ARP ARP - IPv6 Attack obfuscation attacks - anatomy of a client attack attacks - anatomy of a client attack Attacks - attacking a client host Attacks - attacking a client host attacks - land attacks - land attacks - Microsoft LNK exploit attacks - Microsoft LNK exploit attacks - reflector ddos attack attacks - reflector ddos attack attacks - reset attack attacks - reset attack attacks - snort dos attacks - snort dos Base Base - Alert listing Base - analysis Base - graphing Base - pros and cons Base - top reports BIND BIND version number bitmasking bitmasking buffer overflow explanation cache poisoning checksums checksums checksums - destination host processing checksums - destination host processing checksums - formula checksums - formula checksums - IP checksums - IP checksums - IPv6 checksums - IPv6 checksums - psuedo-header protection checksums - psuedo-header protection checksums - UDP checksums - UDP critical path failure cross site request forgery cross site request forgery cross site scripting cross site scripting datagram examination - hex datagram examination - hex datagram examination - icmp datagram examination - icmp datagram examination - UDP datagram examination - UDP demultiplexing DNS DNS DNS DNS - BIND DNS - cache poisoning DNS - caching DNS - client resolver DNS - evasion DNS - evasion DNS - fast flux DNS - IPv4 reverse lookups DNS - IPv6 DNS - master/slave name servers DNS - message format DNS - message format DNS - payload analysis

503-1 503-1 503-4 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-4 503-4 503-4 503-4 503-4 503-4 503-1 503-1 503-2 503-2 503-4 503-1 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-4 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-1 503-2 503-2 503-1 503-1 503-1 503-1 503-1 503-2 503-2 503-1 503-1 503-1 503-1 503-2 503-2 503-2

21 233 158 225 225 224 224 232 232 226 226 233 233 260 260 231 231 203 204 206 205 208 207 199 207 69 69 145 210 135 135 143 143 137 137 136 136 145 145 144 144 142 142 156 295 295 295 295 39 39 40 40 42 42 18 305 305 182 199 210 194 186 248 248 208 190 203 198 250 250 273

DNS - payload analysis DNS - payload detection DNS - payload detection DNS - pointer loop DNS - pointer loop DNS - pointers DNS - pointers DNS - query/response name format DNS - query/response name format DNS - reconnaissance DNS - server resolution DNS - single flux DNS - standard DNS format DNS - standard DNS format DNS - Start of authority DNS - structure DNS - truncation DNS - zone transfer detection DNS - zone transfer detection DNS - Zone Transfers DNS response - large DNS truncation bit DNS truncation bit DNSSEC DNSSEC - validating authenticity Domain internet groper Don't fragment flag ECN bytes ECN bytes ECN bytes ECN bytes EHLO buffer overflow EHLO buffer overflow encapsulation FIN scan flowbits focus IDS deployment four - way handshake four - way handshake Frag3 virtual defragmentation engines Fragmentation Fragmentation - attacks Fragmentation - error Fragmentation - error Fragmentation - final fragment Fragmentation - first fragment Fragmentation - format Fragmentation - IDS/IPS Fragmentation - IPv6 Fragmentation - second fragment Fragmentation - theory Fragmentation - third fragment Fragmentation - using icmp echo request Fragmentation -ID Fragmentation- missing fragment Fragmentation- packet filtering device Fragmentation reassembly examples FTP session - passive FTP session -active Generic Routing Encapsulation hping hping HTTP HTTP HTTP - detection challenges HTTP - detection challenges HTTP - message attacks HTTP - message attacks HTTP - reply header attack HTTP - reply header attack HTTP - request attacks

503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-1 503-1 503-1 503-2 503-2 503-1 503-1 503-1 503-2 503-2 503-1 503-1 503-2 503-2 503-1 503-1 503-1 503-1 503-2 503-2 503-2 503-2 503-2 503-2 503-1 503-1 503-4 503-4 503-2 503-2 503-4 503-1 503-1 503-2 503-2 503-1 503-1 503-1 503-1 503-1 503-1 503-1 503-1 503-1 503-1 503-1 503-1 503-4 503-1 503-1 503-1 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2

273 307 307 308 308 255 255 251 251 205 187 209 306 306 206 189 200 309 309 199 144 50 50 201 202 207 67 161 185 161 185 301 301 18 150 102 62 243 243 50 50 71 270 270 64 59 65 80 239 61 53 63 57 55 78 66 51 142 141 245 96 96 284 284 297 297 295 295 294 294 293

HTTP - request attacks HTTP - request sample HTTP - request sample HTTP - request/message HTTP - request/message HTTP - response in compressed format HTTP - response in compressed format HTTP - response sample HTTP - response sample HTTP - Tshark decode of compressed response HTTP - Tshark decode of compressed response ICMP ICMP ICMP - address mask request ICMP - admin prohibited ICMP - attacks ICMP - fingerprinting ICMP - fingerprinting ICMP - Fragmentation needed/ DF set ICMP - Host unreachable ICMP - IPv6 ICMP - malicious ICMP - mapping ICMP - mapping - cerebral ICMP - mapping - clever ICMP - mapping - efficient ICMP - mapping - tireless ICMP - messages not sent ICMP - path MTU attack ICMP - Path MTU dos ICMP - Port unreachable ICMP - reassembly time exceeded ICMP - reconnaissance ICMP - reconnaissance ICMP - reconnaissance ICMP - redirect ICMP - sample error message ICMP - sample message ICMP - stimulus response ICMP - time exceeded in transit ICMP - timestap request/reply ICMP header ICMP header ICMP header - ID/sequence numbers ICMP header - ID/sequence numbers ICMP header - message type/code ICMP header - message type/code ICMP listeners ICMP speakers ICMP vs TCP/UDP IDS evasion IDS evasion IDS evasion - Application layer attacks IDS evasion - Application layer attacks IDS evasion - evasion IDS evasion - evasion IDS evasion - insertion IDS evasion - insertion IDS evasion - IP layer attacks IDS evasion - IP layer attacks IDS evasion - target based fragmentation reassembly IDS evasion - target based fragmentation reassembly IDS evasion - TCP attacks IDS evasion - TCP attacks IDS policy manager IP header - datagram length IP header - datagram length IP header - differentiated services byte IP header - differentiated services byte IP header - Don't fragment (DF) flag IP header - Don't fragment (DF) flag

503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-1 503-1 503-1 503-1 503-1 503-2 503-2 503-1 503-1 503-1 503-1 503-1 503-1 503-1 503-1 503-1 503-1 503-1 503-1 503-1 503-1 503-2 503-2 503-1 503-1 503-1 503-1 503-1 503-1 503-1 503-2 503-2 503-2 503-2 503-2 503-2 503-1 503-1 503-1 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-4 503-2 503-2 503-2 503-2 503-2 503-2

293 287 287 285 285 289 289 288 288 290 290 23 82 139 102 110 216 216 104 100 107 109 92 96 95 94 93 25 120 118 101 106 217 217 111 103 27 26 137 105 99 214 214 218 218 215 215 89 87 86 118 118 123 123 120 120 119 119 121 121 126 126 122 122 209 28 28 161 161 162 162

IP header - fragmentation offset field IP header - fragmentation offset field IP header - fragmentation total length IP header - fragmentation total length IP header - Identification IP header - Identification IP header - IP version IP header - IP version IP header - IPv4 IP header - IPv4 IP header - IPv4 protocol number/IPv6 next header IP header - IPv4 protocol number/IPv6 next header IP header - IPv4 TOS byte IP header - IPv4 TOS byte IP header - IPv6 IP header - IPv6 IP header - length fields IP header - length fields IP header - More fragments (MF) flag IP header - More fragments (MF) flag IP header - mutant IP version IP header - mutant IP version IP header - options IP header - options IP header - scanning IP protocols IP header - scanning IP protocols IPv4 - numbers IPv4 - numbers IPv4 header IPv4 header byte offsets IPv6 IPv6 - 6to4 IPv6 - address types IPv6 - addresses IPv6 - ARP IPv6 - chained exenstion headers IPV6 - DNS IPv6 - extension headers IPv6 - features IPv6 - fingerprinting IPv6 - fingerprinting IPv6 - fragmentation IPv6 - fragmentation header IPv6 - GRE IPv6 over IPv4 IPv6 - header IPv6 - IPv4 tunnels IPv6 - numbers IPv6 - numbers IPv6 - packet example IPv6 - TCP packet with payload example IPv6 - teredo IPv6 - tools IPv6 - unicast address IPv6 BPF filters IPv6 BPF filters IPv6 Fragmentation IPv6 ICMP LaBrea Tarpit LaBrea Tarpit Labrea Tarpit version 2 Labrea Tarpit version 2 Land attack Land attack Loki mapping - using incomplete fragments mapping - using incomplete fragments memcap Microsoft LNK exploit Microsoft LNK exploit Microsoft protocols MSRPC

503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-1 503-1 503-1 503-1 503-1 503-1 503-1 503-1 503-1 503-1 503-1 503-2 503-2 503-1 503-1 503-1 503-1 503-1 503-2 503-2 503-1 503-1 503-1 503-1 503-1 503-2 503-2 503-1 503-1 503-2 503-2 503-2 503-2 503-2 503-2 503-1 503-2 503-2 503-4 503-2 503-2 503-1 503-1

31 31 30 30 168 168 154 154 152 152 156 156 160 160 153 153 26 26 163 163 155 155 28 28 157 157 166 166 12 16 225 244 232 231 233 238 203 237 242 115 115 239 240 245 229 243 167 167 235 236 246 251 230 85 85 69 107 195 195 208 208 232 232 115 164 164 52 226 226 164 173

MSRPC - interfaces/tasks MSRPC over SMB MSRPC over SMB - example MSRPC over TCP - example Netbios vs Active directory netdude netdude Network Discovery Protocol Nkiller2 TCP exhaustion/DOS attack nmap - ECN detection nmap - ECN detection nmap - ECN segment nmap - ECN segment nmap - fingerprinting - os tests nmap - fingerprinting - os tests nmap - fingerprinting - os-db nmap - fingerprinting - os-db nmap - fingerprinting with tcp options nmap - fingerprinting with tcp options nmap - generic TCP segments nmap - generic TCP segments nmap - ICMP - detecting ICMP echo requests nmap - ICMP - detecting ICMP echo requests nmap - ISN detection nmap - ISN detection nmap - ISN segments nmap - ISN segments nmap - packet crafting nmap - packet crafting nmap - protocol scan output nmap - protocol scan output nmap - sample mutant tcp flags nmap - sample mutant tcp flags nmap - sequence number prediciton nmap - sequence number prediciton nmap - UDP packets nmap - UDP packets NOP sled nslookup nslookup - debug output nslookup - output ntpdc monlist command/monlist ddos potential ntpdc monlist command/monlist ddos potential Null scan OpenAanval OpenAanval - pros and cons OpenAanval - report examples OpenAanval - reporting options OpenBSD IPv6 buffer overflow attack packet crafting - how? packet crafting - how? packet crafting - why? packet crafting - why? PAWS perfmon Ping of death fragmentation attack Preprocessors - memcap Preprocessors -snort Protocol decode Protocol decode ptunnel Reflector DDOS attacks Reflector DDOS attacks reset attack reset attack retransmission timer RFC implemtation issues RPC RPC over TCP (DCOM) scapy scapy

503-1 503-1 503-1 503-1 503-1 503-2 503-2 503-1 503-1 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-4 503-1 503-1 503-1 503-2 503-2 503-1 503-4 503-4 503-4 503-4 503-1 503-2 503-2 503-2 503-2 503-1 503-4 503-1 503-4 503-4 503-2 503-2 503-1 503-2 503-2 503-2 503-2 503-1 503-1 503-1 503-1 503-2 503-2

178 176 179 180 166 271 271 21 152 104 104 103 103 100 100 99 99 205 205 105 105 110 110 102 102 101 101 95 95 158 158 187 187 179 179 111 111 152 195 197 196 236 236 160 198 202 201 200 79 92 92 91 91 45 174 72 52 48 280 280 115 233 233 260 260 43 126 174 177 97 97

sendip sendip server and client ports SGUIL SGUIL - client SGUIL - components SGUIL - pro's and cons SGUIL - query builder SGUIL - reporting slowloris - wireshark analysis slowloris - wireshark analysis Slowloris apache dos Slowloris apache dos SMB/CIFS SMB/CIFS - conversation flow SMB/CIFS - NULL session SMB/CIFS - ports SMTP SMTP SMTP - detection challenges SMTP - detection challenges SMTP - ehlo buffer overflow SMTP - ehlo buffer overflow SMTP - relay attacks SMTP - relay attacks SMTP - session example SMTP - session example SMTP - standard example SMTP - standard example Smurf attack Smurf attack - powertech smurf amplifier registry Snorby Snorby - dashboard Snorby - pro's and cons Snorby - SnorbyLivelook snort - alert modes snort - anomalous behavior example snort - anomalous behavior example snort - binary logs snort - build time options snort - first rule snort - first rule snort - history snort - http rule keywords snort - http rule keywords snort - installing on unix snort - intro snort - metrics snort - modes of operation snort - nids configuration snort - nids mode snort - nids mode CLI options snort - packet logger mode snort - pattern matching example snort - pattern matching example snort - rule distribution snort - second rule snort - second rule snort - second rule and snort config changes snort - second rule and snort config changes snort - shared object rules snort - SMTP preprocessor snort - SMTP preprocessor snort - sniffer mode snort 3.0 snort -dvc snort.conf snort GUI - B.A.S.E snort GUI - IDS policy manager snort GUI - OpenAanval snort GUI - sguil snort GUI - snorby

503-2 503-2 503-1 503-4 503-4 503-4 503-4 503-4 503-4 503-2 503-2 503-2 503-2 503-1 503-1 503-1 503-1 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-1 503-1 503-4 503-4 503-4 503-4 503-4 503-2 503-2 503-4 503-4 503-2 503-2 503-4 503-2 503-2 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-2 503-2 503-4 503-2 503-2 503-2 503-2 503-4 503-2 503-2 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4

256 256 36 186 188 187 193 190 192 292 292 291 291 167 171 172 169 298 298 304 304 301 301 302 302 300 300 299 299 113 114 194 195 197 196 35 282 282 28 13 245 245 7 296 296 9 6 8 22 33 31 34 27 281 281 14 246 246 247 247 15 303 303 23 181 166 203 209 198 186 194

snort GUI - SnortSam snort IDS - config file settings - preprocessors snort IDS - config file settings = includes snort IDS - config file settings = output snort IDS - configuration snort IDS - deployment scenarios snort IDS - detection plug-ins snort IDS - false negatives snort IDS - false negatives - attack obfuscation snort IDS - false negatives - missing rules snort IDS - false negatives - packet loss snort IDS - false negatives - packet loss solutions snort IDS - false positives snort IDS - false positives - solutions snort IDS - focus sensor config preprocessors snort IDS - focus sensor config rules snort IDS - focus sensor config variables snort IDS - Frag3 snort IDS - include statements snort IDS - output configuration snort IDS - output plug-ins snort IDS - passive vs inline deployment snort IDS - performance snort IDS - performance - causes of going slow snort IDS - performance - considerations snort IDS - performance - dropped packets snort IDS - performance - how to check snort IDS - performance - optimize snort IDS - performance - ways to make snort fast snort IDS - performance - writing good rules snort IDS - plug-in interfaces snort IDS - plug-ins snort IDS - preprocessor config snort IDS - tagging snort IDS - tagging - arguments snort IDS - tagging - considerations snort IDS - tagging - rules snort IDS - Variables Snort IPv6 DOS Snort IPv6 DOS snort rules snort rules - basic anatomy snort rules - defining custom rules snort rules - destination address snort rules - destination port snort rules - header snort rules - header = action snort rules - header protocol snort rules - payload options - byte_jump snort rules - payload options - byte_test snort rules - payload options - content snort rules - payload options - depth snort rules - payload options - distance snort rules - payload options - fast_pattern snort rules - payload options - http content modifiers snort rules - payload options - http encode modifier snort rules - payload options - http_uri snort rules - payload options - isdataat snort rules - payload options - offset snort rules - payload options - pcre snort rules - payload options - rawbytes snort rules - payload options - within snort rules - payload options -nocase snort rules - post-detection snort rules - post-detection - detection_filter snort rules - post-detection - tagging snort rules - rule option keyword syntax snort rules - rule options snort rules - rule options - general snort rules - rule options - non payload flow snort rules - rule options - non payload flowbits

503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-2 503-2 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4

210 46 44 53 39 62 59 139 158 140 156 157 159 160 64 65 63 50 45 54 55 66 164 166 171 173 172 165 168 170 58 56 47 176 177 180 178 40 229 229 69 71 75 83 84 73 74 77 128 126 105 111 115 120 124 125 122 133 109 132 119 117 113 134 135 134 89 86 94 99 102

snort rules - rule options - non payload ICMP snort rules - rule options - non payload IP snort rules - rule options - non payload TCP header snort rules - rule options categories snort rules - rule options syntax snort rules - rule ordering snort rules - source IP snort rules - source port snort rules - traffic direction SnortSam SnortSam - pros and cons Spoofing - example Start of authority (SOA) Stream5 SYN/FIN scan TCP TCP - IDS/IPS and TCP flags TCP - IDS/IPS and TCP flags TCP - sample segment TCP - stimulus response TCP - TCP connection retransmissions TCP - TCP connection retransmissions TCP - TCP flags and payload allowed TCP - TCP flags and payload allowed TCP - TCP retries TCP - TCP retries TCP - Urgent/flag TCP - Urgent/flag tcp acknowledgement numbers tcp acknowledgement numbers - duplicate tcp delivery failures TCP flags TCP flags - malicious TCP flags - malicious - response TCP header TCP header TCP header - acknowledgement numbers TCP header - acknowledgement numbers TCP header - destination port mutation TCP header - destination port mutation TCP header - dynamic window size TCP header - dynamic window size TCp header - ECN TCP header - ECN TCP header - ECN flags TCP header - ECN flags TCP header - fingerprinting with tcp options TCP header - fingerprinting with tcp options TCP header - length TCP header - length TCP header - length fields TCP header - length fields TCp header - length with options TCp header - length with options TCP header - mutant ack numbers TCP header - mutant ack numbers TCP header - ports TCP header - ports TCP header - sequence number mutation TCP header - sequence number mutation TCP header - sequence numbers TCP header - sequence numbers TCP header - source port mutation TCP header - source port mutation TCP header - TCP flag byte "reserverd bits" TCP header - TCP flag byte "reserverd bits" TCP header - TCP flags TCP header - TCP flags TCP header - TCP options TCP header - TCP options TCP header - TCP timestamp options

503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-4 503-1 503-1 503-4 503-1 503-1 503-2 503-2 503-1 503-1 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-1 503-1 503-1 503-1 503-1 503-1 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2

97 96 98 93 87 76 78 80 82 210 212 154 206 52 149 30 190 190 31 128 193 193 192 192 194 194 188 188 39 42 41 34 157 159 174 174 181 181 177 177 207 207 185 185 186 186 205 205 35 35 34 34 25 25 182 182 175 175 180 180 178 178 176 176 184 184 183 183 199 199 201

TCP header - TCP timestamp options TCP header - TCP window size TCP header - TCP window size tcp sequence numbers tcp stream reassembly issues tcpdump - changing interfaces tcpdump - changing interfaces tcpdump - default output tcpdump - default output tcpdump - detecting protocol scans tcpdump - detecting protocol scans tcpdump - disabling name/port resolution tcpdump - disabling name/port resolution tcpdump - examining the frame header tcpdump - examining the frame header tcpdump - filtering data tcpdump - filtering data tcpdump - filters tcpdump - filters tcpdump - filters - bit masking tcpdump - filters - bit masking tcpdump - filters - filter format tcpdump - filters - filter format tcpdump - filters - specifying fields tcpdump - filters - specifying fields tcpdump - filters - tcpflags tcpdump - filters - tcpflags tcpdump - hex output tcpdump - hex output tcpdump - hex translation tcpdump - hex translation tcpdump - snaplen tcpdump - snaplen tcpdump - strengths tcpdump - strengths tcpdump - truncation tcpdump - truncation tcpdump - versions tcpdump - versions tcpdump - weaknesses tcpdump - weaknesses tcpdump - writing/reading raw output tcpdump - writing/reading raw output tcpdump commands tcpdump output tcpdump output - DF flag set and fragmentation needed tcpdump output - DNS resolution tcpdump output - malicious fragment activity tcpdump output - ping of death attack tcpdump output - port numbers tcpdump output - sequence/acknowledgement numbers tcpdump output - teardrop attack tcpdump output in hex tcpdump output -tcp flags tcpdump -v tcpdump -w tcpdump -x Teardrop attack Teredo Teredo - addressing Teredo - sample packet Teredo - security issue traceroute - unix tracert - windows Truncation Truncation Truncation - DNS bit Truncation - DNS bit UDP UDP - stimulus response UDP - strange traffic

503-2 503-2 503-2 503-1 503-1 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-2 503-1 503-1 503-1 503-1 503-1 503-1 503-1 503-1 503-1 503-1 503-1 503-1 503-1 503-1 503-1 503-1 503-1 503-1 503-1 503-1 503-1 503-2 503-2 503-2 503-2 503-1 503-1 503-2

201 206 206 38 45 55 55 10 10 159 159 54 54 23 23 53 53 62 62 75 75 64 64 63 63 84 84 14 14 57 57 19 19 7 7 49 49 9 9 8 8 52 52 8 9 68 191 77 74 37 40 75 10 35 8 8 8 76 246 247 248 249 143 138 49 49 50 50 47 134 267

UDP - strange traffic UDP datagram UDP header UDP header UDP header - length UDP header - length UDP header - ports UDP header - ports umbrella IDS deployment unified2 format Zone Transfers

503-2 503-1 503-2 503-2 503-2 503-2 503-2 503-2 503-4 503-4 503-1

267 48 210 210 212 212 211 211 62 54 199