text:
|Publication number
|Publication type
|Application number
|Publication date
|Jul 12, 2011
|Filing date
|Mar 27, 2003
|Priority date
|Mar 27, 2002
|Fee status
|Also published as
|Publication number
|Alfred J. Eisenberg, John A. Thompson, David O. Bundy
|Original Assignee
|Radvision Ltd.
|Export Citation
|BiBTeX, EndNote, RefMan
|Patent Citations (32), Non-Patent Citations (12), Referenced by (20), Classifications (41), Legal Events (8)
|External Links: USPTO, USPTO Assignment, Espacenet
This application is a non-provisional application claiming the benefits of provisional application No. 60/367,826, filed Mar. 27, 2002, titled "System and Method for Traversing Firewalls, NATs, and Proxies with Rich Media Communications and Other Application Protocols".
This invention relates generally to traversing communication network firewalls, NATs and proxies, and more particularly, relates to a novel tunneling approach using endpoint plug-ins that permit UDP-based or other connectionless-based protocol information from a public or private network to traverse firewalls, proxies and NATs emulated in real-time by encapsulating UDP-based information on a connection layer to appear as TCP-based or full duplex connection-based communication.
The Internet allows geographically and logically dispersed applications and nodes to easily communicate and exchange data. These data can range from simple text messages to encrypted or compressed high bandwidth real-time voice and video data. But with the ease of networking, also introduced are potential security threats to any computer publicly accessible on the Internet.
Traditionally, network security has been achieved simply by denying or restricting those outside a secure network access to data or devices within the secure network. Over time, common solutions have evolved, such as firewalls, NATs, and proxies. These approaches block or restrict unauthorized incoming data and unauthorized incoming requests from devices on a private network.
Firewalls isolate devices of a private network from public network devices. Firewalls are installed as security to protect data inside a private network from unsolicited connections. Firewalls can also restrict the way nodes inside a private network can access public sites, such as those on the Internet.
One technique for establishing a firewall is to maintain an "access control list." An access control list approach compares address information contained in a data packet from a remote device to determine whether the source from which the packet originated is on a list of allowed or disallowed addresses. If the address is on the list of disallowed addresses, the packet is not allowed to pass.
Another method of restricting access involves "packet filtering". Packet filtering examines data traversing a firewall to determine if the port or protocol (e.g. Internet Protocol (IP)) is subject to restrictions. If the port or protocol in use is restricted, the packet is not allowed to pass.
Another approach for providing network security uses a NAT (Network Address Translation) technique. NAT involves the translation of IP addresses used within one network to a different IP addresses known within another network.
Typical NAT techniques map local or private network addresses to one or more public IP addresses, and translate incoming global IP addresses into local IP addresses. NAT techniques provide added security since each outgoing or incoming request must go through a translation process to qualify or authenticate the request or match it to a previous request. To preserve the number of IP addresses needed, it is common for a private network use a single IP address in its communication outside the private network. Thus, external devices may not be able to identify or communicate with a specific local device because private addresses behind NATs are not directly accessible by entities on a public network.
Another approach for providing network security is based on proxies. Proxies, such as HTTP proxies, act as the only path out from a private network to the public domain. Proxies are generally done through one or two ports and may require authentication and/or encryption to achieve secure connections. The proxy acts as an intermediary between the secure private network and the public.
For example, referring to
A common theme for firewalls, NATs and proxies is that most bi-directional communication must be initiated from inside the private network towards a public IP address, potentially on restricted ports or with restricted protocols. Once connections or virtual circuits are created from the inside out, data may flow back on that same path from the public network to the private network.
However, for end-to-end rich media applications, such as videoconferencing, methods for initiating and maintaining a session through a gateway or firewall can be complex, requiring several channels to the same or different destinations just to establish a two-way or multi-way real-time conference. Standard protocols such as H.323, SIP and proprietary protocols such as First Virtual Communications' CUseeMe protocol are examples of protocols supporting these types of applications. For example, the International Telecommunications Union H.323 standard defines how real-time, bi-directional multimedia communications can be exchanged on packet-based networks. The H.323 protocol utilizes a User Datagram Protocol (UDP) for the transport of voice and video data. As opposed to a "reliable" type of transmission, or so-called "connected" stream-oriented protocol, such as Transmission Control Protocol/Internet Protocol (TCP/IP), the UDP is a connectionless packet-oriented transfer protocol. Some standards, such as H.323, use connection-based TCP/IP for call or connection setup, but do not use TCP/IP for audio and video data transmission. In contrast, TCP is used for reliable transfer of data and has built in packet loss detection and retransmission and thus is not appropriate for real-time audio and video data.
When a public network transmission utilizes a connectionless type of protocol, like UDP as a transport for the voice and video data packets, the incoming and outgoing packets are often blocked by the firewall security. As a result, connectionless type communications with third parties outside a private network are commonly disabled or blocked. For example, firewalls usually prevent incoming TCP and UDP connections. With firewalls, UDP may be blocked in both directions, while TCP may be blocked except for specific ports.
Internet communications standards and proprietary rich media applications usually require multiple communications channels via UDP and TCP on fixed or random ports. Particularly for real-time rich media communication like voice and video communication, there is a need for a system that allows the establishment of communication channels between computers protected by a firewall and outside third parties, but without compromising the firewall security measures set up to protect against unauthorized or non-permitted data transfers.
Therefore one objective of the present invention is to provide a method and computerized system for transmitting and receiving real-time voice, video and other data over the Internet when either an intended sender or recipient of data utilizes a computer device that is protected by a firewall that does not allow transmissions of data, including data using connectionless packet protocol.
A method and computerized system are provided for transmitting and receiving voice, video, and other data over the Internet and allowing the exchange of TCP/IP and/or UDP type data packets through tunnel connections created between devices on opposite sides of a firewall. The tunnels are created using TCP/IP to a single destination port to encapsulate multiple channels of TCP and UDP data destined to various other ports, across a firewall, NAT or HTTP Proxy, as well as emulate real-time performance for UDP data channels.
The present invention provides plug-in solutions for applications over a client, server, desktop system or other endpoints. In an embodiment of the present invention a plug-in is installed on a device to establish and maintain a TCP/IP tunnel between any two devices having a matched, or paired, plug-in; the tunnels are created over transport layers to support the exchange of TCP and UDP data, solicited or unsolicited, by encapsulating the UDP or TCP data and an additional header as the payload to the TCP stream. The present invention discloses a system and approach for tunneling any application port to a destination IP address once the tunnel is created. Virtually any packet blockage by a firewall, NAT or proxy can be avoided by the tunneling techniques disclosed herein.
In addition, the present invention discloses an approach that is OS and protocol independent but that also allows users to plug-in protocol specific logic for applications that do not perform or behave well through NATs.
The present invention provides plug-ins for download and install on client endpoints and external servers where separate gateways or proxy servers are not needed to connect devices behind a firewall with external devices on a public network.
Additionally, while user registrations can be supported, such registrations through a gateway or proxy server are not required. The plug-ins of the present invention can be automatically downloaded and installed concurrently upon a request to access an application. The plug-in operates transparently to the user and works with existing applications.
Moreover, this invention provides plug-ins for client endpoints in private networks to provide access to conferencing and multimedia services available over a public network and receive incoming calls and invitations from services outside a private network.
Further, the plug-in can be downloaded and installed on devices within corporate networks. Also, the plug-ins can be downloaded and installed by multiple users to generate multiple tunnels for on-line groups, conference calls, web-based presentations, etc. Users on a system can be differentiated even if multiple users are assigned the same private IP address and/or have IP addresses that are translated by a NAT.
It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention, as claimed.
Reference will now be made in detail to the present embodiments of the invention, examples of which are illustrated in the accompanying drawings.
Reference to any specific operating system architecture (such as Microsoft� Windows™) is for demonstration purposes only as to how the present invention could be implemented. In addition, the terms 'client' and 'server' are for functional description only, since communication based on the tunneling approach disclosed supports bi-directional communication.
Network-based systems such as online conferences, online meetings, web seminars and application-sharing applications may depend on conditions associated with a client and server host system. Some components of a network-based application, including configuration information, may be previously installed on a client. Alternatively, the components and configuration information may be concurrently installed on the client as a network-based application is executing.
When a device behind a firewall attempts to make a connection over the Internet using a connectionless or connection-based packet-oriented protocol several issues may arise. For example, when an outside third party intends to establish data communication with someone behind a firewall using either protocol it is often not known at the time when a connection is desired or requested whether a two-way transfer of voice data using the protocol is allowed by the network security system.
Additionally, a firewall may restrict a device behind a network security device (e.g., firewall, NAT, or proxy) from originating connection to an outside device or network, or may prevent connections generated from an external device to a device behind network security device. Further, it is often difficult to implement an unreliable data channel, like UDP, inside a TCP connection due to the reliable nature of TCP (e.g., a reliable connection typically includes retransmit requests for missing or dropped data).
The present invention addresses these and other concerns through a novel tunneling protocol. Tunneling allows the establishment of bi-directional connections or tunnels, initiated from inside or from outside a private network. Tunneling is a technique used in network communications where a first protocol is "wrapped" or encapsulated within a second protocol. For example, a new header from a second protocol is attached to the first packet. The entire first packet of a first protocol becomes the payload of a second protocol. In this way, traffic of a first protocol can be carried over a network that does not support that first protocol directly.
"Tunneled data" refers to data or packets from one protocol that are encapsulated within another protocol. A "tunnel" herein refers to a communication channel between two networked devices through which tunneled data are communicated.
Tunnels are created at the application level. One aspect of the present invention relies on UDP packets targeted for a predetermined or otherwise determinable destination port being intercepted and encapsulated in a TCP tunnel. The encapsulation happens at the driver level by inspection of IP headers of outgoing data, and repackaging them as payload data inside a TCP packet.
The method and system described involve using two plug-in components to create a bi-directional tunnel between a client application endpoint inside a network separated from a public server by a network security device. This public server may also be behind a firewall, but it must be reachable through a public address, whether it is a statically mapped address behind a NAT or not. Using the tunneling approach of the present invention, voice, video and other data communication may be initiated from within or outside a firewall on a transport layer using a connection-based full duplex protocol to encapsulate connection-based or connectionless data in real-time across a firewall, as well as provide other benefits and features as described below.
For purposes of this disclosure, the following definitions shall apply:
Automatic Firewall Detection (AFD)—The process by which a plug-in at a client determines the best path of communication from it's network environment to the public domain.
Client—In reference to a tunnel, the end of the tunnel that initiates the tunnel creation to the server.
Distributed Proxy (DPX)—A tunneling proxy that may be associated with multiple endpoint. Also called a full proxy.
Personal Proxy (PPX)—A component on a computer which can be configured to be associated with and a tunneling proxy for one single external endpoint for an application protocol.
Server or Service—In reference to a tunnel, the end of the tunnel that receives a tunneled connection.
TCP Stack Plug-in (TSP)—The TSP is a component of the TP installed just below the socket level which on the client side, intercepts TCP and UDP requests from an application, performs AFD and tunnel creation, and sends commands to the TDP to signal which subsequent TCP and UDP requests to tunnel. The TSP may also resolve any NAT issues which require translating application protocol-specific data, such as H.323 protocol. On the server side, the TSP listens for tunnel connections on a tunnel port (e.g. 443, the default tunnel port which is HTTPS), and signals the TDP with information necessary to identify the tunnel (source IP and port).
Tunnel Plug-in (TP)—The TP is a full set of components in accordance with an embodiment of the invention needed for one endpoint to support and allow tunneling with another endpoint.
Tunneling Driver Plug-in (TDP)—The TDP is a component of the TP installed at a driver level (e.g., NDIS Intermediate driver on Windows™) that accepts commands from the TSP and manages the tunneling protocol (for example, managing the protocol includes bi-directional UDP emulation within a TCP tunnel). This component also snoops TCP/IP protocol for information required to reconstruct data stream or datagrams on the receiving side of a tunneled session.
Tunnel Port—The TCP/IP port used to establish a tunnel between a client and server.
Tunneling Proxy (TPX)—A component on a computer that routes tunneled data between an associated endpoint and a target endpoint.
Type I Data—Connection-oriented data, such as TCP data.
Type II Data—Connectionless data, such as UDP data. Generally Type II data will not be retransmitted as is typically done for Type I data.
Referring to
Connections 62, 64 may include routers, switches and other transmission devices for communicating data packets and which support a wide variety of technologies, including dedicated wire connections, dial-up connections, DSL, cable, and satellite links.
Referring to
The tunnel plug-ins (TP) 60′ and 70′ are key differences in the overall architecture of
The TP 60′, 70′ may be coupled to the firewall 20′ or network 40′ over connections 62′, 64′ using a wide variety of technologies, including dedicated wire connections, dial-up connections, DSL, cable, and satellite links. Connections 62′, 64′ may include routers, switches and other transmission devices for communicating data packets. WAN/Internet 40 may comprise other nodes (not shown) which route communication between TP 60′ and 70′.
Each plug-in component 60′ and 70′ consists of two components: a Tunneling Driver Plug-in (TDP) and a TCP/IP Stack Plug-in (TSP). In the case where an endpoint 50′ or 80′ is a server or service endpoint, the TSP comprises a tunneling listener module as part of the plug-in 70′ which handles accepting and maintaining the tunnel connections at the application level, as well as responding to the UDP probes for the detection of a firewall 20′. For example, the server listener can track where communications are coming from and going to and "listen" for communications received over predetermined TCP port(s).
The TDP components of TP 60′, 70′ are implemented at the network interface driver level (e.g. NDIS intermediate driver on Windows™). A driver layer refers to a part of the operating system that interacts with a particular device or software and contains information about the device or software interface. For example, for PCs, a driver can be packaged as a .SYS file. Multiple connections may or may not be multiplexed over a single tunneled connection at a driver layer.
In the present embodiment, the TDP is responsible for tunneling two types of data: TCP (Type I) and UDP (Type II) data streams. On the client side, the TDP accepts commands from the TSP, which intercepts socket calls using specific ports to support tunnels to a destination server endpoint and manage the tunneling protocol.
In an embodiment where client or server receives tunneled data, the TDP inspects TCP/IP protocol headers for information required to reconstruct data stream or datagrams. On the server side, the TSP listens on the currently configured tunnel port for incoming tunnel connections from a client endpoint. The TSP listens for and accepts tunnel connections; the TDP snoops incoming IP headers and reconstructs datastreams or datagrams if it finds a tunneled packet.
As noted, the TDP in accordance with the present invention is responsible for tunneling two types of data: Type I and Type II. Type I data refers to data normally sent by an application using the TCP/IP protocol, which is a reliable connection based protocol.
Type II data is connectionless data such as UDP. For example, Type II data can refer to data normally sent by an application using the UDP/IP protocol, which is an unreliable connectionless protocol. Since Type II data is sent with an unreliable protocol, it is assumed that the application does not want the implied overhead and potential latency introduced with a reliable connection-based protocol like TCP/IP. Low overhead/latency is accomplished by making sure no data is retransmitted, whether or not it makes it to the other end of the tunnel.
Turning to the other component of the TP of the present invention, the TSP component of the plug-in is inserted just below the socket layer of a TCP/IP stack and monitors requests of TCP/IP and UDP ports by applications. The TSP may be implemented in one of several ways. For example, the TSP may be implemented as a socket shim like a Winsock Layered Service Provider. This shim will watch all outgoing ports. If there is a TCP connection and/or UDP datagram sent on a port of interest, the shim will perform an AFD ("Automatic Firewall Detection," described below), create a tunnel if necessary, and send commands to the TDP regarding which TCP and UDP port(s) to specific IPs will be tunneled.
Another approach for implementing the TSP component may be for an application to integrate TSP functionality directly into its logic and call the appropriate tunneling API for AFD, tunnel creation, and signaling to the TDP. In this approach, the application would be responsible for any packet translation necessary.
A plug-in may act both as a client and server on any endpoint, but generally a client TP refers to the initiator of communications that may require a tunnel, and the server TP refers to the receiver of that initial communication. Unless otherwise indicated, any reference to UDP or other connectionless protocol shall equally apply for any other connectionless protocol. Reference to TCP or other connection-based protocol shall equally apply to any full duplex or connection-based protocol. It should be noted that the present approach of encapsulating UDP in TCP is not a restriction on the protocol encapsulation, as a TP in accordance with the present invention can apply to other connection and connectionless protocols.
Regardless of whether data is Type I or Type II, the TP can tunnel through when necessary. When it is determined that a tunnel is necessary to complete the desired connection, a tunnel is created on a tunnel port and only connections and data signaled to the TDP from an application client to a server are wrapped in a tunneling header and sent through the tunnel connection.
Unlike TCP, UDP offers a limited amount of service when messages are exchanged between computers in a network. For example, while UDP can handle packet fragments and reassemble them if they come in the right order, UDP cannot handle missing or out of order packets. For example, UDP does not provide sequencing of the packets for arriving data. As a result, generally any application program that uses UDP must be able to make sure that the entire message has arrived and is in the right order. However, due to contemporaneous nature of applications as real-time voice and video transfer, it is not usually required or desirable to use resources for re-transmission of data if some information is not properly transferred. For example, in one embodiment of the present invention, identifier packets (e.g., dummy packets or packets of a known sequence) are sent in response to retransmission requests and where the receiving side knows to discard or ignore such packets. Further details and algorithms for addressing retransmission considerations are provided below.
In a full tunnel plug-in configuration, the TP is installed on both ends of a connection. For example, TP 60′, 70′ is installed with both TDP and TSP installed and having control over data sent over the connection between endpoints 50′ and 80′. In this mode, the TP emulates a TCP datastream for every packet. When it is determined that a tunnel is necessary to get UDP datagrams from one endpoint to another, a tunnel is created on a tunnel port and all data from the client to a server are wrapped in a Type I data tunneling header and sent through the tunnel. Multiple datastreams may or may not be multiplexed over a single tunneled connection, but there is only one header for both TCP and UDP with a field that indicates the type of data.
Referring now to
System 300 represents communication between a device 305 and destination device 325 on opposite sides of a firewall 320. TDP and TSP are deployed in system 300 and operate to exchange UDP data under the guise of TCP. Source device 305 and destination device 325 comprise network layers which perform different application endpoint functions and which communicate endpoint data through to other layers at the endpoint. For purposes of this disclosure, the source device will be described as layers for a client and the destination device will be described as a server. Other configurations are possible and can easily be implemented over the Internet in a manner understood by one skilled in the art based on the application of the teachings herein to each endpoint within a communication system.
The source device 305 includes a source application layer 307, a source socket layer 309, source TSP 311, source TCP/IP stack 313 and source TDP 315. Destination device 325 includes a destination application layer 327, a destination socket layer 329, listener 331, destination TCP/IP stack 333 and destination TDP 335. Various approaches for implementing and handling these layers of both devices are understood by those skilled in the art.
In the case of a server destination device 325, the TSP of the service-side TP is configured as a listener 331 to "listen" for TCP/IP connections on a determinable tunnel port. Several methods to implement the server side functionality of the TSP (i.e., the listener functionality) are possible. For example, the tunnel port can be set by default as 443, the default connection-based HTTPS port. However, designation of port 443 as default could conflict with a standard web server (like Microsoft IIS) which may be listening on this port.
Alternatively, systems that do not have a web server that supports HTTPS, a server TSP can be implemented as a separate process or system service that listens on a determinable port and accepts tunnel connections thereupon. If there is a web server present, a servlet could accept and maintain a persistant HTTPS connection, signaling the server-side TDP when tunneled data arrives.
In either case, the server-side listener uses an OS transport stack to accept the initial tunnel connection.
If the stack layer 325 were being described for a client, the listener is not required, and the listener 331 would correspond to a TSP 311.
Application layers 307, 327 are not necessarily the endpoint applications themselves but generally are the layers at which certain communication features are performed such as partner identification, user authentication and quality of service level establishment.
The socket layers 309, 329 are used by the application layers 307, 327 to communicate TCP or UDP-based data. The socket layers contain sets of programming requests, or "function calls" such as application programming interfaces (APIs). Common APIs include the Berkeley UNIX C interfaces for sockets.
The TSP layers 311, 331 incorporate and implement TCP protocols, perform firewall detection and establish tunnels. In one embodiment, the tunnel is created by TCP 311 as the TCP 311 looks for an outgoing connection to the destination stack 325. Where a firewall 320 is present, UDP data links are not established between the client and server. Instead, the TSP layer 311 creates and maintains a tunnel 340 through the firewall 320. The TDP layers 315, 335 incorporate and implement the TDP component described above. Tunnel 340 appears as TCP-based communication. Thus, data transmitted through tunnel 340 can traverse the firewall 320 via an open TCP port or TCP port of choice. Once a channel is created between source device 305 and destination device 325 based on the TP, Type I and Type II data can be exchanged. The tunneled data received by the destination device 325 can be unpackaged and sent up the stack as TCP or UDP data.
Tunnel 340 supports UDP and TCP data, as well even where an application endpoint port may be blocked or incoming connections to a client or host are not allowed. In this embodiment, any application port can be tunneled to a destination IP address once the tunnel 340 is created. In other words, virtually any protocol blocked by a firewall can be tunneled by the TP.
Reference is now made to
Source device 505 includes a source application layer 507, a source socket layer 509, source TSP 511, source TCP/IP stack 513 and source TDP 515. Destination device 525 includes a destination application layer 527, a destination socket layer 529, destination TSP 531, destination TCP/IP stack 533 and destination TDP 535. Various approaches for implementing and handling these layers of both devices are understood by those skilled in the art.
As described with respect to system 300, in the case of a server, the TSP of the service-side TP is configured to listen for TCP/IP connections on a determinable tunnel port. The description of the server-side TSP in system 300 will apply to the destination TSP 531 in that if device 525 were a client and not a server, the listener functionality is not needed.
The descriptions for the various of the source and destination devices 305 and 325 equally apply to the corresponding devices for the source and destination devices 505 and 525, respectively. For example, socket layers 509, 529 are used by the application layers 507, 527 to communicate TCP or UDP-based data. The TSP layers 511, 531 incorporate the TSP described above and perform firewall detection on a transport layer.
With reference still to
During transmission, the proxy 550 may send back retransmit requests to the source device. Instead, the source device will send blank packets in place of the retransmission packets that can be easily identified as lost data so that the receiving side can discard it. To the proxy, this looks just like a normal retransmission of data and keeps traffic flowing. Further details are provided below.
A user using embodiments described above will not likely know whether a plug-in is required on the application endpoint of the user. Accordingly, the need of a plug-in should be transparent to the user, and the installation of a plug-in should be automatic or otherwise occur "on the fly" and operate transparently with existing client applications.
When a user is invited to or wants to participate in a session for a particular application but has nothing installed for that application (e.g. a video conferencing application or other desktop or device application for communicating voice, video or other communication to the user), it is preferable that a dynamic and user-transparent plug-in download occur automatically. In one embodiment, the plug-in can be a browser plug-in. The TP will be configured using specific logic for the application and will look for the specific TCP ports of the application in question. Then the desired application is launched. To illustrate, consider a case where a user receives a URL either by email, instant message or link on a web page. When the user activates the URL, if the user does not already have an installed application plug-in, the user's device automatically downloads the tunnel plug-in as a browser plug-in, and the tunnel plug-in is installed and configured for that application. Once the plug-in is installed, tunneling in accordance with the present invention can occur.
Once a plug-in is installed, automatic firewall detection (AFD) can be used to determine a configuration for reaching a server. A firewall detection sequence for firewall, NAT and proxy detection normally occurs when the application client first tries to communicate with a server. The sequence may be as simple as an application endpoint registering with a server or an actual connection with the server for an application session.
When a client attempts a connection or tries to send data, the TSP monitors predetermined destination ports used by an application and triggers an AFD sequence when one of these requests happens. In one AFD sequence, several test procedures may be initiated by sending data to the server over various ports. For example, test procedures could test for system configuration such as whether the system supports incoming UDP data, outgoing UDP data on a port with incoming data received on the same port (i.e., pin-holing), incoming TCP data, or outgoing TCP data.
If communication is established with the other end through one of the test procedures, the client can determine whether or not it is behind a NAT. If the test procedure indicates that the client is behind a NAT, the TP tunnels everything through a tunnel port.
If test procedures indicate that the client cannot access the destination with UDP but can get through on the tunnel port with TCP; the client tunnels through the tunnel port. If the client cannot create a tunnel to a desired destination, the AFD sequence may look at the local proxy settings. In any event, once an appropriate tunnel type is determined, a tunnel supporting Type I and Type II data is created. In a system with an HTTP proxy, a handshake may be simulated by the client/server to "fool" the proxy into thinking this is a true HTTPS (or TCP) connection. As a default, port 443 could be used.
Depending on how the tunnels are to be created, tunnel plug-ins will operate one of the appropriate tunnel modes described with respect to
A detailed technique used to enable real time traffic to be tunneled through a TCP connection and behave as close to a direct IP connection can be accomplished and described using the following tunnel plug-in techniques and steps: intermediate system determination, tunnel connection establishment, traffic encapsulation, manipulation of sequence numbers and windows, and retransmission algorithms and efficient acknowledgement algorithms. The goal achieved using this series of techniques is a TCP/IP connection that does not inhibit the transmission of real time traffic by performing its normal reliable delivery and congestion avoidance algorithms. TCP/IP was designed to efficiently pass information in reliably in sequence with out regard to timing jitter.
Intermediate System Determination. Before a connection can be established that will be used to tunnel traffic, it must be determined if a tunnel is necessary. This determination is accomplished by passing test traffic through to the remote host and determining if the remote host can be reached directly by sending a UDP probe packet. The server side tunneling components will attempt to return this packet to the UDP source port+1. If the client does not receive this packet within a reasonable amount of time (configurable, but typically on the order of a few hundred milliseconds) a TCP (Default is HTTPS port 443) connection is established to the remote system.
Connection establishment. For TCP, a standard connection is typically established by intercepting a traffic request (such as an H.323 registration request) to a well-known (e.g. based on H.323) port. A TCP connection is defined by the port and address of both the originating endpoint (or its proxy) and the terminating endpoint (or its proxy). During this connection negotiation between the client and server tunneling components it is determined if an intermediate system is a firewall or an Internet proxy by passing TCP/IP sequence number information of the packet inside the packet and comparing the sequence number with the one inside the packet received by a server side tunnel listener. In determining the intermediate system, the TDP intercepts some outgoing data in the tunnel connection and places the sequence number of the packet in the application payload section where a placeholder is inserted at the application layer. If sequence numbers match then the connection is not terminated, and the system does not require timely acknowledgements. TCP/IP acknowledgements, described more fully below, insert acknowledgements (or ACKS) in the packets coming back in the reverse direction rather than sending just an ACK in a separate packet. This insertion is better than sending ACKS separately as a system would be forced to send twice as many packets.
Once a TCP tunnel is opened, the client side tunneler will not send any more traffic over the tunnel. Instead, the TCP tunnel will be used as a conduit to send tunneled traffic via the TDP. The TCP/IP stack will not be used again until tunnel connection shutdown.
Traffic encapsulation. Traffic encapsulation is achieved by capturing UDP and TCP/IP packets and wrapping them in a new header inside a TCP/IP frame. The information about the original packet is maintained in a partial header that contains IP address and port information for a UDP packet and the IP address, port and sequence number information for a TCP/IP packet. The new header is derived from an established connection and the resulting packet is then part of that connection. The data is piggybacked inside the connection making it possible for it to traverse firewalls, Internet proxies, etc., just as a HTTP/S connection may do. Note that the connection is a TCP/IP connection, and does not employ techniques that a normal connection would exhibit such as slow start, timer back off, round trip time estimation etc. These techniques are useful in the efficient operation of a connection-oriented protocol, but they are often counterproductive when trying to simulate a directly connected network.
Manipulation of Sequence Numbers. Sequence numbers are assigned as with any TCP/IP connection. When sending traffic, sequence numbers are incremented as traffic passes. No acknowledgments need be received (e.g., from an "ACK" flag in the TCP/IP header) in order for the client to continue sending data as would be done with TCP/IP. No timer back off is performed by the TCP stack since when data is ready, the data is sent immediately with the ACK and PUSH flags (which indicate if data is contained in a packet) set to ensure the data is immediately sent up the stack. The TCP/IP window size is preferably set by the TDP to the maximum value to ensure the remote system continues to send as much data as it needs to. When data is received all previous data is acknowledged even if it has not been received (i.e. the last sequence number is sent). This acknowledgment is to make sure that traffic continues to flow as it would in a direct IP network. If necessary, missing data can be dealt with by the higher-level protocols or the application depending on its type.
Retransmission algorithms and efficient acknowledgement algorithms. The algorithms discussed above are sufficient if the tunneling connection does not get terminated by an intermediate system (e.g., Internet proxy). If the intermediate system does terminate the connection, then two issues arise. The first relates to acknowledgements where since the intermediate system is terminating the connection the intermediate system will perform normal acknowledgment algorithms and will not send any traffic until it has received complete transmissions of data. In order to deal with this situation a sender could hold on to traffic and resend it, but this would be cumbersome for the sender and would not aid in the goal of emulating a directly connected network. In a directly connected network lost traffic does not get retransmitted unless the higher-level protocol resends it. UDP packets for instance, generally do not get retransmitted if they are lost. Therefore, the present approach does not employ a retransmission algorithm. Instead, the present approach utilizes an alternating bit pattern in place of the retransmission that can be easily identified as lost data so that the receiving side can discard it. To the proxy, this looks just like a normal retransmission of data and keeps traffic flowing. In case of selective retransmission requests, only the lost parts are sent.
On the receiving side the highest sequence number received is always sent in an acknowledgment flag (ACK) in order to keep information flowing. Since an Internet proxy that terminates the connection cannot be expected to maintain the boundaries of the encapsulated packets, partial packets will be received. These partial packets are transformed into IP fragments and sent up the receiving side of the stack. These fragments are then reassembled by the IP stack. This fragment technique eliminates the need for the tunneling implementation to have to deal with the buffering and discarding of fragments.
Turning to the acknowledgement process, there are at least two techniques for sending acknowledgments in the present invention. One is to acknowledge every received packet, the other is to piggyback acknowledgments on data flowing in the opposite direction. In the latter case, when one end of a connection is receiving but not sending data, the technique must determine when to send an acknowledgment before the TCP/IP window size is reached. Usually half a window size is used as a queue to send an acknowledgment so the other end will continue sending data. The percentage of the window size is preferably configurable at both ends.
Tunnels are shut down when no data has been sent through them for some period of time. Tunnels can be closed by sending a FIN (a standard TCP/IP way of ending a session) to the remote system. When the tunneling driver receives the FIN it frees all state information associated with the connection.
In either case, when a request is made for a connection or datagram to send to a destination IP and port, the following things will happen:
The TSP starts the automatic firewall detection (AFD) process, described above. If the AFD indicates that the two endpoints can send unsolicited UDP to each other, the TP lets the connection proceed normally.
If the endpoint cannot send unsolicited UPD to the other, the TSP will attempt to connect via TCP/IP to the configured tunnel port, which by default is the HTTPS port 443. If an HTTPS handshake can be performed or simulated then the TSP sends a tunnel connect message, formatted as a valid HTTPS connect for the ability to traverse an HTTP proxy. (For proxy traversal, the TSP must support the same browser based proxy detection, automatic, configuration script, or manual configuration). The tunnel connect messages contains the sequence number information mentioned in an earlier section. This message is used by the server side TDP to determine whether or not there is a proxy type device interposed between the application endpoint and application service endpoint, as well as a GUID (Globally Unique Identifier). The GUID is a string of bytes used to uniquely identify the client tunnel endpoint. A tunnel listener at an application service endpoint looks at the GUID and generates a unique IP address for the client. The GUID may be used later by the server to reuse the same IP address for that client.
If there is a proxy in between the client and server, the client will send a second connect message so it will make it all the way to the listener. Once this handshake is done, the connection stays up, but no more data is exchanged between the TSP or a tunnel listener. The TSP signals to the TDP which ports to tunnel and any data through those ports will get tunneled.
It is typical with some rich media communications protocols, for control and data to be exchanged through separate channels, as well as one or more separate destinations.
In system 600 of
In system 600, a client 625-640 registers with a gatekeeper 615. The registration does not necessarily require authentication but the client user provides some user name (e.g. Alf, Dave, Jay or Mike) and IP address (e.g. 10.0.0.1 and 10.0.0.2). When the tunnel listener or TSP on the gatekeeper's plug-in accepts a tunnel connection from the client, the listener will generate an alternate or "fake" IP address for the client side TP to use for packet translation, as well as to uniquely identify the tunnel for the server side application. In one embodiment, the gatekeeper will not see or keep track of the private IP addresses but will only see the "fake" addresses to associate with user names. If the gatekeeper needs to send data to a tunneled client, sending to the "fake" address will indicate to the TDP to tunnel the data to the appropriate client.
Once registered, a tunnel 655-670 will stay open as long as there is a packet transmission. Occasional activity as part of H.323 RAS messaging will keep a tunnel open.
Additionally, once the name and IP address are registered and tunnel created, an application service side server can initiate calls to a client 625-640 even if the client is behind a firewall at a private address. So long as a client 625-640 occasionally sends some data to the server side IP address, a tunnel 655-670 will stay open.
Once the tunnels to the gatekeeper are established, either an endpoint or the gatekeeper can initiate an H.323 call. Q.931 and H.245 control information is exchanged through the tunnel. These TCP-based tunnels are created as normal TCP connections but may multiplex one or more TCP connections requested by an application. All TCP connections requested by an application (i.e., H.323 control information like Q.931, T.120 channels, etc.) on a client or local machine are tunneled as Type I data connections.
A problem arises when the endpoints and the MCU want to exchange RTP-based (real-time transport protocol) media over channels 655-670, and the gatekeeper 615 and MCU 620 are on separate IP addresses. Both the client (client numbers here) and MCU 620 may start sending media at the same time, so some of the packets sent from the MCU 620 to the client endpoints 625-640 will not go anywhere until an endpoint sends at least one packet to open the tunnel to the MCU 620. Since the IP/ports match in each direction the tunnel plug-in on the MCU can easily find which tunnel to send the data on once it is opened. When a NAT is involved, however, the problem is more complicated.
RAS registrations register an IP with one or more aliases. The IP address that an endpoint will register is the local address, which generally will be a private address. This local address is typically unreachable from the outside a private network, as well as indistinguishable from private addresses from other private networks. When a call to a registered endpoint is placed, the gatekeeper 615 must resolve an alias to an IP address. In many cases, there would be multiple private addresses registered with different aliases with there being no way to distinguish one from the other.
To solve the problem of distinguishing addresses from one another, the TDP and TSP is configured to snoop some H.323 protocol messages and rewrite some of the address information embedded in the protocol.
When the TP server 615 detects a tunnel being opened from a NAT TCP client, the TP may be instructed to snoop the application protocol for that tunnel. This will activate a protocol specific module for the protocol in question. For H.323 from NAT clients, the following occurs.
First, RAS registrations 645, 650, 675, 680 are monitored by the server 615, and for each tunnel from a NAT client several items are monitored and maintained by the TP. For example, the TP stores the source address the tunnel came from and the private IP and alias information in the RAS Registration Request (RRQ). The TP will also re-write the packet and substitute a fake non-routable IP address for the private address from a normally unusable range, such as 128.x.x.x.
When the MCU server 620, gatekeeper 615, or an endpoint 625, 630, 635 or 640 tries to initiate a call, the call will be initiated with the generated address. Once the call gets to the gatekeeper TDP, the TDP will find the appropriate tunnel to match the generated address.
At some point before the RTP media channels are started, the TP server (gatekeeper 615 in this case) will have to send the generated address information back to TP client 625-640. The MCU will receive the generated address information when the client's RTP data causes a tunnel to be opened to the MCU. When the MCU 620 tries to send RTP to the generated address, the MCU TP will match this with the recent incoming tunnel from the TP client and know where to send the media.
The system 600 is particularly useful in establishing various conferencing features. For example, suppose a user wishes to join or be invited in to an existing conference. Multiple tunnels may need to be generated to the gatekeeper 615 and the MCU server 620 (acting as a conferencing server) to support multiple communication tunnels. In one approach, clients 625-640 register with gatekeeper 615 and receives a "fake" IP address assigned to a client's TSP by the gatekeeper TP to use as an IP address.
Service is established to the gatekeeper and conference server by the client 1130 through tunnels created and maintained by TP in accordance with the present invention. The client 1130 can register with gatekeeper 1110 over a tunnel established, for example, in accordance with the data flow diagram in
To join an existing conference, a client could connect directly to the conference through NAT/firewalls as a client could do as described with respect to system 300. The server 620 receives the "fake" IP address from the client. This fake IP address is used by the gatekeeper TP to differentiate duplicate private addresses and associate specific clients with specific tunnels. The gatekeeper 615 and server 620 see the same IP address for any client.
In the case where a client is invited by the system to a conference, an invitation may come from the gatekeeper for which there would already be a tunnel allowing the incoming invitation through the firewall/NAT/proxy. The invitation could contain the destination server 620 to connect to so that the client would be establishing a tunnel similar to system 300. In the case of H.323 or SIP protocol, the client-side TSP must parse H.245 messages or SIP invites from the gatekeeper 615 or SIP proxy to find out the RTP and RTCP addresses the conferencing server 620 is expecting to use.
Another advantage of tunneling in accordance with the present invention is that one can deploy services with clients having different firewall protection. For example, the TP can be installed on different client endpoints even if some clients are behind a NAT/firewall and others are configured with a proxy server. Additionally, on the application server side or a corporate network side, the TP can be easily installed on corporate sites. To highlight both of these advantages, reference is made to
A central office 710 is coupled to a plurality of sites 720, 730 through network 740. A first site 720 contains a desktop client 755 coupled to TP 760. Site 720 is coupled to network 740 over connection 727, which such connection can be similar to connections 62′, 64′ described earlier. Site 730 contains a desktop client 745 coupled to TP 750. Site 730 is coupled to network 740 over connection 737, which such connection can be similar to connections 62′, 64′ described earlier.
Site 720 corresponds to system 500 in that client 755 is separated from a firewall 725 by HTTP proxy 765. Site 730 corresponds to system 300 in that plug-in 750 is coupled to a firewall 735 without an intervening HTTP proxy. The application of the TP of the present invention can be installed on each client endpoint (or, for example, on an external server serving multiple clients at a site, as in the case depicted in
Central office side 710 may include one or more office desktops 770. TP 775 can be installed on desktop 770 to enable a desktop application to transmit and receive voice, video, and other data over the Internet 740 and allowing the exchange of HTTP, TCP/IP and UDP type data packets through tunnel connections created between the desktop and devices on other sides of a firewall 705 or 715.
Proxy 780 and router 785 act as a DMZ network inserted between a company's private network 710 and the outside public network 740. The DMZ allows outside users to get access to a service. Corporate networks commonly utilize a DMZ network to deploy certain services but prevent external devices from accessing internal IP addresses. Since the DMZ is often separated from internal or external users by a proxy, firewall or NAT, TP 775 can be installed on devices in the DMZ.
Additionally, DMZs themselves are commonly separated from network 740 by a firewall 715. Connections 717, 793, 798 and connections to the network 740 from firewall 715 are similar to connections 62′, 64′, described above. Corporate network 710 may be coupled to an external server, such as a MCU or conferencing server 790. MCU 790 is preferably similar in all respects to MCU 620 described above. Similarly, a gateway server 795 may be coupled to the corporate network 710 and similar in all respects to the server 615 described above. MCU 790 and server 795 may have TPs installed to support tunneling through a firewall (e.g., firewall 705) proxy, or a NAT in accordance with the present invention. For example, tunnels may be created and maintained between TPs on servers 790, 795 and the TP 775 for desktop 770 through firewall 705. Additionally, tunnels may be created and maintained between TPs on servers 790, 795 and a TP 760 and/or TP 750 on open HTTP ports on firewall 715.
In any event, the present invention adapts very well to a variety of private and corporate networks.
As previously described, a TP configuration in accordance with the present invention, such as TP 750, 760 and 775 can be downloaded and installed only when needed (e.g., based on a test procedure), and such download and install will be transparent to the client or user.
Additionally, for any configuration a TP install can take place on each endpoint and/or external server of a configuration to support tunneling without the requirement of a separate system gateway/proxy or user registration process.
Further, the novel TP approach taught can support virtually any case of packet blockage by a firewall, proxy or NAT. For example, when either an intended sender or recipient of data utilizes a computer device that is protected by a firewall that does not allow transmissions of data using connectionless packet protocol and connection-based protocol, a tunnel can be created and maintained in accordance with the present invention by wrapping the connectionless and connection-based protocol in a connection-based protocol that is permitted to pass the firewall. The plug-in components interact and operate to emulate real-time or connection based transfer for both connection and connectionless protocol. In this way, UDP-like performance (i.e., unreliable datastream) can be supported over a TCP connection. For example, the driver and transport layer plug-ins can support tunnel path simulating a TCP connection in part by sending acknowledgment and appropriate synchronization packets to fool firewalls and other devices into responding to the packets as if the packets were TCP.
Additionally, for transmissions that do not perform or behave well through NATs, the plug-in can have specific logic for applications to translate packets and solve the NAT problems.
The invention can be implemented through computer program code operating on a programmable computer system or instruction execution system such as a personal computer or workstation, or other microprocessor-based platform.
Elements of the invention may be embodied in hardware and/or software as a computer program code (including firmware, resident software, microcode, etc.) Furthermore, the invention may take the form of a computer program product on a computer-usable or computer-readable storage medium having computer-usable or computer-readable program code embodied in the medium for use by or in connection with an instruction execution system such as those shown in
Finally, although specific embodiments of the invention have been described and illustrated, the invention is not to be limited to the specific forms or arrangements of parts as described and illustrated herein. For instance, it should also be understood that throughout this disclosure, where a software process or method is shown or described, the steps of the method may be performed in any order or simultaneously, unless it is clear from the context that one step depends on another being performed first.
The present invention is directed to certain aspects within the communication exchange between endpoints. Other details not provided regarding other system hardware and software requirements are not required for implementing the present invention as the present invention can operate and is configurable with any OS or applications by one skilled in the art.
Although the invention has been described with reference to the specific embodiments, it will be apparent to one skilled in the art that variations and modifications are contemplated within the spirit and scope of the invention. The drawings and descriptions of the specific embodiments are made by way of example only, rather than to limit the scope of the invention, and it is intended to cover within the spirit and scope of the invention all such changes and modifications.
|Cited Patent
|Filing date
|Publication date
|Dec 21, 1990
|Sep 17, 1996
|Tibco, Inc.
|Apparatus and method for providing decoupling of data exchange details for providing high performance communication between software processes
|Jan 11, 1996
|Aug 25, 1998
|U S West, Inc.
|Network addressing scheme encoding communication channel information
|Jul 17, 1997
|Apr 20, 1999
|Matsushita Electric Industrial Co., Ltd.
|Retransmission control method
|Oct 1, 1997
|Aug 24, 1999
|Sun Microsystems, Inc.
|Network message redirection
|Aug 22, 1997
|Oct 19, 1999
|Intel Corporation
|Method and apparatus for facilitating the management of networked devices
|Mar 14, 1997
|Dec 7, 1999
|Microsoft Corporation
|Method and apparatus for determining a most advantageous protocol for use in a computer network
|Mar 17, 1997
|Jun 13, 2000
|Methods and apparatus for providing improved quality of packet transmission in applications such as internet telephony
|May 29, 1998
|Apr 17, 2001
|Research In Motion Limited
|System and method for pushing information from a host system to a mobile data communication device having a shared electronic address
|Jul 23, 1993
|Sep 11, 2001
|Amiga Development Llc
|Bidirectional data transfer protocol primarily controlled by a peripheral device
|Feb 15, 2000
|Feb 19, 2002
|Hewlett-Packard Company
|Agent/proxy connection control across a firewall
|Dec 16, 1998
|May 14, 2002
|Lucent Technologies Inc.
|Method and apparatus for transparently directing requests for web objects to proxy caches
|Jan 22, 1999
|Aug 20, 2002
|Nortel Networks Limited
|Method and system for redirecting web page requests on a TCP/IP network
|Dec 30, 1999
|May 27, 2003
|Nokia Internet Communications Inc.
|System and method for providing address discovery of services in mobile networks
|Dec 10, 1999
|Aug 5, 2003
|Texas Instruments Incorporated
|Data processing device
|Mar 6, 2000
|Aug 19, 2003
|Canon Kabushiki Kaisha
|Facsimile system
|Jul 7, 1999
|Dec 23, 2003
|Telefonaktiebolaget L M Ericsson (Publ)
|System and method for providing multiple endpoints in a device disposed in a packet-switched network
|Mar 16, 2001
|Aug 16, 2005
|At&T Corp.
|Local network router and method of routing IP data packets
|Sep 15, 2000
|Mar 7, 2006
|Datawire Communications Networks, Inc.
|System and method for secure transactions over a network
|Mar 16, 2001
|Jul 25, 2006
|Telefonaktiebolaget Lm Ericsson (Publ)
|Subscriber terminal, network controller and communication system for performing packet data transfer with reduced delay
|Aug 9, 2000
|Sep 4, 2007
|Microsoft Corporation
|Fast dynamic measurement of bandwidth in a TCP network environment
|Apr 12, 2000
|Nov 20, 2007
|Emc Corporation
|Distributed traffic controller for network data
|Sep 22, 2004
|Apr 7, 2009
|Cisco Technology, Inc.
|Cooperative TCP / BGP window management for stateful switchover
|May 9, 2000
|Oct 13, 2009
|3Com Corporation
|Method and system for network management
|Nov 29, 1999
|Oct 10, 2002
|Silvano Gai
|Method and apparatus for rapidly reconfiguring computer networks using a spanning tree algorithm
|Apr 2, 2001
|Dec 12, 2002
|Alan Buck
|Firewall gateway for voice over internet telephony communications
|Jan 28, 2002
|Dec 19, 2002
|Placeware, Inc.
|Method and apparatus for automatically determining an appropriate transmission method in a network
|Jun 28, 2001
|Jan 9, 2003
|Bavadekar Shailesh S.
|System and method for providing tunnel connections between entities in a messaging system
|Aug 26, 2002
|Feb 27, 2003
|Brother Kogyo Kabushiki Kaisha
|Network system that connects a network terminal to another network terminal having a different protocol
|Nov 13, 2001
|May 15, 2003
|Reefedge, Inc., A Delaware Corporation
|Enabling secure communication in a clustered or distributed architecture
|Jan 3, 2002
|Jul 3, 2003
|Allen Houston
|Relating to auto-tunnelling in a heterogeneous network
|Jun 25, 2001
|Jan 3, 2002
|Grinnell Corporation
|Upright fire protection nozzle
|Oct 11, 2006
|Apr 26, 2007
|Samsung Electronics Co., Ltd.
|Method and apparatus of performing tunnel signaling over ip tunneling path
|CUseeMe Conference Server-Technical Overview, First Virtual Communications, 2000.
|CUseeMe Conference Server—Technical Overview, First Virtual Communications, 2000.
|CUseeMe Web-The Next Revolution of Internet Communications, First Virtual Communications, 2000.
|CUseeMe Web—The Next Revolution of Internet Communications, First Virtual Communications, 2000.
|Deploying H.323 Conferencing on Your IP Network-Seeing, Hearing, and Sharing Across Networks, First Virtual Communications, 2000.
|Deploying H.323 Conferencing on Your IP Network—Seeing, Hearing, and Sharing Across Networks, First Virtual Communications, 2000.
|Firewalls-Implementing IP-based Videoconferencing through a Firewall, First Virtual Communications, 2000.
|Firewalls—Implementing IP-based Videoconferencing through a Firewall, First Virtual Communications, 2000.
|Linking & Cascading Conference Servers-An Overview and Tutorial, First Virtual Communications, 2000.
|Linking & Cascading Conference Servers—An Overview and Tutorial, First Virtual Communications, 2000.
|Linking Topology Considerations-Optimizing Bandwidth and Latency, First Virtual Communications, 2000.
|Linking Topology Considerations—Optimizing Bandwidth and Latency, First Virtual Communications, 2000.
|Citing Patent
|Filing date
|Publication date
|Oct 20, 2011
|Jan 15, 2013
|Apple Inc.
|NAT traversal for media conferencing
|Oct 20, 2011
|May 14, 2013
|Apple Inc.
|NAT traversal for media conferencing
|May 31, 2011
|Oct 15, 2013
|Citrix Systems, Inc.
|Systems and methods for providing a VPN solution
|Oct 20, 2011
|Oct 29, 2013
|Apple Inc.
|NAT traversal for media conferencing
|May 25, 2010
|Jan 21, 2014
|Citrix Systems, Inc.
|Systems and methods for communicating a lossy protocol via a lossless protocol
|Aug 21, 2012
|May 13, 2014
|Citrix Systems, Inc.
|System and method for establishing a virtual private network
|Jun 29, 2005
|May 27, 2014
|Citrix Systems, Inc.
|Method and device for performing integrated caching in a data communication network
|Jan 18, 2013
|Jul 22, 2014
|Citrix Systems, Inc.
|Method and device for performing caching of dynamically generated objects in a data communication network
|Jul 25, 2012
|Sep 30, 2014
|Citrix Systems, Inc.
|System and method for performing flash caching of dynamically generated objects in a data communication network
|Sep 2, 2010
|Oct 7, 2014
|Citrix Systems, Inc.
|Systems and methods for automatic installation and execution of a client-side acceleration program
|Jan 11, 2013
|Nov 25, 2014
|Citrix Systems, Inc.
|Method and systems for routing packets from a gateway to an endpoint
|Jul 22, 2005
|Dec 16, 2014
|Citrix Systems, Inc.
|Systems and methods for facilitating a peer to peer route via a gateway
|Dec 30, 2005
|Feb 10, 2015
|Citrix Systems, Inc.
|Systems and methods for providing client-side accelerated access to remote applications via TCP buffering
|Aug 24, 2012
|Aug 11, 2015
|Qualcomm Innovation Center, Inc.
|System and method for network traffic aggregation and analysis of mobile devices using socket wrappers
|Jul 22, 2005
|Dec 22, 2015
|Citrix Systems, Inc.
|Systems and methods for client-side application-aware prioritization of network communications
|Dec 17, 2014
|Aug 16, 2016
|Samsung Display Co., Ltd.
|Photoresist composition
|Nov 19, 2008
|Oct 28, 2010
|Lee John C
|Data access
|Sep 2, 2010
|Dec 30, 2010
|Prabakar Sundarrajan
|Systems and methods for automatic installation and execution of a client-side acceleration program
|Aug 24, 2012
|Feb 27, 2014
|Qualcomm Innovation Center, Inc.
|System and method for network traffic aggregation and analysis of mobile devices using socket wrappers
|Dec 17, 2014
|Jul 23, 2015
|Samsung Display Co., Ltd.
|Photoresist composition
|U.S. Classification
|709/224, 714/18
|International Classification
|Cooperative Classification
|European Classification
|Feb 23, 2004
Owner name: FIRST VIRTUAL COMMUNICATIONS, INC., CALIFORNIA
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:BUNDY, DAVID O.;EISENBERG, ALFRED J.;THOMPSON, JOHN A.;REEL/FRAME:014995/0031
Effective date: 20030327
|Oct 5, 2004
Owner name: HURON CONSULTING GROPU, CANADA
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:FIRST VIRTUAL COMMUNICATIONS, INC.;REEL/FRAME:015220/0443
Effective date: 20040819
Owner name: MORRISON & FOERSTER LLP, CALIFORNIA
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:FIRST VIRTUAL COMMUNICATIONS, INC.;REEL/FRAME:015220/0443
Effective date: 20040819
|Jan 26, 2005
Owner name: FIRST VIRTUAL COMMUNICATIONS, INC., CALIFORNIA
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:EISENBERG, ALFRED J.;THOMPSON, JOHN A.;BUNDY, DAVID O.;REEL/FRAME:015609/0895
Effective date: 20030327
|May 23, 2005
Owner name: RADVISION LTD., ISRAEL
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:FIRST VIRTUAL COMMUNICATIONS, INC.;REEL/FRAME:016047/0712
Effective date: 20050315
|Dec 17, 2008
Owner name: FIRST VIRTUAL COMMUNICATIONS, INC., CALIFORNIA
Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:MORRISON & FOERSTER LLP;REEL/FRAME:021985/0586
Effective date: 20081215
|Feb 3, 2014
Owner name: AVAYA, INC., CALIFORNIA
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:RADVISION LTD;REEL/FRAME:032153/0189
Effective date: 20131231
|Dec 24, 2014
|Fee payment
Year of fee payment: 4
|Jan 27, 2017
Owner name: CITIBANK, N.A., AS ADMINISTRATIVE AGENT, NEW YORK
Free format text: SECURITY INTEREST;ASSIGNORS:AVAYA INC.;AVAYA INTEGRATED CABINET SOLUTIONS INC.;OCTEL COMMUNICATIONS CORPORATION;AND OTHERS;REEL/FRAME:041576/0001
Effective date: 20170124


text:
I haven't run into any duds in my 22lr history. I can empty a 10 round clip from my Walther P22 in 2 or 3 seconds. That has a little stopping power I would think...however in the interest of full disclosure I do carry a 38 special. If 32 ammo were readily available I would carry a 32 revolver with HP
On the brown bear...I hope I can out run one of the folks with me. If the bear were attacking my tent it is probably already too late unless I am sleeping with my 30 30 at the ready.
If the bear climbs up the tree after you it is a black bear...if the bear shakes the tree until you fall out it is a brown bear!

subset: commoncrawl


text:
- Sold for: Start Free Trial or Sign In to see what it's worth.
- Item Category: Fraternal, Political, Organizations
- Source: eBay
- Sold Date: Nov 09, 2006
- Channel: Auction House
This necklace hold a precious Nativity Stone from the birthplace of Jesus. It comes with a collector's certificate and was introduced on television by Ricardo Montalban. The stone in this keepsake is from the 1963 renovation of the cave of teh Nativity in Bethlehem. This set also comes with a video tape that tells of the story of the Nativity Stone. T is a little wear on the outside of the box from storage.This is what Ricardo Montalban says about his Nativity Stone: " I cherish my Nativity Ston for helping me feel closer to Jesus. My faith in Him has always been a great comfort to me. My devout wish is that when you receive the Nativity Stone for yourself or to give as a gift, it will hlep you draw closer to the only true answer in these undertan times, our Lord Jesus Christ."


text:
They say old memories are sweet, well...only time can tell if by the end of this article you'll really cherish the memory or just wish it goes away. All this happened at Guitar World Blindfold test in 1994, where Yngwie was asked to listen to a selection of unidentified tracks by unnamed Artists, and to comment the skills and music. Yngwie agreed, and the responses were...well, as follows:
"The Mighty Turtle Head"
Time Machine, Relativity (1993)
Malmsteen: "I like the groovy intro. Sounds like a Strat. But the soloing going over the song is very bad. It's bent out of shape and out of tune. It's very basic bullshit pentatonic runs. The choice of notes in the solo is completely overdone. That stuff has been done for 30 years! I'm sick and tired off that bending bullshit. This is the most run-of-the-mill pentatonic playing I ever heard."
GW: "That was Joe Satriani."
Malmsteen: "You're kidding! Was he high? He's playing out of tune, and the most boring runs! What I've heard from Satriani before was really good, but this -- this sounds like something someone would play in a garage. After the backwards solo, Joe does some nice stuff with out of phase pickups, which I liked. But the actual solo... I could never dream that was Joe. Out of tune, and terrible."
Buy Joe Satriani Signature equipment with insane deals here.
"Master Of Puppets"
Live Shit: Binge & Purge, Elektra (1993)
Malmsteen: "That's Metallica -- I love it! This is maybe the second or third time I've heard this song, and the first time I've heard the live version. My old drummer and keyboardist liked Metallica a lot, and they played this song around the time I was recording Odyssey (1988). I liked it then and I like it now.
Of all the bands that play this type of music, Metallica's the best. James (Hetfield) sings better than all the other vocalists, and Lars (Ulrich) is a great drummer. I feel some sort of connection with them. I think the band heard some of my eary demos, which sounded something like this. (Malmsteen demos first surfaced on college radio stations in Northern California, where Metallica is based) I'm not saying I influenced them, but maybe I did. Overall, the band has a great sound. But I think the lead guitar player (Kirk Hammett) is not very good. He can play fast and is pretty good at it. But his choice of notes and sense of pitch are very bad. I don't think that he plays with musicality, or plays in tune. Rather than lifting the song, his solo seems to be the anticlimax."
Buy James Hetfield Signature Black Fang Picks and his Signature Snakebyte Electric Guitar.
Buy Kirk Hammett Signature Wah Pedal and his Signature Electric Guitar.
"My Name Is Mud"
Pork Soda, Interscope (1993)
Malmsteen: "I know this band -- it's Primus. The intro is cool. However, when I listen closely, i hear one thing I totally detest: I Hate slap bass playing. It's the worst technique ever. But I think Primus is very funny. I get a bit of a Frank Zappa vibe from them. But although I find them very funny, and they do intrigue me, they don't give me a hard-on, in that the band doesn't inspire me to do a similar thing.
On this song the guitarist plays the weirdest combination of notes; it sounds like he's playing it that way just for the sake of doing it differently. I think Zappa intentionally made his music weird, but he did it with intelligence. Primus is not unintelligent, but I think their music is done, not to piss people off, but to make the listener react, "What the Fuck is this?" Someone like Alan Holdsworth plays the wackiest things, but he does it with panache, such taste. This is done just to do it."
"I'm Broken"
Far Beyond Driven, East West (1994)
Malmsteen: "I don't know what this is, but I like the cool guitar riff. I also like the groove over the second chorus but I don't like the buzz-saw guitars. I'd much prefer a distorted guitar that doesn't really sound distorted if you don't play more than two notes. As far as the singing goes, I couldn't find enough words to describe my disgust. Because it's really not singing. It sounds like somebody is either shoving something up the vocalist's ass, or something is coming out of his ass and his mouth at the same time. It's a stupid excuse for someone who stands in front of a mic stand."
GW: "What did you think of the guitar solo?"
Malmsteen: "A sad reason for being a guitarist in the nineties. It started off sounding like Chuck Berry. Then there was some terrible, terrible bending going on. Very untasteful. That was one of the worst solos I've heard. But the riffage at the beginning and end of the song is very good."
Buy Dimebag's Signature Distortion Pedal and Signature Guitar
"Under A Glass Moon"
Images And Words, Atco (1992)
Malmsteen: "I have this on CD -- it's brilliant. Dream Theater is, by far, one of the best bands to come out recently. Musically, I think they're really clever, and the guitarist and keyboardist are very good. A great band with the right attitude. They're musical, technical, interesting, -- and tasteful. One of my absolute favorite bands at the moment. I have just one reservation about them: their drummer. His choice of beats is terrible! He's obviously listened to too much Neil Peart (Rush) over the years and needs to take a Valium.
As for the song, a great intro. I actually like even the drumming there. Another thing I like about this band, and this song, is that the group likes to use a lot of keyboards -- everything from synthesizers to Hammond organs. Almost like Jan Hammer, which I think is great.
The guitar solo is very interesting; it's like a who's who of guitar playing. It starts off reminiscent of Steve Vai's humbucky, distorted tone. Then the guitarist plays something similar to a harmonic minor run that I would do. Then he goes into a Stevie Ray Vaughn/Hendrix thing, which is splendid. I also hear some Brad Gillis and Michael Schenker. I'm not too crazy about his tone, however. Sounds like he's using a Floyd Rose tremolo, humbucking pickups, and the string action is below the frets. I prefer lower-output pickups, no Floyd Rose, and very high strings. Therefore I get a more acoustic-type sound. But I really cant say anything bad about the guitarist in Dream Theater, because he's good and very ambitious. I think in a couple more years he'll have his own identity."
Buy John Petrucci's Signature Dreamscape Pedal.
Buy Mike Portnoy's Signature Pro-Mark Drumsticks.
Vs., Atlantic (1993)
Malmsteen: "I am going to dig my own grave right now. I think the singer in Pearl Jam should go eat some Pearl Jam! He cannot sing to save his life! And the guitar player needs to seek help. The guitar solo is terrible -- it's just wank-off, wah-wah pedal bullshit! That's the most disgusting thing, so tasteless, so common, so blatant -- the worst! There are a couple of people like Clapton, Hendrix, Angus Young, Ritchie Blackmore, even Jimmy Page, they played pentatonic -- the regular stuff -- but did it with taste. But the guitarist in Pearl Jam, and the lead player in Metallica, they've got no taste what-so-ever. I don't want to comment on that song anymore."
"Even The Losers"
Greatest Hits, MCA (1993)
Malmsteen: "That's Tom Petty. Great songwriter. Not a technical singer, but good at what he does. Obviously it's something that's not up my alley, but I do like it. I also like Dire Straits -- opposites attract. The lead guitar playing on this song is non-existent. I think the guitarist bought a Chuck Berry record that had a scratch on it. He repeats the same thing, even though he changes the key. Had I played on this type of song, I would have played more melodically and chosen different notes, instead of that overdone "Johhny B. Goode" lick."
Polydor (1973)
Malmsteen: "I like it. Very inventive twin-lead guitar in the beginning. It's very musical, and on pitch. What they're doing, they're doing right. Although it doesn't sound technical or wild, the guitarists are playing perfectly in tune. A lot of people don't realize that guitar playing is very much like singing or playing any of the glissando-type instruments -- you have to do it in tune."
GW: "That was the Allman Brothers."
Malmsteen: "I thought I'd heard it before! Back in the Seventies, I saw Dickey Betts playing a live show on TV, via satellite from the Rock Palace in Hamburg, and remember being impressed by the fact that he was playing clean and very much on pitch."
"The Philosopher"
Individual Thought Patterns, Relativity (1993)
Malmsteen: "The singer sounds like he's sitting on a toilet seat, pushing a big one. I can't stand it! It sounds like the band can't decide which song to play. This beat changing bullshit -- I don't like it. The guitarist isn't awful; he actually has decent vibrato. But I can't get off on it."
GW: "But isn't this similar to what Metallica plays, which you do like?"
Malmsteen: "It is, but it isn't as good. But I like that the bassist is playing fretless. However, the fact that he is playing out of tune isn't so tasty. Also the production is awful; it sounds like it was recorded on a Fostex 4-track."
"Cause We've Ended As Lovers"
Blow By Blow, Epic (1975)
Malmsteen: "Great intro and arrangement. Great choice of notes, and the intention is good. However, he performance and accuracy of the guitar player, whoever he is, is not on pitch and is very much below standard."
GW: "That was Jeff Beck."
Malmsteen: "Oh my God! That's unfuckin' believable! I've never heard this before -- that's Jeff Beck? He's playing out of tune. He's bending the strings out of pitch. It's not the correct pitch! Every time he bends a string, he bends it sharp or flat. I can't believe that people... whoever produced and engineered this, or Beck himself, or the listeners, are tonedeaf. I can't believe it!"
"Start Choppin"
Where You Been, Sire (1993)
Malmsteen: "My first impression is that the song wasn't that bad -- it's got a decent groove. But the vocalist -- I don't know what he is doing! It hurts to listen to that. Please don't torture me any longer."
GW: "What do you think of the guitar work?"
Malmsteen: "It's horrible. The guitar playing on the Jeff Beck song was brilliant compared to this."
"Touching Tounges"
Sex & Religion, Relativity (1993)
Malmsteen: "The guitar playing is really nice. Sounds like a humbucking pickup. I've never heard this before, but I know it's Steve Vai. Steve's got his own sound and style -- I spotted it right away -- and that's what I admire about him. This is some of the best stuff that I've ever heard from him. I like what he's doing in the middle of the song -- sounds like he's using an octave divider. Very interesting. Musically and arrangement-wise, it's excellent. I have an objection to Steve's actual guitar sound, and I've told him so myself, but that doesn't really matter at this moment. I don't think that anyone who clones anybody, or plays something technically perfect, is worth s much as somebody with their own identity. Steve's definitely got it. There's no way I'm going to knock that, even though much of what he does may not be my cup of tea. But this track I really liked. Steve, good on you, man."
Buy Steve Vai's Signature Guitar.
"Still Got The Blues (For You)"
Blues Alive, Virgin (1993)
Malmsteen: "Now here's a guy who doesn't play out of tune. Gary Moore doesn't have much technique, but he's brilliant when playing slow bits, and he's got style. When he does play fast he's sloppy. But when he plays a melody, he's one of the very best. No question.
On this song he plays some beautiful melodic-minor runs. I must admit that he played even better on some of his other stuff, like "Parisienne Walkways." This is pretty much the same vibe, but it sounds like he's playing a Les Paul on this one."
"Purple Haze"
Stone Free: A Tribute To Jimi Hendrix Reprise (1993)
Malmsteen: "Total Blasphemy! You don't make "Purple Haze" into a fuckin' rap song! You just don't! The mere thought of it makes me want to puke! It's like converting a Rolls Royce into a Volkswagon. Whoever these guys are they should be shot! And the fact that (producer) Eddie Kramer, who I've known for years, didn't ask me to do something on this Hendrix tribute is also blasphemy! I would've loved to play on it."
Do you agree with what Malmsteen had to say or do you think he's high on pot? Let us know in the comment section below :)
Comments will be approved before showing up.


text:
Sound in the Aboriginal Australian Films of Rolf de Heer
Starrs, D. Bruno (2011) Sound in the Aboriginal Australian Films of Rolf de Heer. In Devy, G. N., Davis, G. V., & Chakravarty, K. K. (Eds.) Voice and Memory : Indigenous Imagination and Expression. Orient Blackswan, Hyderabad, India, pp. 310-318.
Anna Hickey-Mody and Melissa Iocca invented a new name for the cinema-goer at "Bad Boy Bubby" (1993) when they wrote: "In de Heer's film, the viewer is primarily a listener, or aurator, and secondly a spectator" and I have argued the label 'aurator' can also be used for the person experiencing "Ten Canoes" (2006). This Aboriginal Australian Dreamtime fable features dialogue recorded entirely in the Ganalbingu language of the Indigenous people it stars, and is a prime example of what I would suggest can be labeled 'The Aboriginal Australian Films of Rolf de Heer'. "The Tracker" (2002) and "Dr. Plonk" (2007) have also included depictions of Aboriginal Australians and each of the trio utilizes Cat Hope's "innovative sound ideas" to present what I argue is an aural auteur's signature revealing a post-colonial Australian world-view that privileges the justice system and eco-spirituality of Aboriginal Australians.
Impact and interest:
Citation counts are sourced monthly from Scopus and Web of Science® citation databases.
These databases contain citations from different subsets of available publications and different time periods and thus the citation count from each is usually different. Some works are not in either database and no count is displayed. Scopus includes citations from articles published in 1996 onwards, and Web of Science® generally from 1980 onwards.
Citations counts from the Google Scholar™ indexing service can be viewed at the linked Google Scholar™ search.
Export: EndNote | Dublin Core | BibTeX
Repository Staff Only: item control page


text:
Here's a cool little arrow trick to try with word processing programs. Next time you're using your arrow keys to go from one area of a sentence to another (left and right arrows), hold down your CTRL key.
Instead of moving one space at a time, you'll go one word at a time.
If you're using the up and down arrows to go from line to line, holding down the CTRL key will make your cursor jump from paragraph to paragraph (well, from carriage return to carriage return anyway).
One last thing, if you hold down the SHIFT key while you do this (i.e. hold down SHIFT + CTRL at the same time), you select text as you arrow along.
I've tested this in MS Word, Wordpad, Notepad and Open Office Writer, but it *should* work no matter what word processing program you use. Now you don't have any reason to take your hands off the keyboard at all!
~ Andrew


text:
Katherine Lake & Campground
4955 Garden Bay Road, Garden Bay, BC V0N 1S1
View in Google Maps
The camping season begins May 20th
This picturesque lake is a popular swimming spot to enjoy for a day, or as part of a family camping trip.
Location: North end of Pender Harbour, turn off Highway 101 onto Garden Bay Road (at the Petro Can gas station). Continue 5.5 kms on Garden Bay Road. Katherine Lake signpost is on your right.
Area: 37.0 hectares (91.4 acres)
Reservations can be made starting May 1st: 604-883-9557
Camping Fees: $18.00 per night per party and $22.00 for an RV site
Brochure with map
Map: Katherine Lake
Klein Lake Recreation Site & Campground
View in Google Maps
Location: Located at the north end of the Sunshine Coast, this lake can be reached by taking North Lake Road, accessed from Egmont Road just south of the Earls Cove ferry terminal. Take North Lake Road for approximatley 3.6 kms and you will find the entrance to Klein Lake Park and Campground.
Amenities: This is a popular camping spot with a seasonal onsite caretaker, 25 tenting sites, smaller RV sites (these do not allow for RV hookups and there are no sanitation flush facilities), public toilets, and a day use picnic area. One campsite and toilet facility is wheelchair accessible.
The camping season runs from April 15th to September 30th.
Reservations cannot be made at Klein Lake. This site runs on a first come first serve basis.
Camping Fees: $12.00 per night per party (cash only) from April 15th through to September 30th .
The beautiful Suncoast Trail, linking Klein Lake to the Halfmoon Bay area can be accessed from Klein Lake.
Brochure with map
Map: Klein Lake Recreation Site


text:
David Michael Slater's tomes capture attention of movie producer and screenwriter
David Michael Slater's controversial 'Sacred Books' series is heading to Hollywood.
A film combining the first two volumes of the six-part fantasy adventure series, 'The Book of Nonsense' and 'The Book of Knowledge,' is being pitched to movie studios by producer Kevin Bannerman and screenwriter Karen Janszen.
The two are in the process of attracting actors to potentially star in the film before knocking on industry executives' doors.
'We'd like to have talent attached to the project before going to the studios to make our pitch,' Bannerman said Wednesday.
Both Bannerman and Slater are hopeful.
'I'm nervous and excited - it seems to be a more real possibility,' Slater said of his books being transformed into a movie for the big screen. 'I'm thrilled with the idea of the movie.
'A movie would mean more people would hear about the books and open up a new world.'
The young adult series is fraught with suspense, hidden clues, bizarre twists and ancient texts, which threaten to tear apart the world of teenage twins Daphna and Dexter. The combination could prove to be just the right mix to attract financial backing for the film project - and ultimately, movie audiences of all ages, especially teens.
As a longtime language arts teacher in Beaverton, Slater understands the secret to capturing the interest of teens is to engage their curiosity and intelligence by hooking them with a blend of unusual references, mysterious clues and a dark, suspenseful plot packed with action.
Because the story is based in the Hillsdale area where Slater and his family live, local readers have the advantage of recognizing the neighborhood streets Daphna and Dexter run up and down as well as several Multnomah Village haunts. Locals will recognize references to Gabriel Park, the U.S. Post Office at the bottom of the hill, Village Coffee and the Multnomah Arts Center - to name a few.
And, if a studio picks up the project, film crews just might invade Portland.
'They could film anywhere, but that would be really neat to have this movie filmed right here,' Slater said.
While the idea of swinging by the set after teaching at Beaverton's Health and Science High School is appealing, he trusts the instincts of both Bannerman, who worked on both 'Lion King' and 'Curious George,' and Janszen, whose screenwriting credits include 'Dolphin Tale,' 'Gracie,' 'A Walk to Remember,' 'The Matchmaker' and 'From the Earth to the Moon.'
'I haven't seen their take on the story, but I'm impressed with their track record,' Slater said. 'I would not presume to know their business.'
Q and A with Producer Kevin Bannerman
Producer Kevin Bannerman recently took time to talk about the 'Sacred Books' movie project. Here's what he told the Beaverton Valley Times:
How did you discover the 'Sacred Books' series?
A team of producers that I was working with on another project asked me to look at 'The Book of Nonsense' as a potential animation project. After reading it, I told them I didn't think it made sense for animation, but I liked the book in general. They were about to go into production on something, so they told me I was free to run with the book if I wanted to. That's when I contacted David.
What was it about 'The Book of Nonsense' and 'The Book of Knowledge' that appealed to you?
I see the books as a 'tweenage DaVinci Code,' wherein the protagonists get caught up in a mystery and big adventure and have to figure out what the truth is. I loved the relationship of Daphna and Dex in the book and that their sibling relationship was complicated by his secret, dyslexia. I also loved the idea of the old folks - the 'seven dwarves' - seeming to be innocent but actually secretly involved in everything going on.
What made you decide to tackle the project of bringing the twins' story to the big screen?
Again, I think the story is marketable in that it exhibits the classic story structure of someone innocent being pulled into a big mystery/adventure. They have to figure out what is true, who are their adversaries and who are their allies, and often discover that things aren't always what they appear to be. I find that a very appealing story to tell.
What has the process been like so far?
It has been terrific, although it has by necessity moved slowly. David has been generous in his belief in me as a producer on the project, and I am excited that the books attracted the interest of a writer as good as Karen Janszen. We have had to make some rather significant adjustments to the narrative to bring the first two books in line with a movie's structure, and we have also had to work around Karen's busy schedule. We are all very excited to be at the point where we are about to expose the project to the studios.
What has it been like to work with David?
David has been great in understanding that we have to make changes from book to screen adaptation. He has exhibited great confidence in Karen's judgment. I think David is a writer possessing a strong imagination, and I hope to reward that by getting the movie onscreen, which of course is always a challenge.
What has the response been by others in the industry to your take on the 'Sacred Books?'
We are on the verge of pitching the story to the studios, so all I can say is that the writers' agencies responded to the idea, and a strong, in-demand writer responded to the books. That is very gratifying, to find that others respond to and share your vision. Now, to convince the studios to put up the money to further develop it and eventually to get it into production.


text:
Your Furniture Connection carries the following products. Select a manufacturer below to view the lines and collections carried by this retailer:
Simmons Bedding Company is the maker of Beautyrest, Beautyrest Black, Natural Care, ComforPedic and Simmons Kids mattresses, among others. Simmons ... See Simmons models »
Have you shopped for a mattress at Your Furniture Connection? Write a Review!
Your Furniture Connection is a furniture retailer that sells mattresses in addition to other types of home furnishings. Headquartered in Chico, TX, Your Furniture Connection carries a variety of mattress models from which to choose, including mattresses from Simmons. Your Furniture Connection has a home furnishings store in Texas.
Have an update or correction to our information about Your Furniture Connection? If so, please take a moment to suggest an edit.
If this is your business, claim your profile to update this information directly. (What's this?)
Do you work for Your Furniture Connection?
Get started on GoodBed by claiming your business profile. Companies in the GoodBed community believe in providing consumers with straightforward information, quality products, and good service. If you share these beliefs, join us by claiming your free profile today.
Once you've claimed your profile, you'll be able to start using GoodBed to attract more customers to your store. Learn more »


text:
Being a fan of both charismatic curriculum vitae and ample shirt potatoes, Guru can not see the problem with a job candidate putting down their contact email address as email@example.com.
However, it seems that 63% of employers have seen inappropriate personal email addresses such as the above and the equally intriguing firstname.lastname@example.com. According to a poll by recruitment website fish4jobs.co.uk, badly presented and written CVs are more of a turn-off to 73% of employers than candidates showing up late, wearing inappropriate clothes or swearing in an interview.
Are you ready for the list of errors, disciples? Here it comes…
- Candidates claiming to have "worked in a busty office"
- People looking for "a job as a manger"
- Jobseekers after a position in "pubic relations"
- Many candidates "have been trained in fist aid" rather than first aid
- They often claim to be "a good leeder"
- All this despite the fact that most of them either "attended collage" or went to "a very good skool"
- Friends describing jobseekers as "gobby"
- Perhaps that's because interests include "going to the pub" and "gossiping"
Guru would make further comment but he's too busy looking for firstname.lastname@example.com on Facebook.


text:
Ann Zwinger
Hello Friends of GCFS,
With heavy hearts, we advise you of the passing of our much-beloved co-founder, mentor and dear, dear friend, Ann Zwinger. Nobody was more fun on a trip, and nobody could match her depth of knowledge about the natural world, nor her ability to eloquently teach in such a kind way that she was the favorite of children and seniors and everybody in-between. Her smile alone could light the path for those lucky enough to share it with her, and her books will continue to light the way for all of us.
- Ann Haymond Zwinger, 1925 - 2014 by Gary Paul Nabhan of Orion Magazine
- Ann Haymond Zwinger Obituary in the Gazette
Glen Canyon National Recreation Area
With a grant from GCFS, Glen Canyon NRA's cooperating association, the Glen Canyon Natural History Association, has started its own field school, the Glen Canyon Field School, http://glencanyonfieldschool.org and has assumed our class operations at the Recreation Area. They will continue our tradition of offering spectacular houseboat and kayak trips and will offer our Sampler classes and hiking classes as well! We hope, with GCNHA's proximity to the area, to see an increasing number of field school activities in the whole park. This is the beginning of something really fine as the lake and surrounding backcountry offer a large number of unique outdoor experiences. Join us in wishing them all the best!
Kids at Grand Canyon
GCGS is proud to announce that it has just made a matching funds challenge grant to Grand Canyon's Kids at Grand Canyon program. We believe that its mission, which is to forge life-long connections between school children and our national parks, perfectly dovetails with our mission, and we are excited to help bring the Grand Canyon to students everywhere! The program offers learning adventures for students and teachers throughout the the world through field trips, lesson plans, in-school outreach programs and distance learning through Internet-based educational programs. If you want to contribute too, go to Kids at Grand Canyon.
California Condor Restoration Project
GCFS has long partnered with the Peregrine Fund's Condor Project in the Vermilion Cliffs area, and now we are pleased to assist its new public education program to help the public stay informed and participate in their historic effort to recover one of the world's largest and most critically endangered species, the California Condor. The Condor Cliffs program incorporates this message in five major video productions, a live bird show at an IMAX theater, and public television and radio. GCFS purchased a special MacBook computer for the Condor Cliffs project to help them broadcast direct from the field to their webpage at Condorcliffs.org, and to their facebook page CondorCliffs. We have also donated equipment for use in the field.
Vermilion Cliffs National Monument
A new nonprofit partner, Friends of the Cliffs, is forming to provide several services to the Monument, and it is our hope that they will soon offer a field school as well. When the Friends group has attained its 501c3 status, GCFS plans to grant funds to help initiate a field school in Vermilion Cliffs.
Grand Canyon-Parashant National Monument
Grand Canyon-Parashant is working on a partnership project as well, but it is not as far along as Vermilion Cliffs. Again, when a nonprofit offering a field school is formed, GCFS will offer support.
What now?
All of us at GCFS want to sincerely thank you for your support over the years. It has truly been our privilege to work with such talented educators and devoted conservationists and with so many enthusiastic individuals who understand that exploration and education are valuable and powerful ways to protect the lands we love. You truly are the heart of GCFS, and we have been fortunate indeed to meet you and to serve you.
While we are leaving Northern Arizona, Grand Circle Field School is neither disbanding nor giving up its mission. We expect to continue exploring and educating about the extraordinary wildlands of the world. But more on that later...
Happy Trails
from your friends at Grand Circle Field School
.....until we meet again!