<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40">

<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">


<meta name=ProgId content=Word.Document>
<meta name=Generator content="Microsoft Word 10">
<meta name=Originator content="Microsoft Word 10">
<link rel=File-List href="cid:filelist.xml@...2208...">
<!--[if gte mso 9]><xml>
 <o:OfficeDocumentSettings>
  <o:DoNotRelyOnCSS/>
 </o:OfficeDocumentSettings>
</xml><![endif]--><!--[if gte mso 9]><xml>
 <w:WordDocument>
  <w:SpellingState>Clean</w:SpellingState>
  <w:GrammarState>Clean</w:GrammarState>
  <w:DocumentKind>DocumentEmail</w:DocumentKind>
  <w:EnvelopeVis/>
  <w:Compatibility>
   <w:BreakWrappedTables/>
   <w:SnapToGridInCell/>
   <w:WrapTextWithPunct/>
   <w:UseAsianBreakRules/>
  </w:Compatibility>
  <w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel>
 </w:WordDocument>
</xml><![endif]-->
<style>
<!--
 /* Style Definitions */
 p.MsoNormal, li.MsoNormal, div.MsoNormal
        {mso-style-parent:"";
        margin:0in;
        margin-bottom:.0001pt;
        mso-pagination:widow-orphan;
        font-size:12.0pt;
        font-family:"Times New Roman";
        mso-fareast-font-family:"Times New Roman";}
a:link, span.MsoHyperlink
        {color:blue;
        text-decoration:underline;
        text-underline:single;}
a:visited, span.MsoHyperlinkFollowed
        {color:purple;
        text-decoration:underline;
        text-underline:single;}
span.EmailStyle17
        {mso-style-type:personal-compose;
        mso-style-noshow:yes;
        mso-ansi-font-size:10.0pt;
        mso-bidi-font-size:10.0pt;
        font-family:Arial;
        mso-ascii-font-family:Arial;
        mso-hansi-font-family:Arial;
        mso-bidi-font-family:Arial;
        color:windowtext;}
span.SpellE
        {mso-style-name:"";
        mso-spl-e:yes;}
span.GramE
        {mso-style-name:"";
        mso-gram-e:yes;}
@page Section1
        {size:8.5in 11.0in;
        margin:1.0in 1.25in 1.0in 1.25in;
        mso-header-margin:.5in;
        mso-footer-margin:.5in;
        mso-paper-source:0;}
div.Section1
        {page:Section1;}
-->
</style>
<!--[if gte mso 10]>
<style>
 /* Style Definitions */ 
 table.MsoNormalTable
        {mso-style-name:"Table Normal";
        mso-tstyle-rowband-size:0;
        mso-tstyle-colband-size:0;
        mso-style-noshow:yes;
        mso-style-parent:"";
        mso-padding-alt:0in 5.4pt 0in 5.4pt;
        mso-para-margin:0in;
        mso-para-margin-bottom:.0001pt;
        mso-pagination:widow-orphan;
        font-size:10.0pt;
        font-family:"Times New Roman";}
</style>
<![endif]-->
</head>

<body lang=EN-US link=blue vlink=purple style='tab-interval:.5in'>

<div class=Section1>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Developers,<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>While
working on a book for McGraw-Hill, I have been conducting some testing of
snort. <span style='mso-spacerun:yes'> </span>When I looked at 1.8.7, it
handled default fragroute traffic well by the stream4 preprocessor sounding the
alert “</span></font><font size=1 color=black face=Arial><span
style='font-size:9.0pt;font-family:Arial;color:black'>: Multiple <span
class=SpellE>Acked</span> Packets (possible fragroute)”.</span></font><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'><span
style='mso-spacerun:yes'>  </span>I may have found a problem with
2.0.1.<span style='mso-spacerun:yes'>  </span>It seems that there are some
changes in the 2.0.1 that make the decoder fire “</span></font><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>WARNING: TCP Data Offset is less than 5!” which of course
could mean lots of things besides fragroute. <span
style='mso-spacerun:yes'> </span>It is much less descriptive and will
probably be chalked up as a false positive by an analyst…<span
style='mso-spacerun:yes'>  </span>It looks like the decoder is stealing
the stream4 preprocessors thunder here. <span
style='mso-spacerun:yes'>  </span>Details follow:<o:p></o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>Here is the problem:<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>Both snorts 1.8.7 and 2.0.1 have default <span class=SpellE>configs</span>
and rules.<span style='mso-spacerun:yes'>  </span><span class=GramE>Using
default <span class=SpellE>config</span> for fragroute.</span><o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'><o:p> </o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>root@...2207...[<span class=SpellE>knoppix</span>]# ping 10.10.10.33<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>root@...2207...[<span class=SpellE>knoppix</span>]# fragroute
10.10.10.33<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><span
class=GramE><font size=1 color=black face=Arial><span style='font-size:9.0pt;
font-family:Arial;color:black'>fragroute</span></font></span><font size=1
color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>: <span class=SpellE>tcp_seg</span> -> <span class=SpellE>ip_frag</span>
-> <span class=SpellE>ip_chaff</span> -> order -> print (starts fragroute,
then open another window for ftp session)<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'><o:p> </o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><span
class=GramE><font size=1 color=black face=Arial><span style='font-size:9.0pt;
font-family:Arial;color:black'>ftp</span></font></span><font size=1
color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'> 10.10.10.33 (proceed to log-in, move to /etc <span class=SpellE>subdir</span>,
get <span class=SpellE>passwd</span>, then log out)<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'><o:p> </o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>--------------------------<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><span
class=GramE><font size=1 color=black face=Arial><span style='font-size:9.0pt;
font-family:Arial;color:black'>snort</span></font></span><font size=1
color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'> 1.8.7<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'><o:p> </o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'><o:p> </o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>[**] [111:18:1] spp_stream4: Multiple <span class=SpellE>Acked</span>
Packets (possible fragroute)<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>[**] 09/23-14:58:05.445121 10.10.10.102:33039 -> 10.10.10.33:21
TCP<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>TTL<span class=GramE>:64</span> TOS:0x10 ID:26987 IpLen:20
DgmLen:53<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>***AP*** <span class=SpellE>Seq</span>: <span class=GramE>0x1B4A6A08<span
style='mso-spacerun:yes'>  </span><span class=SpellE>Ack</span></span>:
0x6EE8F32C<span style='mso-spacerun:yes'>  </span>Win: 0x16D0<span
style='mso-spacerun:yes'>  </span><span class=SpellE>TcpLen</span>: 32 TCP<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>Options (3) => NOP <span class=SpellE>NOP</span> TS: 33629416
62418991<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'><o:p> </o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>[**] [111:18:1] spp_stream4: Multiple <span class=SpellE>Acked</span>
Packets (possible fragroute)<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>[**] 09/23-14:58:05.445214 10.10.10.102:33039 -> 10.10.10.33:21
TCP<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>TTL<span class=GramE>:64</span> TOS:0x10 ID:63939 IpLen:20
DgmLen:53<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>***AP*** <span class=SpellE>Seq</span>: <span class=GramE>0x1B4A6A0A<span
style='mso-spacerun:yes'>  </span><span class=SpellE>Ack</span></span>:
0x6EE8F32C<span style='mso-spacerun:yes'>  </span>Win: 0x16D0<span
style='mso-spacerun:yes'>  </span><span class=SpellE>TcpLen</span>: 32 TCP<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>Options (3) => NOP <span class=SpellE>NOP</span> TS: 33629416
62418991<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'><o:p> </o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>[**] [111:18:1] spp_stream4: Multiple <span class=SpellE>Acked</span>
Packets (possible fragroute)<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>[**] 09/23-14:58:05.445094 10.10.10.102:33039 -> 10.10.10.33:21
TCP<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>TTL<span class=GramE>:64</span> TOS:0x10 ID:3410 IpLen:20
DgmLen:53<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>***AP*** <span class=SpellE>Seq</span>: <span class=GramE>0x1B4A6A0C<span
style='mso-spacerun:yes'>  </span><span class=SpellE>Ack</span></span>:
0x6EE8F32C<span style='mso-spacerun:yes'>  </span>Win: 0x16D0<span
style='mso-spacerun:yes'>  </span><span class=SpellE>TcpLen</span>: 32 TCP<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>Options (3) => NOP <span class=SpellE>NOP</span> TS: 33629416
62418991<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'><o:p> </o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'><o:p> </o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>This is good...<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'><o:p> </o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'><o:p> </o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>------------------ snort 2.0.1<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'><o:p> </o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>[**] [116:46:1] (<span class=SpellE>snort_decoder</span>) WARNING:
TCP Data Offset is less than 5!<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>[**] 09/23-15:02:13.783931 10.10.10.102:0 -> 10.10.10.33:0 TCP
TTL<span class=GramE>:64</span><o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>TOS<span class=GramE>:0x10</span> ID:37117 IpLen:20 DgmLen:52<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>*2U**R** <span class=SpellE>Seq</span>: <span class=GramE>0x3330556E<span
style='mso-spacerun:yes'>  </span><span class=SpellE>Ack</span></span>:
0x50537257<span style='mso-spacerun:yes'>  </span>Win: 0x374E<span
style='mso-spacerun:yes'>  </span><span class=SpellE>TcpLen</span>: 16<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><span
class=SpellE><font size=1 color=black face=Arial><span style='font-size:9.0pt;
font-family:Arial;color:black'>UrgPtr</span></font></span><font size=1
color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>: 0x75<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>30<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'><o:p> </o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>[**] [116:46:1] (<span class=SpellE>snort_decoder</span>) WARNING:
TCP Data Offset is less than 5!<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>[**] 09/23-15:02:14.886738 10.10.10.102:0 -> 10.10.10.33:0 TCP
TTL<span class=GramE>:64</span><o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>TOS<span class=GramE>:0x10</span> ID:37119 IpLen:20 DgmLen:52
*2***R*F <span class=SpellE>Seq</span>: 0x6B645039<span
style='mso-spacerun:yes'>  </span><span class=SpellE>Ack</span>:<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><span
class=GramE><font size=1 color=black face=Arial><span style='font-size:9.0pt;
font-family:Arial;color:black'>0x2B65597A<span style='mso-spacerun:yes'> 
</span>Win</span></font></span><font size=1 color=black face=Arial><span
style='font-size:9.0pt;font-family:Arial;color:black'>: 0x4B79<span
style='mso-spacerun:yes'>  </span><span class=SpellE>TcpLen</span>: 12<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'><o:p> </o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>[**] [116:46:1] (<span class=SpellE>snort_decoder</span>) WARNING:
TCP Data Offset is less than 5!<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>[**] 09/23-15:02:14.888232 10.10.10.102:0 -> 10.10.10.33:0 TCP
TTL<span class=GramE>:64</span><o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>TOS<span class=GramE>:0x10</span> ID:37120 IpLen:20 DgmLen:52<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>*2U***S* <span class=SpellE>Seq</span>: <span class=GramE>0x4B633332<span
style='mso-spacerun:yes'>  </span><span class=SpellE>Ack</span></span>:
0x56583431<span style='mso-spacerun:yes'>  </span>Win: 0x3373<span
style='mso-spacerun:yes'>  </span><span class=SpellE>TcpLen</span>: 16<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><span
class=SpellE><font size=1 color=black face=Arial><span style='font-size:9.0pt;
font-family:Arial;color:black'>UrgPtr</span></font></span><font size=1
color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>: 0x37<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>57<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'><o:p> </o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><span
class=GramE><font size=1 color=black face=Arial><span style='font-size:9.0pt;
font-family:Arial;color:black'>this</span></font></span><font size=1
color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'> is not good... looks like the decoder is stealing the thunder of<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><span
class=GramE><font size=1 color=black face=Arial><span style='font-size:9.0pt;
font-family:Arial;color:black'>the</span></font></span><font size=1
color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'> stream4 preprocessor... this can easily be chalked up as a<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><span
class=GramE><font size=1 color=black face=Arial><span style='font-size:9.0pt;
font-family:Arial;color:black'>false</span></font></span><font size=1
color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'> positive by the analyst and there is no mention or inkling that<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><span
class=GramE><font size=1 color=black face=Arial><span style='font-size:9.0pt;
font-family:Arial;color:black'>fragroute</span></font></span><font size=1
color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'> is being used...<span style='mso-spacerun:yes'>  </span>So,
it appears that fragroute becomes useful again. <span
style='mso-spacerun:yes'> </span><o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'><o:p> </o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'>Allen<o:p></o:p></span></font></p>

<p class=MsoNormal style='mso-layout-grid-align:none;text-autospace:none'><font
size=1 color=black face=Arial><span style='font-size:9.0pt;font-family:Arial;
color:black'><o:p> </o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><span style='mso-spacerun:yes'> </span><o:p></o:p></span></font></p>

</div>

</body>

</html>