistaking a sequence of binary tokens to be a text token or vice versa. Second, a text token is allowed to align with a gap, but we allow at most two gaps of this kind. This constraint is for handling the case that a text field consisting of some white space characters is mistakenly divided into multiple tokens.
When we align and compare two message formats to decide whether to merge them, we first check if the gap constraints can be satisfied. If no, we stop and claim the two formats are mismatched; otherwise, we continue to check the number of mismatches. If there is at most one pair of aligned tokens mismatched, we claim the two formats are matched and merge them. Note that this is conservative because the mismatched token can be treated as a variable token that takes values from a new set covering both formats.
Since we use the gap constraints and the number of mismatches to decide whether to merge two message formats, our merging performance is insensitive to sequence alignment parameters--scores for match, mismatch and gap.
Figure 2: Ethereal's XML output of an example SMB ``Tree Connect AndX Request'' message (edited for better presentation).
Figure 3: The ``name'' of the true format for the example message in Figure 2 concatenates the human readable names of all the fields.
Table 1: Discoverer 's inferred format for the true format in Figure 3. For C(x,y), C means constant, x means binary (``b'') or text (``t''; in text tokens, ``u'' means Unicode and ``n'' means it is null terminated), y is the hex value or string of the token; for V(x,z), z is the number of different values for the token.
For better understanding, here we present a concrete example based on the SMB ``Tree Connect AndX Request'' message format to explain the design and output of Discoverer. We obtain the true message format from Ethereal (see Figure 2 and Figure 3). The final inferred format by Discoverer is shown in Table 1.
We can see that the inferred format is a sequence of tokens with token properties (binary vs. text, constant vs. variable) and semantics (e.g., length fields). For tokens with unknown semantics, their possible values are also taken into account in the format. Before the merging step, messages of this true format were scattered into 24 clusters in 18 different token patterns. Different token patterns are due to the ``smb.signature'' field. Since this field may take any random values, we will have a different token pattern when more than three consecutive bytes at a different offset take values from the printable ASCII range and are wrongly treated as a text token. Messages in some token patterns were further split into fine-grained clusters in the recursive clustering phase due to our conservative approach. Our merging technique mitigates this over-classification problem effectively. At the end, all of the 24 clusters were merged into a single one.
This example also shows the possibility of imprecise field boundaries. For example, the first null byte of the field ``smb.nt_status'' was treated as the null terminator for the text token before it. However, we believe this kind of imprecision will not affect the effectiveness of the inferred format but instead create some extra inferred formats with different values for ``smb.nt_status''.
We implemented Discoverer in 5,700 lines of C++ code on Windows. The tool takes a network capture file either in the libpcap [12] or Netmon [14] format as input and outputs inferred message formats: a sequence of tokens with the inferred properties and semantics. Our current un-optimized implementation takes about 6-12 hours for a trace of several million messages (the merging procedure is the slowest due to the need of pairwise comparisons of all inferred formats). Before discussing the experimental results, we first describe our data sets and evaluation methodology.
We tested Discoverer on traces from two different sites: a honeyfarm site [2] (which responds to un-solicited, mostly malicious traffic) and a busy enterprise (which has diverse and high-volume traffic). The honeyfarm trace consists of CIFS/SMB only. The enterprise trace includes HTTP, CIFS/SMB, and RPC. The honeyfarm trace and the HTTP trace were used as the calibration data to help guide the design process and set tunable parameters. Our results are presented based on the output of our tool on the traces from the enterprise site, which served as the evaluation data. Thus, CIFS/SMB can be seen as the evaluation case where the tool was trained on the trace from a different site, whereas RPC is the case where the tool is evaluated over a new protocol. Though CIFS/SMB messages may encapsulate the RPC layer, the RPC trace consists of RPC traffic exclusively. The HTTP trace was used for both calibration and evaluation, but we hardly tailored our tool to HTTP.
In our experiment, the CIFS/SMB and RPC trace from the enterprise site contains traffic in one direction only. This will not affect our evaluation because the protocol formats in both directions are equally complicated based on Ethereal's parsing results of the honeyfarm CIFS/SMB trace. This is not to say that if we can infer the format in one direction, we are guaranteed to infer the format in the other direction; but the performance in one direction does give an indication of the performance in the other direction. In addition, since we do not put messages in different directions into the same cluster, uni-directional traffic does not make the problem any easier.
For the HTTP trace, our tool reassembled consecutive data sent in one direction into a message. For the CIFS/SMB and RPC traces, we leveraged Ethereal to parse them and identify message boundaries. A summary of these traces is shown in Table 2.
Our evaluation methodology is to compare the quality of our output with the set of true message formats. To obtain the true format, instead of trying to manually extract it from documentation and RFCs, we used the protocol analyzers in Ethereal [5]. Ethereal can parse a network trace and produce, for each message in the trace, an XML output that includes the list of fields in the message, the values of those fields, some human readable names and their sizes. Based on this output, we assign every message a true format ``name'', which is simply the concatenation of the human readable names of all the fields. An example of Ethereal's XML output and the true format name is shown in Figure 2 and Figure 3.
We characterize the performance of our tool and highlight the results in the following metrics:
As for the semantic inference, all the length fields inferred by Discoverer are correct; certain length fields are missed due to the trace limitation. For instance, some true formats in CIFS/SMB have a fixed message size. In this case, Discoverer will treat the length fields that reflect the message size as constant tokens, and it will not affect parsing messages of these formats in practice.
Discoverer has just a few tunable parameters (see Table 3). For a message larger than 2048 bytes, we only consider the first 2048 bytes, referred to as the maximum message prefix. The minimum length of text segments controls the tokenization procedure (Section 3.2.1). The minimum cluster size and the maximum distinct values for FD are used in the recursive clustering phase (see Section 3.3.3). The match/mismatch/gap scores are parameters for sequence alignment [15]. We observed that the performance of Discoverer is not sensitive to the settings of these parameters. For instance, we saw similar performance when we changed the maximum prefix size from 2048 bytes to 1024 bytes or changed the minimum cluster size from 20 messages to 10 messages. In addition, our type-based sequence alignment is not sensitive to the match/mismatch/gap scores as we discussed in Section 3.4. Thus we take the same parameters for our evaluations on all three protocols.
In the rest of this section, we present the experimental results on the enterprise traces for HTTP, RPC, and CIFS/SMB. Note that we use the inferred format and cluster interchangeably because we infer one format from each cluster.
Figure 5: Correctness for HTTP: CDF of the number of true formats followed by messages of a cluster for all clusters before the merging phase.
The HTTP protocol allows an arbitrary number of ``parameter: value'' pairs in an arbitrary order. We refer this to be the ``set'' semantic. Currently we are unable to identify this set semantic. So we treat each ordering of the set elements as a distinct format. By doing so, we observed 2,696 formats from the parsing results of Ethereal. We leave the identification of set semantic to be future work (see Section 6).
In Figure 4, we show the number of messages of each true format in the HTTP trace. Note that the y-axis is in logarithmic scale. This clearly reveals the heavy-tail distribution; most messages (more than 99%) fall in the first top 1000 true formats. We observed a similar trend in the RPC and CIFS/SMB trace as well. The implication for our tool is that the format coverage and message coverage are likely to be very different; the latter will be much higher compared to the former. In HTTP, we inferred 3,926 formats, which covered 5,938,511 out of 5,950,453 messages (99.8%). The covered messages belong to 865 out of 2,696 true formats (32%). Since we have a hard requirement on the minimum size of a cluster, we conjecture that the coverage ratio in terms of true formats will improve when the trace grows and each format has more messages.
Figure 5 plots the CDF of the number of true formats followed by messages of a cluster for all clusters before the merging phase. This reflects the correctness of our tool. This figure shows that about 90% of our inferred clusters are correct. They correspond to only one true format. The number rises to over 95% if we include inferred formats that match two true formats.
By manually inspecting the results, we found that the clustering errors are mainly due to the inaccuracy in Ethereal parsing. For example, in some message formats, Discoverer infers that there is a token that can be either ``Connection'' or ``Proxy-Connection''. Discoverer does not treat it as a FD because both may be followed by the same set of values such as ``Close'' or ``Keep-Alive''. However, Ethereal does not recognize ``Proxy-Connection'' as a parameter for HTTP, and returns a null string for this field in its parsing result, while it returns ``http.connection'' for ``Connection''. So we will have two true formats for a cluster that contains both ``Connection'' and ``Proxy-Connection''. Thus, our conciseness number may improve if Ethereal has more accurate parsing.
The merging phase reduced 4,465 clusters to 3,926 clusters. Since the covered messages belong to 865 true formats, this gives us a 5 to 1 ratio. In fact, almost 80% true formats are scattered into at most five clusters. On one hand, our conservative strategy eliminated false positives (i.e., wrongly merging two clusters that correspond to two different true formats). On the other hand, it did not help much in merging clusters for HTTP. The reason is as follows. HTTP allows many parameters in the form of ``parameter: value''. We treat the ``parameter:'' and ``value'' as separate tokens because of the space in between. Since the ``value'' token for certain parameters such as ``PROXY'' may be arbitrary strings, it is likely for such ``value'' tokens in two clusters to not have overlapped values. In this case, we will treat them as a mismatch. If two clusters happen to have more than one such mismatch, we will not merge them based on our conservative policy.
Figure 6: Effectiveness of merging for RPC: Number of inferred formats into which messages of a single true format are ``scattered'': before and after merging.
The RPC trace consists of exclusively RPC traffic. Though the trace size is 179MB, one order less than the HTTP and CIFS/SMB trace, we observed the similar trend in the distribution of the number of messages in each true format. Overall, we inferred 33 formats, which covered 340,624 out of 351,818 messages (96.8%). The covered messages belong to 18 out of 50 true formats (36%).
The recursive clustering generated 83 clusters, among which 78 clusters contain messages from a single true format, and the rest five clusters have messages from two true formats. The merging phase helped reduce the overall clusters from 83 to 33 without introducing false positives. This shows that our merging phase compensates the tokenization errors well by recognizing wrongly classified binary and text tokens. From Figure 6 we can see that, for each of 11 true formats, its messages were merged into in a single cluster.
Figure 7: Correctness for CIFS/SMB: CDF of the number of true formats followed by messages of a cluster for all clusters before the merging phase.
Figure 8: Merging effectiveness for CIFS/SMB: Number of inferred formats into which messages of a single true format are ``scattered'': before and after merging
CIFS/SMB is a fairly complex binary protocol which includes several layers of protocols: it consists of the NetBIOS Session Service (NBSS) headers which encapsulate a SMB header which in turn is layered over RPC. Overall, we inferred 679 formats, which covered 3,640,239 out of 3,818,267 messages (95.3%). The covered messages belong to 130 out of 301 true formats (43%).
In Figure 7, we plot the CDF of the number of true formats followed by messages of a cluster for all clusters before the merging phase. We can see that 57% clusters contain messages from a single true format, and 35% clusters have messages from two true formats. We manually checked these clusters and found that it is due to the imprecise parsing of Ethereal. It recognized the last field as a ``dcerpc.nt.close.frame'' field for some messages and as a stub data for other messages while those messages have the same format according to our manual inspection. If we take into account this factor, more than 90% clusters contain messages from a single true format, which is consistent with HTTP.
We further inspected the clusters consisting of messages from more than two formats and found that, for many of such clusters, the only difference in the true formats followed by their messages is the last field. It is in the form of ``Stub data (XX bytes)'', and the difference is in ``XX'' which says the size of the stub data. Based on our manual inspection, we conjecture that these stub data likely follow the same format and the size difference is due to a text field with a variable length embedded in the stub data. Therefore, 90% is a conservative measure on the correctness.
In Figure 8, we plot the number of inferred formats into which messages of a single true format are scattered before and after merging. Like RPC, the merging technique is effective on CIFS/SMB. Overall, we reduced the number of clusters from 7180 to 679 without introducing false positives, which gives us a 5 to 1 ratio against the 130 true formats.
We divide the related work into three categories. First, we discuss the state of the art in protocol reverse engineering. Second, we present the previous work that was geared towards a specific application rather than performing all-purpose protocol reverse engineering. Finally, we discuss grammar inference.
To date, most protocol reverse engineering appears to be a painstaking manual process, which involves looking at available documentation, source code, and traces. Two popular examples in the community include the SAMBA project [18] and the messenger clients [6]. Automatic protocol reverse engineering appears to have received much less attention. The most closely related work to our paper that we are aware of is the Protocol Informatics project [17]. It aims to employ sequence alignment techniques to infer protocol formats from a trace of the protocol. Its main limitation is that the byte-wise sequence alignment, while ideally suited to aligning messages with similar byte sequences, is not suitable for aligning messages with similar formats. In addition, selecting weights to tune the alignment is hard as shown in [3].
Previous studies have also performed some level of protocol reverse engineering with a specific purpose in mind, namely, application-level replay and protocol identification.
RolePlayer [3] and ScriptGen [11,10] both leverage byte-wise sequence alignment techniques to achieve application-level replay by heuristically detecting and adjusting some specific fields such as network addresses, lengths, and cookies. A driving application for application-level replay is to build a protocol-independent, application-level proxy to filter known attacks in a honeyfarm. To improve the performance of the Needleman-Wunsch algorithm [15], RolePlayer uses the so-called pairwise constraint matrix, which specifies whether the th byte of the first message can or cannot be aligned with the th byte of the second message based on the field semantic of the th byte. However, if the semantic of the th byte in the first message is unknown, it can be aligned with any byte in the second message, which may lead to alignment errors. There are two key differences between Discoverer and these two systems. First, RolePlayer and ScriptGen only discover the protocol format to the extent necessary for replay, while Discoverer is aimed to discover the complete protocol format. Second, instead of using the byte-wise sequence alignment, we first cluster messages based on token patterns and then use a novel type-based sequence alignment technique to align and compare message formats based on token types. This represents a significant improvement: on one hand, we can avoid byte-pattern alignment in the recursive clustering phase to achieve a good performance on correctness; on the other hand, we can mitigate over-classification by merging similar inferred formats. Furthermore, compared with ScriptGen which clusters messages by comparing the whole messages at once, our recursive clustering technique performs better because we not only look at the potential FD token itself but also look into ``the future'' by comparing the subsequent tokens in the messages. Some of our techniques for identifying semantically important fields (such as length fields) are borrowed from RolePlayer.
Ma et. al. [13] perform protocol identification, that is, they classify the set of sessions in a trace into various protocols without relying on port numbers. They develop three techniques for profiling messages exchanged in a protocol: product distributions of byte offsets, Markov models of byte transitions, and common substring graphs of message strings. The main difference between their work and ours is that we have different goals. They aim to characterize a protocol based on the first (e.g., 64) bytes in sessions of the protocol; we leverage the format inference and type-based sequence alignment techniques to decipher the message formats of the entire session.
The problem of protocol reverse engineering is related to the theoretical problem of grammar inference, which aims to deduce the grammar given a set of sample strings drawn from it. This problem is unfortunately theoretically unsolvable, even when the grammar is in the simplest form of Chomskian grammar, the regular language [7]. Since even a regular language can be potentially infinite and the sample set cannot be, it turns out that this task is impossible. The language implicit in application-level protocols is often substantially more complex than a regular language, involving fields such as length fields. Because of this complexity, we were unable to directly apply any results from the grammar inference community. There have been extensions based on Kolmogorov complexity [4] to learn the simplest finite language from only positive examples, but once again, they appear too complicated to apply to the context sensitive grammars that network protocols involve.
Techniques used in the speech recognition community, such as, probabilistic Markov chain analysis [8], were not applied in our work, since the correlation between protocol fields makes it difficult for the byte sequence in a message to be modeled as independent samples from a Markov process.
In this section, we discuss the limitations of our approach. We categorize our limitations into two categories: ones that are fundamental to the problem we want to solve and those that are due to the heuristics in our tool. We will also describe future research directions for solving these limitations.
There are two main fundamental limitations.
We now move on to the imprecision problems that are directly related to the design of our tool. The following are the major imprecisions in our inferred message formats:
Many of the limitations above are due to the limited information available from network traces. To tackle these limitations and achieve a better reverse-engineered protocol specification, we can use program analysis to gain more information and insight into the parsing and processing of the input in the program. For instance, we may easily identify two consecutive bytes as a WORD (i.e., a two-byte integer) from run-time analysis by observing that they are processed as a WORD throughout the execution.
We have focused on reverse engineering network protocols in Discoverer; it would be useful to reverse engineer the input specifications for file-based applications, since we have seen a significant growth in file-based attacks.
Protocol reverse engineering is a highly manual process today, which is still suffered through because of the immense value of protocol knowledge. We have developed Discoverer, a tool that aims to automate this reverse engineering process. Discoverer leverages recursive clustering and type-based sequence alignment to infer message formats. We have demonstrated Discoverer can infer message formats effectively for three network protocols, CIFS/SMB, RPC, and HTTP. In the future, we plan to enrich our semantic inference, research on the protocol state machine inference, explore the direction of using program analysis to reverse engineer the specifications of both network and file input, and apply reverse-engineered protocol specifications to real world applications.
We would like to thank Vern Paxson, Ion Stoica, Christian Kreibich, and Gautam Altekar for their valuable comments on an early draft of this paper. We thank Joseph Kravis for providing network traces to us. We would also like to thank the anonymous reviewers for their insightful comments.
N. Borisov, D. J. Brumley, H. J. Wang,
J. Dunagan, P. Joshi, and C. Guo.
A Generic Application-Level Protocol Analyzer and its Language.
In Proceedings of the 14th Annual Network & Distributed System Security Symposium (NDSS), March 2007.
W. Cui, V. Paxson, and N. Weaver.
GQ: Realizing a System to Catch Worms in a Quarter Million Places.
Technical Report TR-06-004, ICSI, 2006.
W. Cui, V. Paxson, N. C. Weaver, and
R. H. Katz.
Protocol-Independent Adatpive Replay of Application Dialog.
In Proceedings of the Symposium on Network and Distributed System Security (NDSS 2006), February 2006.
F. Denis.
Learning Regular Languages from Simple Positive Examples.
Machine Learning, 44(1/2):37-66, 2001.
Ethereal: A Network Protocol Analyzer.
Gaim Instant Messaging Client.
E. M. Gold.
Language Identification in the Limit.
Information and Control, 10(5):447-474, 1967.
F. Jelinek and J. D. Lafferty.
Computation of the Probability of Initial Substring Generation by Stochastic Context-Free Grammars.
Computational Linguistics, 17(3):315-323, 1991.
J. Kannan, J. Jung, V. Paxson, and C. E.
Semi-Automated Discovery of Application Session Structure.
In Proceedings of the 2006 Internet Measurement Conference (IMC), Rio de Janeiro, Brazil, October 2006.
C. Leita, M. Dacier, and F. Massicotte.
Automatic Handling of Protocol Dependencies and Reaction to 0-Day Attacks with ScriptGen based Honeypots.
In Proceedings of the 9th International Symposium on Recent Advances in Intrusion Detection, Hamburg, Germany, September 2006.
C. Leita, K. Mermoud, and M. Dacier.
ScriptGen: An Automated Script Generation Tool for Honeyd.
In Proceedings of the 21st Annual Computer Security Applications Conference (ACSAC 2005), December 2005.
The libpcap Project.
J. Ma, K. Levchenko, C. Kreibich,
S. Savage, and G. Voelker.
Unexpected Means of Protocol Inference.
In Proceedings of the 2006 Internet Measurement Conference, 2006.
Microsoft Corporation.
Microsoft Network Monitor 3.
S. B. Needleman and C. D. Wunsch.
A General Method Applicable to the Search for Similarities in the Amino Acid Sequence of Two Proteins.
Journal of Molecular Biology, 48(3):443-453, 1970.
R. Pang, V. Paxson, R. Somer, and
L. Peterson.
binpac: A yacc for Writing Application Protocol Parsers.
In Proceedings of the 2006 Internet Measurement Conference, October 2006.
The Protocol Informatics Project.
How Samba Was Written.
B. W. Watson.
A Taxonomy of Finite Automaton Minimization Algorithms.
Technical Report CS-93-44, Eindhoven University of Technology, Eindhoven, The Netherlands, 1993.


text:
Mention a visit to Montserrat and you can expect quizzical expressions. Spanish mountain? Massachusetts college? West Indies island?
Time Off » Getaways
August 1, 2010
April 1, 2010
Tucsonans are generally too polite to say this, but they consider their city to be the anti-Phoenix.
February 1, 2010
To reach most hotels you simply fly or drive there, but to get to Jules Undersea Lodge you'll also need scuba gear. Located at the bottom of a lagoon in Key Largo, Fla., the freestanding resort sits at a depth of 21 feet and is monitored 24 hours a day from a nearby "surface control center."
February 1, 2010
In the market for a boat? The 25th annual Palm Beach [Fla.] International Boat Show, to be held March 25 to 28, will showcase more than $350 million worth of watercraft-everything from powerboats, bowriders and personal vessels to yachts longer than 100 feet.
February 1, 2010
Indians, soldiers and ghosts of Camelot have docked on her marshy shores. Early 20th century millionaires built castles and commanding women protected their estates. The history of Cumberland Island reads like steamy, romantic fiction. Now its mansions stand in ruin, with wild horses as their guests. But that doesn't mean there's nothing left to see or do here-far from it.
December 1, 2009
The 2010 Vancouver Winter Olypmics countdown is on. Opening ceremonies take place on February 12, when tens of thousands of Olympic athletes, coaches, officials and organizers will be joined by hundreds of thousands of spectators at the BC Place Stadium in downtown Vancouver and the Whistler Blackcomb ski resort.
December 1, 2009
One of the most unusual hotels anywhere exists for only part of the year.
October 1, 2009
The 11th staging of the Dubai Airshow will take place from November 15 to 19 at the Airport Expo Centre in Dubai, UAE. In past years the event has focused on military and commercial aviation, but business aviation has been making its presence felt. At the 2007 event (the show is held every two years) private and corporate jet sales reached $2.7 billion.
October 1, 2009
While Africa brims with unspoiled landscapes written in big, bold strokes, Botswana's Okavango Delta proves especially dazzling. The 6,000-square-mile Delta is formed by the mighty Okavango, "the river that never finds the sea," which roars down from neighboring Angola and spills out into the sands of the perpetually barren Kalahari Desert.
September 1, 2009
Much has changed since last fall, when the National Business Aviation Association held its 61st Annual Meeting and Convention in Orlando.
"It doesn't sound like much but those extra hours [saved by flying privately] make my life 10 times more efficient. "
-life and business strategist Tony Robbins
Most Popular
January 10, 2017
January 15, 2017
January 1, 2017
January 15, 2017
January 22, 2017
January 1, 2017
January 16, 2017
January 8, 2017
January 15, 2017
January 22, 2017
February 1, 2012
January 12, 2012
December 1, 2011
May 30, 2013
December 5, 2012
November 26, 2012
April 30, 2012

subset: commoncrawl


text:
Debates of Feb. 28th, 2003
House of Commons Hansard #70 of the 37th Parliament, 2nd Session. (The original version is on Parliament's site.) The word of the day was yukon.
- Yukon Environmental and Socio-economic Assessment Act
- Pharmacist Awareness Week
- Justice
- Yukon Sourdough Rendezvous Festival
- Foreign Credentials
- Josée Lavigueur
- National Defence
- Canadian Music Week
- International Women's Day
- Liberal Party of Canada
- Atlantic Canadian Artists
- International Women's Day
- Winter Games
- Suzanne Rochon Burnett
- Canadian Forces
- Black History Month
- Gasoline Taxes
- Ethics
- Iraq
- Ethics
- Foreign Affairs
- National Defence
- The Environment
- Government Contracts
- Technology Partnerships Canada
- Taxation
- Agriculture
- Veterans Affairs
- Border Security
- Health
- Foreign Affairs
- Drugs and Pharmaceuticals
- Goods and Services Tax
- Oil and Gas Prices
- Health
- Human Rights
- The Environment
- Organized Crime
- Firearms Registry
- Foreign Affairs
- The Environment
- Fisheries and Oceans
- Citizenship and Immigration
- Government Appointments
- Zimbabwe
- Points of Order
- Privilege
- Points of Order
- Report of the Canadian Forces Housing Agency
- Interparliamentary Delegations
- Committees of the House
- Income Tax Act
- Committees of the House
- Petitions
- Questions on the Order Paper
- Question No. 45
- Question No. 105
- Specific Claims Resolution Act
- Committees of the House
- Specific Claims Resolution Act
- Falun Gong
Fisheries and Oceans
Oral Question Period
February 28th, 2003 / 11:55 a.m.
Charles Caccia Davenport, ON
Mr. Speaker, my question is for the Minister of Fisheries and Oceans and it is based upon media reports from British Columbia. Because of salmon aquaculture operations, wild salmon are exposed to severe sea lice infestations which in turn have led to a drastic plunge in the number of pink salmon.
Will the minister set firm rules banning the bad practice of net-cage salmon farming which is the root cause of sea lice outbreaks, and also not resort to the use of pesticides?
Fisheries and Oceans
Oral Question Period
11:55 a.m.
West Nova
Nova Scotia
Robert Thibault Minister of Fisheries and Oceans
Mr. Speaker, I thank the member for his question and for his genuine interest in the matter of the protection of wild salmon stocks. It is a matter we are taking very seriously in light of the recent problems that have been outlined with the Broughton Archipelago.
We have a five point program to do a study to make sure that we understand fully whether the sea lice problem is increased by aquaculture in those areas and to make sure that we minimize the risk. It is our belief that we can have both an aquaculture industry and at the same time protect the wild salmon resource. It is very important that our first priority be the wild salmon resource.
Citizenship and Immigration
Oral Question Period
11:55 a.m.
Jocelyne Girard-Bujold Jonquière, QC
Mr. Speaker, on Sunday, Citizenship and Immigration Canada, demonstrating a complete lack of compassion, will deport Fatima Marhfoul to Morocco, her country of origin, where she faces the threat of a severe prison sentence because her application for permanent residence in Canada is considered an insult to Morocco's monarchy.
Knowing that Fatima Marhfoul was shamefully exploited as a domestic in Canada for 10 years, does the Minister of Citizenship and Immigration not feel that he should demonstrate humanity in her case and cancel the deportation procedure before it is too late?
Citizenship and Immigration
Oral Question Period
11:55 a.m.
Brampton Centre
Sarkis Assadourian Parliamentary Secretary to the Minister of Citizenship and Immigration
Mr. Speaker, as members know, we cannot comment on specific cases in the House. However, I would like to inform the member that the information she has and the information the department has are different. We have to make sure the case proceeds appropriately so we can make a final judgment which will be appropriate for the government and for the individual concerned.
Government Appointments
Oral Question Period
11:55 a.m.
Wendy Lill Dartmouth, NS
Mr. Speaker, today we hear that former Cape Breton MP David Dingwall will become the president of the Royal Canadian Mint, which includes an annual salary of $250,000, a car and a chauffeur. It is a nice gift from the Prime Minister to his former minister of health who was rejected by his Cape Breton constituents and who presided over billions of dollars of cuts to health services, leaving our health care system in the state it is today.
Is this the first in a long string of patronage postings to be handed out by the Prime Minister to Liberal loyalists, or will he consent to having a public process for this type of appointment?
Government Appointments
Oral Question Period
Don Valley East
David Collenette Minister of Transport
Mr. Speaker, I could not think of anyone better qualified to be master of the mint than the former minister, who was minister of public works and who understands the mint, has a good grasp of its issues and of marketing its products around the world.
I would have thought the hon. member would have been happy, as a Nova Scotian, that someone from that province, and especially from Cape Breton, has been recognized by the board of the Royal Canadian Mint. He will serve with distinction.
Oral Question Period
Progressive Conservative
Bill Casey Cumberland—Colchester, NS
Mr. Speaker, on February 18 the member for Esquimalt--Juan de Fuca asked if Canada would oppose the reinstatement of Zimbabwe to the Commonwealth. The Minister of Foreign Affairs outlined the position of South Africa, Nigeria and several others, but did not indicate the position of Canada.
Will the minister clarify Canada's position and confirm that Canada will oppose the reinstatement of Zimbabwe to the Commonwealth?
Oral Question Period
Toronto Centre—Rosedale
Bill Graham Minister of Foreign Affairs
Mr. Speaker, I would like to inform the House and the hon. member that we are working closely with the Commonwealth secretariat, particularly the right hon. Donald McKinnon who is the secretary-general of the Commonwealth and the members of the troika to see if we can resolve this matter through the troika.
We recognize that the conduct of Zimbabwe and President Mugabe at this time is totally inconsistent with their Commonwealth obligations. However, we wish to work through the Commonwealth process before we make any clear decisions as to what should take place at the Commonwealth leaders meeting where this matter will be considered.
Points of Order
Oral Question Period
Don Valley East
David Collenette Minister of Transport
Mr. Speaker, earlier in question period, the right hon. member for Calgary Centre accused me of uttering a false statement in reply to one of his questions that the conflict of interest guidelines emanated from the Parker commission and the former Mulroney government, of which he was a member.
He challenged me to put documents on the table to prove my answer. I do not need to do that. This was confirmed by Mr. Mulroney himself in a published statement this week when he said he thought a blind management agreement might have been used for a public servant who worked on the free trade agreement.
Points of Order
Oral Question Period
Progressive Conservative
Joe Clark Calgary Centre, AB
Mr. Speaker, the Minister of Transport will know that there is a world of difference between a statement outside the House saying something might have happened and the document that I requested saying it did happen.
If the Minister of Transport believes that he has a document which proves his case, let him not rely on testimony from outside the House; let him have the courage to come to this Parliament and lay upon the table the document itself.
Points of Order
Oral Question Period
The Deputy Speaker
I think I heard a difference of opinion which amounts to a debate in this place. It is not a point of order.
I have a notice of a question of privilege from the hon. Minister of State and Leader for the Government in the House of Commons.
Oral Question Period
Don Boudria Minister of State and Leader of the Government in the House of Commons
Mr. Speaker, this is in fact not a new question of privilege. It refers to something that was raised in the House yesterday. I committed yesterday to return to the House on the question of privilege at the earliest opportunity, which of course is today.
Yesterday the hon. member for St. Albert asked about details on the firearms funding in the supplementary estimates by way of a question of privilege.
A total of $77.5 million was requested for Justice in the supplementary estimates. Of this amount, $59.4 million was requested in support of the Canadian firearms program, of which $50.5 million is in Justice vote 1, operating, and $8.8 is in vote 5, contributions. The remaining $18 million is to cover four additional items, namely: incremental funding--which has an asterisk beside it and I will get back to that in a moment--to address core operational requirements, $16.4 million; public security and anti-terrorism initiatives, $.4 million; additional operating costs, $1 million; and partnering with the voluntary sector, $.2 million.
On the use of Treasury Board vote 5 for Justice, as it was alleged yesterday, in the 2002-03 supplementary estimates part B, the member for St. Albert also asked whether Treasury Board vote 5 was used for firearms funding. As I answered yesterday, and I am willing to provide more detail now, the answer is no.
As I indicated yesterday, $14 million was provided from Treasury Board vote 5 specifically for prosecution and legal costs associated with an increased workload in drug prosecution. When the minister appears before committee he can give details of that. That is the custom. The remainder is for aboriginal litigation cases.
The asterisk in the supplementary estimates denotes the fact that the request was made by the Minister of Justice for access to vote 5 for this specific item only. The department will use this temporary allocation only for this purpose.
It should be noted that all departmental expenditures in either the main or supplementary estimates are approved by Parliament and reported in the public accounts, which of course ultimately is the verification method. They are subsequently reviewed, as we know, and verified by the Office of the Auditor General.
I am pleased to inform the House on this. I hope it will assist the Chair in making its decision as to whether or not the privileges have been breached, which of course we maintain they have not.
Oral Question Period
12:05 p.m.
Canadian Alliance
John Williams St. Albert, AB
Mr. Speaker, I think the government House leader is just trying to deflect the whole issue.
The point of my question of privilege was that he gave information, and he repeated some of that information today, that is not in the main estimates for 2003-04 that was supplied by the spokesperson for the Department of Justice outside this chamber to the general public, referring to the fact that the House would be advised of this information later when the plans and priorities, the part IIIs, were tabled in the House later this month.
This is information that first belongs here before it goes out there, not the other way around. That was my question of privilege.
Oral Question Period
12:05 p.m.
The Deputy Speaker
Of course, this original question of privilege was heard yesterday by our hon. Speaker himself. He has undertaken to review the matter so I am sure that today's information will again give him more subject matter for reflection. His decision will be brought to the House at the appropriate time.
Points of Order
Oral Question Period
12:05 p.m.
Progressive Conservative
Joe Clark Calgary Centre, AB
Mr. Speaker, the Minister of Transport in his capacity as acting prime minister referred to documents which he said had respect to a blind management agreement entered into by the former government. He knows that he has the authority of the prime minister of that former government to lay upon table documents which might otherwise be unavailable to the House that pertain to that particular matter. I think it would be in the interest of debate in the House that if the hon. minister has documents that prove his case he table them now in the House of Commons.


text:
Android 4.4 to be officially called KitKat
The next version of Android will be called KitKat after the Nestle chocolate bar, and not Key Lime Pie, as was predicted for months, Google has announced.
The next version of Android will be called KitKat after the Nestle chocolate bar, and not Key Lime Pie, as was predicted for months, Google has announced.
The latest major version of Android, known as Jelly Bean, is now the most widely used variant of the platform, according to new statistics from Google.
Four months after Facebook released a native app for iOS, a corresponding Android version is available. The app, written with native code (instead of HTML 5) that the company says is twice as fast as the previous app, has no significant new features ...
The latest business news, reviews, features and whitepapers
Visit our shop for the best deals on hot products
Watch our video news and reviews from around the world
Comprehensive buying guides, features, and step-by-step articles
First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.
For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.
The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.
The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.
My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.


text:
Colorado Springs, Colo.- Team for Tomorrow, a program launched in 2008 by America's Olympic and Paralympic athletes and the United States Olympic Committee, continues to make a difference for those in need around the world. Today, the USOC announced details of the 2012 program, including the roster of 2012 Team for Tomorrow Athlete Ambassadors and a partnership with the YMCA and Boys & Girls Clubs of America - both Multi-Sport Organizations within the U.S. Olympic Family.
Team for Tomorrow is a humanitarian relief effort through which U.S. athletes offer assistance and support to people around the world who are in need. Humanitarian relief and assistance takes place in the form of donations, volunteerism, disaster recovery support, advocacy and other contributions to communities. The program offers U.S. athletes a way to stay connected to sport in a meaningful way, finding new significance in what it means to represent their country.
The Team for Tomorrow Athlete Ambassadors will serve as captains of the program on behalf of the entire 2012 U.S. Olympic and Paralympic Teams. As ambassadors, this select group of athletes will act as advocates and champions of the effort, educating their U.S. teammates and spreading awareness about Team for Tomorrow's causes for the 2012 U.S. Olympic and Paralympic Team. The ambassadors include:
- Tony Azevedo, water polo
- Rachel Dawson, field hockey
- Anjali Forber-Pratt, Paralympic track & field
- Rudy Garcia-Tolson, Paralympic swimming
- Jessica Hardy, swimming
- Gwen Jorgensen, triathlon
- Tim Morehouse, fencing
- David Oliver, track & field
- Heather O'Reilly, soccer
- Mary Whipple, rowing
"I decided to get involved with Team for Tomorrow because it provides an opportunity to give back," said Oliver, 2008 Olympic bronze medalist in the 110-meter hurdles and London 2012 hopeful. "At one point or another, we all need a helping hand and this program provides a platform for Olympians and Paralympians to represent Team USA at the local level where we can interact with members of the communities in which we live."
For complete bios of the Athlete Ambassadors, please click here.
Between now and the London 2012 Games, Team for Tomorrow will connect Athlete Ambassadors and their teammates with local YMCAs and Boys & Girls Clubs in their hometown or training communities. These athletes will donate service hours helping with afterschool activities, leading sport clinics and speaking to young people about the importance of living an active and healthy lifestyle.
"We are thrilled that this incredible roster of Athlete Ambassadors and their teammates are making time to visit local Boys & Girls Clubs through Team for Tomorrow in the lead-up to the London 2012 Games," said Wayne B. Moss, Boys & Girls Clubs of America Senior Director of Sports, Fitness & Recreation. "The inspiration that these individuals will bring to their communities will undoubtedly make this summer's Games unforgettable for everyone involved and leave lasting memories for dozens of young people."
Additionally, U.S. Olympians, Paralympians and London hopefuls across the country will visit children's hospitals and at-needs schools both leading up to and following the Games. They will share their journeys of determination and commitment to reaching their ultimate goal - the 2012 Olympic and Paralympic Games - while encouraging children to reach for their dreams.
Athlete Ambassador and two-time Paralympic medalist in wheelchair racing Forber-Pratt will conduct one of these visits in July at the Shriners Hospitals for Children® - Chicago, where the track-start will meet with children receiving pediatric specialty care for orthopedic conditions, spinal cord injuries, as well as cleft lip and palate.
"Having a group of passionate, inspiring athletes working together to give back to our communities all across the country and inspire and motivate others to do so is extremely powerful," said Forber-Pratt. "We have an important message to share, and a responsibility to educate those around us. It is rewarding to make a difference in the lives of others, and I couldn't be more excited to be involved with a program like Team for Tomorrow."
Team for Tomorrow's first initiative in 2008 provided 1,000 disaster relief tents to families that lost their homes during the earthquakes that struck China's Sichuan Province in May of that year. Then, in 2010, nearly 25,000 items of athletic apparel and equipment were donated to National Olympic Committees in Africa, Fondation Internationale OlympAfrica, and the people of Afghanistan through Kabul's Bagram Air Force Base.In both 2008 and 2010, U.S. athletes donated hundreds of service hours to Habitat for Humanity after returning from both Beijing and Vancouver. For more information, visit the Team for Tomorrow page on TeamUSA.org.


text:
Bank Stocks and the Secret of NIM (Update 2)
Updated with market close information, comments from FIG Partners analyst and Oppenheimer analyst Terry McEvoy on FirstMerit, and comments on Regions Financial from FBR analyst Paul Miller.
NEW YORK ( TheStreet) -- Bank stock investors need to look beyond declining net interest margins and focus on what really matters.
A bank's net interest margin (NIM) is the spread between the average yield on loans and deposits and the average cost for deposits and borrowings. With the Federal Reserve keeping its target range for the short-term federal funds rate in a range of zero to 0.25% since late 2008, the majority of banks have already seen most of the benefit they will realize on the cost side, while most continue to see their yields on earning assets decline.
Fig Partners analyst John Rodis says that "for most banks, there is just not much room for improvement on cost of funds," but the news isn't all bad.
"The one thing to remember when you talk about the margin is that even though the margin is down, it is just a ratio. It is very important to look at net interest dollars," Rodis says. "In a lot of cases, net interest income is coming down too, but it is certainly not coming down at the same pace as the margin."
FirstMerit Corp. (FMER) of Akron, Ohio, is an example of a bank with net interest income declining at a slower pace than the net interest margin. The company on Monday reported a fourth-quarter NIM of 3.58%, declining from 3.66% in the third quarter. Net interest income was $119.1 million in the fourth quarter, declining 1.3% from $120.7 million the previous quarter.
FirstMerit's average core deposits -- excluding CDs and other time deposits -- grew by 1.1% during the fourth quarter to $10.173 billion, while the company's average loans -- excluding balances covered by Federal Deposit Insurance Corp. loss-sharing agreements -- grew 3.2% to $8.444 billion.
Still, Rodis on Wednesday downgraded FirstMerit to a "Market-Perform" rating from "Outperform," saying the stock was up 10% since it was upgraded in October. The analyst's target price for the shares is $16.00. Rodis lowered his 2013 earnings estimate for FirstMerit by five cents to $1.20 a share, to reflect "expectations for a lower margin and lower net interest income," although he also said he expected "core loan growth of 8-10% in 2013." Rodis also introduced a 2014 EPS estimate of $1.37.
Oppenheimer analyst Terry McEvoy on Tuesday stuck with his "Outperform" rating for FirstMerit, with an $18 price target, and said that "since it inked a deal to acquire MI-based Citizens Republic on September 13, 2012, FirstMerit's shares have fallen 10% compared to a 2% decline in the S&P Regional Bank index and a 4% gain in the S&P 500." McEvoy said that "in contrast to critics of the Citizens deal, we believe the assumptions behind the acquisition are conservative and that the combination will ultimately create a more valuable franchise."


text:
Karol Conka was the talk of Brazil before her recent show at our 2012 São Paulo event, and lived up to the hype—and then some—when she and Nave totally rocked out on stage.
After her incredible performance, we filmed Conka rapping the extremely good vibes of her new song "Corre, Corre Erê" in front of some of the artworks. The party started with Minha Yang's Meditation 1208~, before she danced through Cantoni & Crescenti's reflective Wall, rearranged the colored pixel cubes of Zigelbaum + Coelho's Six-Forty by Four-Eighty, shimmied in front of SuperUber's interactive mobile game OctoCloud, and eventually took flight in Chris Milk's The Treachery of Santuary.


text:
Benny Greb has announced a four-date UK clinic tour.
The clinic ace kicks off the run at Rhythm Base in Glasgow on 6 May.
He follows that up with dates at Gateshead's Drum Shop on 7 May, before a performance at Sound Attak in Colchester the following evening.
The tour is rounded off with a stop off at Absolute Music in Bournemouth. From there Benny will head into the Netherlands for a pair of clinics.
For more information on Benny head to www.bennygreb.de.
Benny Greb announces UK clinics
Four dates on the way
Benny Greb has announced a four-date UK clinic tour.


text:
Katelynn Ludwig and David Schneider II announce their engagement.
The bride-to-be is the daughter of Mr. and Mrs. Paul Ludwig of Alpena. The future groom is the son of Mr. and Mrs. David Schneider, also of Alpena.
A 2006 graduate of Alpena High School, Katelynn graduated from Central Michigan University with a Bachelor of Science Degree in Elementary Education. A 2006 graduate of Cheboygan High School, David will graduate in December 2013 with a Bachelor of Science Degree in Secondary Education, majoring in Special Education and History.
David and Katelynn will exchange their wedding vows June 15, 2013 at St. Paul Lutheran Church in Alpena.


text:
Robert E. "Swampy" Whitmore
Robert E. "Swampy" Whitmore, 57, of 8 Bowen St., died unexpectedly Monday, Feb. 4, 2013, in his home.
A lifelong Jamestown resident, he was born July 5, 1955, a son of the late James and Lucille VanEvery Whitmore.
He was employed by SKF in Falconer as a machine operator.
Swampy was a very social person and was a member of Cassadaga American Legion, Falconer Moose, Eagles Lodge, Ellington, Carroll and Falconer Rod and Gun Clubs and was a life member of Vietnam Veterans Association.
He enjoyed to taking his '63 Nova SS out and going to car shows during the summer with his wife and family.
Surviving are his wife, the former Roberta Troutman; two sons: Bradley Whitmore of Sarasota, Fla., and Brandon (Tabitha) Whitmore of Jamestown; a granddaughter, Sierra Whitmore of Arizona; a brother, William Whitmore of Kennedy; and three sisters: Cindy Whitmore of California, Chris Whitmore of Kansas and Sharon Whitmore of Frewsburg.
Besides his parents, he was preceded in death by a son, Brian Whitmore on March 4, 2004; two sisters: Norma Dalrymple and Rosemarie Whitmore; and a brother Jim Whitmore.
The funeral will be held at 11 a.m. Friday in the Lind Funeral Home.
Friends will be received from 2-4 p.m. and 7-9 p.m. Thursday in the funeral home.
Memorials may be made to the American Diabetes Association, 315 Alberta Drive, Suite 102, Amherst, NY 14226 or American Heart Association, PO Box 417005, Boston, MA 02241-7005.
You may light a candle in remembrance of Swampy at www.lindfuneralhome.com.


text:
Comic Party Revolution
Save Tsukamoto Printing!
Episode 6 | TV-14
Chisa's father collapses at their family print shop. Subaru comes to the rescue, and the two form the ultimate team…of utter chaos! When Subaru's plan to pull the shop out of debt backfires, they'll need a miracle to keep the printer's rolling.
Official Site: www.funimation.com/shows/comic-party-revolutionHide Details


text:
Qwest/CenturyTel Merger
On April 22, CenturyTel Inc. (NYSE: CTL) announced the acquisition of Qwest Communications International Inc. (NYSE: Q) in a stock swap worth $10.6 billion.
The combined company would service 18 million phone lines in 37 states, but will still lag far behind industry leaders AT&T Inc. (NYSE: T) and Verizon Communication Inc. (NYSE: VZ).
Shareholders of Qwest would receive 0.1664 CenturyTel shares for each share that they own. Qwest stockholders would own 49.5 percent of the combined company, with CenturyTel stockholders controlling the rest.
The deal is expected to close in the first half of 2011, and the boards of both companies will have to approve the tax-free acquisition. The deal would save an estimated $625 million over the three to five years following the close.


text:
Pizza Making Forum
. Please
Did you miss your
activation email
1 Hour
1 Day
1 Week
1 Month
Login with username, password and session length
This topic
This board
Entire forum
Pizza Glossary
Pizza Books
Dough Calculators
Other Tools
Pizza Making Forum
Pizza Making
Neapolitan Style
Neopolitan dough?
« previous
next »
Pages: [
Go Down
Topic: Neopolitan dough? (Read 4499 times)
0 Members and 1 Guest are viewing this topic.
Registered User
Posts: 6
I Love Pizza!
Neopolitan dough?
August 30, 2005, 03:19:38 PM »
I am a new registered member but I have been reading posts on this website for a while trying to learn how to make the best Pizza, I want to thank all you guys for all the help you have given me. I grew up in New Haven, CT eating Pepe's, Modern & Ernies Pizza and I have to say New Haven makes the best Pizza.
I just received my Caputo 00 flour and the 6 in 1 tomatoes and I have been searching for a good simple Neopolitan receipe that does not require starters or whey, just a simple receipe and I wanted to ask you guys for your help. Can you recommend the best neopolitan receipe, I will be using a regular oven at 500 degrees and a stone.
Thank you for your help in advance and I apologize for taking so long to make post.
Re: Neopolitan dough?
Reply #1 on:
August 30, 2005, 05:38:28 PM »
Welcome to the pizza forum pizza freak
You may find plenty information on this forum starting with the home link to recepies or this thread
or follow the nimerous other thread by searching this site
Lifetime Member
Global Moderator
Posts: 25630
Location: Texas
Always learning
Re: Neopolitan dough?
Reply #2 on:
August 30, 2005, 07:52:00 PM »
I gather from your comments about starters and whey that you have already read some of the Neapolitan pizza threads on this forum.
I would like to suggest that you go to the A16 thread, at
, and take a look at the recipes posted at Replies # 73 (p.4), 87 (p.5) and 133 (p.7). For dough processing, I would follow the steps recited in Reply # 133 (p.7). The recipes are as simple and as basic as they can get.
Good luck, and please report back on your results.
Last Edit: September 15, 2005, 09:43:09 AM by Pete-zza
scott r
Supporting Member
Posts: 3170
Age: 45
Location: boston
I Love Pizzafreaks!
Re: Neopolitan dough?
Reply #3 on:
August 30, 2005, 08:45:32 PM »
Pizza Freak, I have had great success following pizzanapoletana's (Marco's) guidelines for making Neapolitan pizza. He has been fortunate enough be able to pick the brains of the best pizziolo's in Naples. His wisdom and insight is invaluable when it comes to making an authentic Neapolitan pie. If you click on his name on one of his posts there is a way to go back and read everything he has written on the forum. I know it might not seem like an easy or simple recipe at first, but it really is. If you are going to learn to make Neapolitan pizza you might as well learn to do it the way the best places in Naples do.
At one point I did some experiments with using IDY instead of a starter with his "recipe" and the outcome was really great. Yes, I do prefer the dough made with a starter culture, but even the IDY version is really some of the best crust I have ever tasted. Everything you need to know is in his posts. After a recent visit to Naples, I was shocked to find that what I learned form him, Pete-zza, and the rest of the generous folks here at the forum was enough to let my dough stand solid ground with the pizza there. Thanks to this fourm all of this was accomplished by the time I made it to the bottom of my first bag of Caputo.
A few words of caution.
Try pulling your pies out before you think they are done. Most of the pizza in Naples looks quite pale when compared to what you grew up with in New Haven. Even though my home oven is putting out 800 I can't even get close to the color they have in the better places in Naples. Pulling them early will help the pies to be more tender. For a long time I thought I was messing up my mixing, or fermentation regimen, but I was just leaving my pies in the oven too long trying to match the look I saw in pictures from pizzerias with Neapolitan wood burning ovens.
If you are going to use the recommended long slow rise make sure the temperature of your proofing room is no more than 70 degrees. I have a small room with a window mounted air conditioner that lets me regulate temperature easily, but if I just use standard room temp I have to use the dough much earlier even if I up the salt level (to slow down fermentation), or use less yeast. If the dough has doubled in the second stage of fermentation it is definitely time to use it, and it may even be too late.
I know you say you are going to use a 500 degree oven, but if you have grown up with New Haven pizza you are going to be disappointed no mater how great your dough is. Crank that oven up as far as it will go (probably 550). Do a search on the forum and find out all the tricks you can play with a standard oven. Some ovens have a calibration to get another 30 degrees, some ovens will stay on full blast with the broiler setting. If you have a self cleaning oven, get in there and trick it out. If you don't get up to at least 650 you are going to need to add oil to your dough. Also try mixing some high gluten flour with the Caputo, maybe 30%. This is the only way I have been able to make a crust with the proper texture in a 550 degree oven. Pepe's is not using Caputo, they are using Pillsbury flour with a fairly high gluten content.
Good Luck!!!!!!!!!!!!!!!!!!!!
Last Edit: August 30, 2005, 08:47:48 PM by scott r
Lifetime Member
Global Moderator
Posts: 25630
Location: Texas
Always learning
Re: Neopolitan dough?
Reply #4 on:
August 30, 2005, 09:19:36 PM »
Welcome back and thanks for all the photos and reports you made on your recent trip to Italy.
I don't want you or Marco to think that I didn't think of Marco's recipe as one for Pizza Freak to try. It is true that Marco's recipe can use instant dry yeast (IDY) but Marco had forewarned me early on that his recipe was best suited to large amounts of dough, not just a single dough ball with minuscule amounts of yeast. Also, as you know, Marco uses high hydration for a 00 dough, which can be difficult to manage if you aren't experienced. Marco also indicated that if one were to use a home oven, it would be a good idea to use a lower hydration (otherwise the dough could be cracker-like) and also add some oil to the dough. After considering all these factors, I concluded that something a bit simpler might be a better starting point for Pizza Freak. Hopefully you will have whetted Pizza Freak's appetite enough that he will return at some point to try out Marco's recipe. I agree with you that it is one of the best, and particularly so if you use a preferment.
scott r
Supporting Member
Posts: 3170
Age: 45
Location: boston
I Love Pizzafreaks!
Re: Neopolitan dough?
Reply #5 on:
August 30, 2005, 09:38:11 PM »
I totally agree, Peter, with everything you have said. It probably does make more sense to start elsewhere.
Sorry about that, I was working on my post when you chimed in on this thread for the first time.
Registered User
Posts: 44
Location: Santa Clara, CA
Re: Neopolitan dough?
Reply #6 on:
September 15, 2005, 01:08:17 AM »
Ok, if Marcos recipe is a little tough for a newbie(like me) and you suggest and easier one to start with....... what would it be? I also would like to stay away from starters. I did terrrible when I tried sourdough bread...
Lifetime Member
Global Moderator
Posts: 25630
Location: Texas
Always learning
Re: Neopolitan dough?
Reply #7 on:
September 15, 2005, 09:42:21 AM »
You might want to take a look at Reply # 2 above in this thread. To make matters even simpler for you if you do not have a scale and are using volume measurements, I went back to the posts and added volumes for the flour and water. The way I measure out volumes of flour is to dip a spoon into the bag of flour, fill the selected measuring cups/spoons, and level off the tops with a straight edge such as the flat edge of a knife. I don't shake or tamp the measuring cups.
Good luck.
Registered User
Posts: 44
Location: Santa Clara, CA
Re: Neopolitan dough?
Reply #8 on:
September 15, 2005, 07:57:15 PM »
Thanks for drawing my attention back to reply #2... I had read it...but had seen that their were 4 suggested posts to read on a multipel(8?) page thread..
When someone jumped in suggesting Marco's recipe and others had agreed, I had forgotten to continue on and look at the 3 other suggestions.
I had actually been reading the a16 thread(since it is semi local to me) but had gotten overloaded with all the banter in the early pages.
Pages: [
Go Up
« previous
next »
Pizza Making Forum
Pizza Making
Neapolitan Style
Neopolitan dough?
Simple Machines
Mobile View


text:
Catalog • 2011-2012
Early Childhood Education - Major
For information, contact Dr. Nancy King.
The Early Childhood Education major prepares professional educators to meet the many challenges of the 21st century PreK-4 classroom. Prospective PreK-4 teachers may also pursue a dual certification in Early Childhood Education/Special Education. Acceptance into the College does not constitute acceptance as a declared education major or co-major. All teacher certification candidates must meet the Pennsylvania Department of Education Chapter 354 Requirements as well as the liberal arts requirements of Cedar Crest College.
Mission Statement of the Education Program
The Cedar Crest College Education Department is committed to the preparation of teachers who have a strong foundation of content knowledge, research-based pedagogy, classroom management and assessment and use this knowledge to plan and implement effective instruction that provides meaningful learning experiences for all students in grades PreK-12, including those students with special needs and diverse cultural and linguistic backgrounds. Our graduates will be advocates for children and will strive to ensure all children achieve to high standards and develop as adults who contribute to society in meaningful ways. To this end, the Department establishes and maintains strong partnerships with local school districts and fosters the development of teachers who are reflective practitioners, instructional leaders, and role models for students in the schools and in the community. The work of the Education Department is grounded in the premise that education provides the foundation for women's leadership, civic engagement, and global connectivity.
Admissions Credentials-Teacher Certification
The Pennsylvania Department of Education Chapter 354 regulation requires that all candidates for teacher certification have a cumulative grade point average (GPA) of 3.0 for acceptance into the program. Teacher candidates seeking secondary teacher certification must have a 3.0 GPA in their major course work. In order to be considered for a statement of advanced standing, the teacher candidate must submit official transcripts from all colleges attended previous to Cedar Crest College.
Prospective teachers are required to take six credits of college course work in mathematics; three credits in English composition; and three credits in American or British literature and earn a grade of C or higher in these courses. Prior to declaration of major (full acceptance) into the teacher certification program, all grades in education courses must be a B or higher. Transfer students must consult with representative of the education department to review program requirements.
Education Department Outcomes
- Teacher candidates will plan effective standards-based instruction that reflects research-based pedagogy and incorporates knowledge of best practices while addressing the needs of all learners.
- Teacher candidates will employ a variety of instructional strategies and technologies to promote students' critical thinking and problem solving skills and differentiate instructional delivery to meet the needs of all learners.
- Teacher candidates will evaluate student performance through a variety of formal and informal assessments and utilize assessment data in a manner that drives instructional practice, accommodations, and referrals to ensure the continuous progress of all learners.
- Teacher candidates develop meaningful and differentiated learning experiences for all learners that demonstrate knowledge of academic content, theories of typical and atypical development, and diverse pedagogy.
- Teacher candidates will create motivating and safe learning environments that are accessible to all learners while encouraging positive social interaction, self-management, and active learning.
- Teacher candidates will demonstrate the ability to assess their own development through self-reflection on their performance and develop an action plan for improvement if necessary.
- Teacher candidates will demonstrate a high level of professional conduct and a responsive and collaborative attitude when interacting with peers, professors, students, mentor teachers, and the community.
Courses Required for the Early Childhood Education Major
Grades PreK - 4
WRI-100 Basic Composition (WRI-1) 3 credits
ENG-201 or ENG 220 American or British Literature (HUM) 3 credits
ENG-303 Linguistics and the Development of Human Language (HUM) 3 credits
MAT-202 Mathematics for the Early Childhood Teacher - Grades PreK - 4 (ML) 3 credits
MAT-110 Probability and Statistics (ML) 3 credits
HIS-121 Survey of U.S. History I (HUM) 3 credits OR HIS-122 Survey of U.S. History II (HUM) 3 credits
PSC-211 The World Economy and Globalization (WRII) and (GST) 3 credits
ETL-235 Ethical Life (community service required) 3 credits
PSY-100 General Psychology (SS) 3 credits
PSY-250 Lifespan Development (prerequisite PSY- 100) 3 credits
SOC-100 Introduction to Culture and Society (SS) 3 credits
MUS-101 Experiencing Music: An Introduction (ART) 3 credits
DNC-102 Experiencing Movement (ART) 3 credits
ART-110 Principles of Visual Organization (ART) 3 credits
BIO-111 Concepts in Ecology & Environmental Issues (SCI) 4 credits
Select from one of the following Earth Science courses:
GSC-101 Earth Science I: Physical Geology (SCI) 4 credits
GSC-103 Earth Science III: Astronomy (SCI) 4 credits
GSC-104 Earth Science IV: Historical Geology (SCI) 3 credits
GSC-110Geology of the National Parks (SCI) 3 credits
Total credits for LAC and PDE major requirements: 49 or 50 credits
*Students must complete a total of 44 credits including the above courses with a cumulative GPA of 3.0 including no grade below a C in LAC courses and no grade below a B in Education courses, as well as meet all other requirements as outlined in the handbook. Students may declare their major after the completion of 24 credits. Students who do not pass the PPST tests may be required to take additional courses in order to pass these required tests.
Professional Courses
ECE-101 Introduction to Early Childhood Education 3 credits
ECE-207 Emergent Literacy (Pre-K-Grade 1) (prerequisite EDU-150) 3 credits
ECE-301 Assessment in ECE I (prerequisite ECE 101, EDU 102, EDU150) 3 credits
ECE-302 Assessment in ECE II (prerequisite ECC -301) 3 credits
ECE-305 Issues and Advocacy in Early Childhood Education 3 credits
EDU-102 Educational Psychology 3 credits
EDU-150 Educational Planning 3 credits
EDU-151 Field Experience I (co-req. EDU-150) 1 credit
EDU-207 Technology for Educators (prerequisite EDU-150) 3 credits
EDU-240 Nutrition, Health and Safety 3 credits
EDU-311 Literacy I-Grades 2-4 (prerequisite EDU-150) 3 credits
EDU-313 Field Experience II (co-req. EDU-311) 1 credit
EDU-308 Integrating the Arts Across the Curriculum (prerequisite EDU-150) 3 credits
EDU-317 Curriculum, Assessment, & Learning Experiences for Science for Early Childhood Educators (prerequisite EDU-311) 3 credits
EDU-319 Curriculum, Assessment, & Learning Experiences for Social Studies for Early Childhood Educators (prerequisite EDU-311) 3 credits
EDU-321 Field Experience III (prerequisite– EDU-317 or EDU-319) 1 credit
EDU-332 Curriculum, Assessment, & Learning Experiences for Mathematics for Early Childhood Educators (prerequisite EDU-150 and MAT-202) 3 credits
EDU-340 Differentiated Reading Instruction for the Primary Grades 3 credits (prerequisite EDU-150, ECE 207, and EDU-311)
EDU-359 Teaching the Culturally and Linguistically Diverse Student 3 credits
EDU-372 Student Teaching: Early Childhood Education (prerequisite See Student Teaching Checklist) 9 credits
EDU-374 Professional Seminar 3 credits
SPE-243 The Exceptional Child (prerequisite EDU-150) 3 credits
SPE-245 Field Experience IV (co-requisite SPE-243) 1 credit
SPE 320 Teaching Students with Learning Disabilities 3 credits
SPE-344 Adaptations and Accommodations for the Exceptional Child 3 credits (prerequisite EDU-150 and SPE-243)
Total = 73 credits
Total Credits for Early Childhood Education Major and Teacher Certification = 122 or 123 credits
Please note:
*Students may not be enrolled in any other course(s) during the student teaching semester.
*Students who are not proficient in oral/written communication in the English language as determined by classroom performance and the evaluation of cooperating mentor teachers in Field Experiences will be required to take additional courses to meet basic competencies in English communication.
Certification in Special Education PreK - 8
Courses Required for Level I Certification in Special Education PreK - 8: CBPH/D Add On Certification
Requirements for students who are Early Childhood Education Majors or who are working on or hold Level I or II Elementary or Early Childhood Education Certification. Special Education Certification as an undergraduate requires Dual Certification with Early Childhood Education.
SPE-243 The Exceptional Child (Prerequisite EDU-150) 3 credits SPE-245 Field IV 1 credit
SPE-320 Teaching Students with Learning Disabilities 3 credits
SPE-344 Adaptations, Modifications and Assistive Technology for the Exceptional Child (Prerequisite EDU-150 and SPE-243) 3 credits
Certification Courses:
SPE- 250 Subject Area Content Access for Students with Learning Disabilities (Prerequisite SPE 243) 3 credits
SPE-310 Intensive Reading, Writing, and Mathematics Development and Intervention Approaches (Prerequisites EDU-150 and SPE-243) 3 credits
SPE-315 Teaching Students with Pervasive Developmental Disorders 3 credits
SPE-333 Screening, Assessment, and IEP Development for Teachers 3 credits
SPE-346 Collaborative Partnerships in Inclusive Settings 3 credits
SPE-347 Classroom Management for Teaching Students with Behavioral Disabilities 3 credits
SPE-348 Teaching Students with Low Incidence Disabilities 3 credits
EDU-359 Teaching the Culturally and Linguistically Diverse Students 3 credits
SPE-375 Practicum in Special Education 3 credits
Students must complete the certification requirements for Early Childhood Education certification (PreK-4) or Middle Level Education (4-8) certification to be eligible for Special Education PreK-8 certification. Students seeking certification in Special Education (CBPH/D ) will be required to take a second specialty test of the Praxis II.


text:
In a trade of some effects, switches and AB boxes I received something I've never seen and can find NO info about - a L.R. Baggs PreEQ.
It's in the original box with the Nipomo address. A CE sticker on the box and no other ID except for a numbered sticker on the circuit board - 59691- and the info to follow.
It's the same brown color as my ParaAcoustic DI (never leave home without it - it's saved my bacon on more than one occasion) but just has a few controls/jacks:
Input/on (1/4")
Output (1/4")
Gain slider
Treble, mid and bass sliders
Also says Pre-Amp Equalizer above the controls
It appears to have had a battery at one time - and leakage that damaged interior paint. There are rubber pads that appear to be battery mounts.
There's a metal belt hook slipped onto one side that looks like it was originally attached to 2 otherwise useless scres on the back (the back also has a thin rubber pad.
Then it gets REAL weird - there are two 1/8" jacks unevenly mounted at the end where the battery apparently was. Both are connected to the board at different places.
Without a manual or schematic I don't want to plug in my One Spot and two adapters, plug it in and cook it. I'm not an expert at tracing solid-state circuits, but CAN read a schematic.
If anyone has a manual and/or schematic for this little gem (well, actually it's about 3/4 the size of my ParaAcoustic DI) I'd really appreciate it. I've searched the web, looked at all the Baggs discontinued items and come up empty - so I can't even test it!
loosened the circuit board screws and found more data - on the 1/4" end "Copyright LR Baggs 1991" and on the "power end each 1/8" jack is connected tip-positive to 4 respective "+" and "-" marked eyelets on the PCB. From there both seem to go to separate diodes and from there I have trouble tracing it. Hope that help with ID, manual or questions!


text:
I've been on a cozy mystery reading kick. I've always loved cozies but in recent years I've tried to broaden my reading list. However, I always come back to cozies.
Cozies are just what the name implies. There's a murder off-stage and a group of people, usually friends living in a small town with simple lives that continue on after one of them solves the mystery. Think Agatha Christie and Jessica Fletcher.
Right now I am reading "Writers of the Purple Sage" by Barbara Burnett Smith. I found this on a sale rack quite a while back and of course it caught my attention because it is about a writer's group in the town of Purple Sage, Texas. Besides enjoying the book itself I'm learning some interesting tricks about writing from the characters. I have always wanted to write a cozy. One of those dreams I just never follow up on.
While reading last night this particular sentence stirred some strong memories. The main character, Jolie Wyatt has just arrived at the baseball field to watch her son play.
"I got out of the car and walked across the hard-packed dirt toward the small cinder-block building that served as the concession stand."
Suddenly I was back in the park in Great Bend, Kansas. Just behind the pool and probably near the fields, although I can't remember that detail, was the concession stand. The concession stand was small and usually manned by a high school girl bored out of her mind. She barely had to get off her stool to reach everything on the shelves. I don't remember if the stand was open during big events in the park but I sure do remember stopping paying it a visit.
After swimming in the public pool my friends and I stopped there for a snack to munch on as we walked home. My favorite was a frozen Zero candy bar. I still get them occasionally although but my adult self and my older teeth don't enjoy them as much as I did then.
Did the description of the concession stand jog any memories for you?
Tuesday, June 14, 2011
Tuesdays With Rita: Concession Stands
3 comments:
Just stopped by to say fingers crossed for you tomorrow. Lori W at Art Camp for WomenReplyDelete
In grade school, we could either eat lunch in the cafeteria or buy something at "the stand." I don't remember what was sold for lunch, but I think we could also get snow cones, which were paper cones filled with crushed ice with some kind of flavoring poured over it. They were great on a hot day.ReplyDelete
LOVE your blog! Found you through C.B. Wentworth's Blog and I've added you to my blogroll so I can follow what you write. Thanks!ReplyDelete
Subscribe to: Post Comments (Atom)