text:
Communication Networks/IP Tables

Operational summary
The netfilter framework, of which is a part of, allows the system administrator to define rules for how to deal with network packets. Rules are grouped into chains—each chain is an ordered list of rules. Chains are grouped into tables—each table is associated with a different kind of packet processing.

Each rule contains a specification of which packets match it and a target that specifies what to do with the packet if it is matched by that rule. Every network packet arriving at or leaving from the computer traverses at least one chain, and each rule on that chain attempts to match the packet. If the rule matches the packet, the traversal stops, and the rule's target dictates what to do with the packet. If a packet reaches the end of a predefined chain without being matched by any rule on the chain, the chain's policy target dictates what to do with the packet. If a packet reaches the end of a user-defined chain without being matched by any rule on the chain or the user-defined chain is empty, traversal continues on the calling chain (implicit target RETURN). Only predefined chains have policies.

Rules in iptables are grouped into chains. A chain is a set of rules for IP packets, determining what to do with them. Each rule can possibly dump the packet out of the chain (short-circuit), and further chains are not considered. A chain may contain a link to another chain - if either the packet passes through that entire chain or matches a RETURN target rule it will continue in the first chain. There is no limit to how many nested chains there can be. There are three basic chains (INPUT, OUTPUT, and FORWARD), and the user can create as many as desired. A rule can merely be a pointer to a chain.

Tables
There are three built-in tables, each of which contains some predefined chains. It is possible for extension modules to create new tables. The administrator can create and delete user-defined chains within any table. Initially, all chains are empty and have a policy target that allows all packets to pass without being blocked or altered in any fashion.

 * filter table — This table is responsible for filtering (blocking or permitting a packet to proceed). Every packet passes through the filter table.  It contains the following predefined chains, and any packet will pass through one of them:
 * INPUT chain — All packets destined for this system go through this chain (hence sometimes referred to as LOCAL_INPUT)
 * OUTPUT chain — All packets created by this system go through this chain (aka. LOCAL_OUTPUT)
 * FORWARD chain — All packets merely passing through the system (being routed) go through this chain.
 * nat table — This table is responsible for setting up the rules for rewriting packet addresses or ports. The first packet in any connection passes through this table: any verdicts here determine how all packets in that connection will be rewritten.  It contains the following predefined chains:
 * PREROUTING chain — Incoming packets pass through this chain before the local routing table is consulted, primarily for DNAT (destination-NAT).
 * POSTROUTING chain — Outgoing packets pass through this chain after the routing decision has been made, primarily for SNAT (source-NAT).
 * OUTPUT chain — Allows limited DNAT on locally-generated packets
 * mangle table — This table is responsible for adjusting packet options, such as quality of service. All packets pass through this table.  Because it is designed for advanced effects, it contains all the possible predefined chains:
 * PREROUTING chain — All packets entering the system in any way, before routing decides whether the packet is to be forwarded (FORWARD chain) or is destined locally (INPUT chain).
 * INPUT chain — All packets destined for this system go through this chain
 * FORWARD chain — All packets merely passing through the system go through this chain.
 * OUTPUT chain — All packets created by this system go through this chain
 * POSTROUTING chain — All packets leaving the system go through this chain.

In addition to the built-in chains, the user can create any number of user-defined chains within each table, which allows them to group rules logically.

Each chain contains a list of rules. When a packet is sent to a chain, it is compared against each rule in the chain in order. The rule specifies what properties the packet must have for the rule to match, such as the port number or IP address. If the rule does not match then processing continues with the next rule. If, however, the rule does match the packet, then the rule's target instructions are followed (and further processing of the chain is usually aborted). Some packet properties can only be examined in certain chains (for example, the outgoing network interface is not valid in the INPUT chain). Some targets can only be used in certain chains, and/or certain tables (for example, the SNAT target can only be used in the POSTROUTING chain of the nat table).

Rule targets
The target of a rule can be the name of a user-defined chain or one of the built-in targets ACCEPT, DROP, QUEUE, or RETURN. When a target is the name of a user-defined chain, the packet is diverted to that chain for processing (much like a subroutine call in a programming language). If the packet makes it through the user-defined chain without being acted upon by one of the rules in that chain, processing of the packet resumes where it left off in the current chain. These inter-chain calls can be nested to an arbitrary depth.

The following built-in targets exist:

 * ACCEPT
 * This target causes netfilter to accept the packet. What this means depends on which chain is doing the accepting.  For instance, a packet that is accepted on the INPUT chain is allowed to be received by the host, a packet that is accepted on the OUTPUT chain is allowed to leave the host, and a packet that is accepted on the FORWARD chain is allowed to be routed through the host.

 * DROP
 * This target causes netfilter to drop the packet without any further processing. The packet simply disappears without any indication of the fact that it was dropped being given to the sending host or application.  This frequently appears to the sender as a communication timeout, which can cause confusion (though dropping undesirable inbound packets is often considered a good security policy, because it gives no indication to a potential attacker that your host even exists).

 * QUEUE
 * This target causes the packet to be sent to a queue in user space. An application can use the libipq library, which also is part of the netfilter/iptables project, to alter the packet. If there is no application that reads the queue, this target is equal to DROP.

 * RETURN
 * According to the official netfilter documentation, this target has the same effect of falling off the end of a chain: for a rule in a built-in chain, the policy of the chain is executed. For a rule in a user-defined chain, the traversal continues at the previous chain, just after the rule which jumped to this chain.

There are many extension targets available. Some of the most common ones are:

 * <tt>REJECT</tt>
 * This target has the same effect as 'DROP' except that it sends an error packet back to the original sender. It is mainly used in the INPUT or FORWARD chains of the filter table. The type of packet can be controlled thorough the '--reject-with' parameter. A rejection packet can explicitly state that the connection has been filtered (an ICMP connection-administratively-filtered packet), though most users prefer that the packet will simply state that the computer does not accept that type of connection (such packet will be a tcp-reset packet for denied TCP connections, an icmp-port-unreachable for denied udp sessions or an icmp-protocol-unreachable for non-tcp non-udp packets). If the '--reject-with' parameter hasn't been specified, the default rejection packet is always icmp-port-unreachable.

 * <tt>LOG</tt>
 * This target logs the packet. This can be used in any chain in any table, and is often used for debugging (such as to see which packets are being dropped).

 * <tt>ULOG</tt>
 * This target logs the packet but not like the LOG target. The LOG target sends information to the kernel log but ULOG multicasts the packets matching this rule through a netlink socket so that userspace programs can receive these packets by connecting to the socket

 * <tt>DNAT</tt>
 * This target causes the packet's destination address (and optionally port) to be rewritten for network address translation. The '--to-destination' flag must be supplied to indicate the destination to use.  This is only valid in the OUTPUT and PREROUTING chains within the nat table.  This decision is remembered for all future packets which belong to the same connection, and replies will have their source address and port changed back to the original (ie. the reverse of this packet).

 * <tt>SNAT</tt>
 * This target causes the packet's source address (and optionally port) to be rewritten for network address translation. The '--to-source' flag must be supplied to indicate the source to use.  This is only valid in the POSTROUTING chain within the nat table, and like DNAT, is remembered for all other packets belonging to the same connection.

 * <tt>MASQUERADE</tt>
 * This is a special, restricted form of SNAT for dynamic IP addresses, such as most Internet service providers provide for modems or DSL. Rather than change the SNAT rule every time the IP address changes, this calculates the source IP address to use by looking at the IP address of the outgoing interface when a packet matches this rule.  In addition, it remembers which connections used MASQUERADE, and if the interface address changes (such as reconnecting to the ISP), all connections NATted to the old address are forgotten.

 * <tt>REDIRECT</tt>
 * The REDIRECT target is used to redirect packets and streams to the machine itself. This means that we could for example REDIRECT all packets destined for the HTTP ports to an HTTP proxy like squid, on our own host. Locally generated packets are mapped to the 127.0.0.1 address. In other words, this rewrites the destination address to our own host for packets that are forwarded, or something alike. The REDIRECT target is extremely good to use when we want, for example, transparent proxying, where the LAN hosts do not know about the proxy at all.

 * Note that the REDIRECT target is only valid within the PREROUTING and OUTPUT chains of the nat table. It is also valid within user-defined chains that are only called from those chains, and nowhere else. The REDIRECT target takes only one option, as described below.

Diagrams
These diagrams illustrates how a packet traverses the kernel netfilter tables/chains:

The following resources may also be useful:

 * http://xkr47.outerspace.dyndns.org/netfilter/packet_flow/packet_flow9.png
 * http://www.shorewall.net/images/Netfilter.png
 * http://dmiessler.com/images/DM_NF.PNG
 * http://linux-ip.net/nf/nfk-traversal.pdf

Connection tracking
One of the important features built on top of the netfilter framework is connection tracking. Connection tracking allows the kernel to keep track of all logical network connections or sessions, and thereby relate all of the packets which may make up that connection. NAT relies on this information to translate all related packets in the same way, and iptables can use this information to act as a stateful firewall.

Connection tracking classifies each packet as being in one of four states: <tt>NEW</tt> (trying to create a new connection), <tt>ESTABLISHED</tt> (part of an already-existing connection), <tt>RELATED</tt> (related to, but not actually part of an existing connection) or <tt>INVALID</tt> (not part of an existing connection, and unable to create a new connection). A normal example would be that the first packet the firewall sees will be classified <tt>NEW</tt>, the reply would be classified <tt>ESTABLISHED</tt> and an ICMP error would be <tt>RELATED</tt>. An ICMP error packet which did not match any known connection would be <tt>INVALID</tt>.

The connection state is completely independent of any TCP state. If the host answers with a SYN ACK packet to acknowledge a new incoming TCP connection, the TCP connection itself is not yet established but the tracked connection is - this packet will match the state ESTABLISHED.

A tracked connection of a stateless protocol like UDP nevertheless has a connection state.

Furthermore, through the use of plugin modules, connection tracking can be given knowledge of application layer protocols and thus understand that two or more distinct connections are "related". For example, consider the FTP protocol. A control connection is established, but whenever data is transferred, a separate connection is established to transfer it. When the ip_conntrack_ftp module is loaded, the first packet of an FTP data connection will be classified <tt>RELATED</tt> instead of <tt>NEW</tt>, as it is logically part of an existing connection.

iptables can use the connection tracking information to make packet filtering rules more powerful and easier to manage. The "conntrack" match extension allows iptables rules to examine the connection tracking classification for a packet. For example, one rule might allow <tt>NEW</tt> packets only from inside the firewall to outside, but allow <tt>RELATED</tt> and <tt>ESTABLISHED</tt> in either direction. This allows normal reply packets from the outside (<tt>ESTABLISHED</tt>), but does not allow new connections to come from the outside to the inside. However, if an FTP data connection needs to come from outside the firewall to the inside, it will be allowed, because the packet will be correctly classified as <tt>RELATED</tt> to the FTP control connection, rather than a <tt>NEW</tt> connection.

iptables
iptables is a user space application program that allows a system administrator to configure the netfilter tables, chains, and rules (described above). Because iptables requires elevated privileges to operate, it must be executed by user root, otherwise it fails to function. On most Linux systems, iptables is installed as <tt>/sbin/iptables</tt>. The detailed syntax of the <tt>iptables</tt> command is documented in its man page, which can be displayed by typing the command "<tt>man iptables</tt>".

Common options
In each of the iptables invocation forms shown below, the following common options are available:

 * <tt>-t table</tt>
 * Makes the command apply to the specified <tt>table</tt>. When this option is omitted, the command applies to the filter table by default.

 * <tt>-v</tt>
 * Produces verbose output.

 * <tt>-n</tt>
 * Produces numeric output (i.e., port numbers instead of service names, and IP addresses instead of domain names).

 * <tt>--line-numbers</tt>
 * When listing rules, add line numbers to the beginning of each rule, corresponding to that rule's position in its chain.

Rule-specifications
Most iptables command forms require you to provide a rule-specification, which is used to match a particular subset of the network packet traffic being processed by a chain. The rule-specification also includes a target that specifies what to do with packets that are matched by the rule. The following options are used (frequently in combination with each other) to create a rule-specification.

 * <tt>-j target</tt>
 * <tt>--jump target</tt>
 * Specifies the target of a rule. The target is either the name of a user-defined chain (created using the <tt>-N</tt> option), one of the built-in targets, <tt>ACCEPT</tt>, <tt>DROP</tt>, <tt>QUEUE</tt>, or <tt>RETURN</tt>, or an extension target, such as <tt>REJECT</tt>, <tt>LOG</tt>, <tt>DNAT</tt>, or <tt>SNAT</tt>.  If this option is omitted in a rule, then matching the rule will have no effect on a packet's fate, but the counters on the rule will be incremented.

 * <tt>-i [!] in-interface</tt>
 * <tt>--in-interface [!] in-interface</tt>
 * Name of an interface via which a packet is going to be received (only for packets entering the INPUT, FORWARD and PREROUTING chains). When the '!' argument is used before the interface name, the sense is inverted. If the interface name ends in a '+', then any interface which begins with this name will match. If this option is omitted, any interface name will match.

 * <tt>-o [!] out-interface</tt>
 * <tt>--out-interface [!] out-interface</tt>
 * Name of an interface via which a packet is going to be sent (for packets entering the FORWARD, OUTPUT and POSTROUTING chains). When the '!' argument is used before the interface name, the sense is inverted. If the interface name ends in a '+', then any interface which begins with this name will match. If this option is omitted, any interface name will match.

 * <tt>-p [!] protocol</tt>
 * <tt>--protocol [!] protocol</tt>
 * Matches packets of the specified protocol name. If '!' precedes the protocol name, this matches all packets that are not of the specified protocol.  Valid protocol names are <tt>icmp</tt>, <tt>udp</tt>, <tt>tcp</tt>... A list of all the valid protocols could be found in the file /etc/protocols.

 * <tt>-s [!] source[/prefix]</tt>
 * <tt>--source [!] source[/prefix]</tt>
 * Matches IP packets coming from the specified source address. The source address can be an IP address, an IP address with associated network prefix, or a hostname.  If '!' precedes the source, this matches all packets that are not coming from the specified source.

 * <tt>-d [!] destination[/prefix]</tt>
 * <tt>--destination [!] destination[/prefix]</tt>
 * Matches IP packets going to the specified destination address. The destination address can be an IP address, an IP address with associated network prefix, or a hostname.  If '!' precedes the destination, this matches all packets that are not going to the specified destination.

 * <tt>--destination-port [!] [port [: port ]] </tt>
 * <tt>--dport [!] [port [: port ]] </tt>
 * Matches TCP or UDP packets (depending on the argument to the <tt>-p</tt> option) destined for the specified port or the range of ports (when the <tt>port:port</tt> form is used). If '!' precedes the port specification, this matches all TCP or UDP packets not destined for the specified port or port range.

 * <tt>--source-port [!] [port [: port ]] </tt>
 * <tt>--sport [!] [port [: port ]] </tt>
 * Matches TCP or UDP packets (depending on the argument to the <tt>-p</tt> option) coming from the specified port or the range of ports (when the <tt>port:port</tt> form is used). If '!' precedes the port specification, this matches all TCP or UDP packets not coming from the specified port or port range.

 * <tt>--tcp-flags [!] mask comp</tt>
 * Matches TCP packets having certain TCP protocol flags set or unset. The first argument specifies the flags to be examined in each TCP packet, written as a comma-separated list (no spaces allowed).  The second argument is a comma-separated list of flags which must be set within those that are examined.  The flags are: SYN, ACK, FIN, RST, URG, PSH, ALL, and NONE.  Hence, the option "<tt>--tcp-flags SYN,ACK,FIN,RST SYN</tt>" will only match packets with the SYN flag set and the ACK, FIN and RST flags unset.

 * <tt>[!] --syn</tt>
 * Matches TCP packets having the SYN flag set and the ACK,RST and FIN flags unset. Such packets are used to initiate TCP connections.  Blocking such packets on the INPUT chain will prevent incoming TCP connections, but outgoing TCP connections will be unaffected.  This option can be combined with others, such as <tt>--source</tt> to block or allow inbound TCP connections only from certain hosts or networks.  This option is equivalent to "<tt>--tcp-flags  SYN,RST,ACK SYN</tt>".  If the '!' flag precedes the <tt>--syn</tt>, the sense of the option is inverted.

 * This section is under construction.

Invocation
iptables { -A | --append | -D | --delete } chain rule-specification [ options ]

This form of the command adds (<tt>-A</tt> or <tt>--append</tt>) or deletes (<tt>-D</tt> or <tt>--delete</tt>) a rule from the specified chain. For example to add a rule to the INPUT chain in the filter table (the default table when option <tt>-t</tt> is not specified) to drop all UDP packets, use this command:

 * <tt>iptables -A INPUT -p udp -j DROP</tt>

To delete the rule added by the above command, use this command:

 * <tt>iptables -D INPUT -p udp -j DROP</tt>

The above command actually deletes the first rule on the INPUT chain that matches the rule-specification "<tt>-p udp -j DROP</tt>". If there are multiple identical rules on the chain, only the first matching rule is deleted.

iptables { -R | --replace | -I | --insert } chain rulenum rule-specification [ options ]

This form of the command replaces (<tt>-R</tt> or <tt>--replace</tt>) an existing rule or inserts (<tt>-I</tt> or <tt>--insert</tt>) a new rule in the specified chain. For instance, to replace the fourth rule in the INPUT chain with a rule that drops all ICMP packets, use this command:

 * <tt>iptables -R INPUT 4 -p icmp -j DROP</tt>

To insert a new rule in the second slot in the OUTPUT chain that drops all TCP traffic going to port 80 on any host, use this command:

 * <tt>iptables -A INPUT-p tcp -m tcp --dport 22 -j ACCEPT</tt>

iptables { -D | --delete } chain rulenum [ options ]

This form of the command deletes a rule at the specified numeric index in the specified chain. Rules are numbers starting with 1. For example, to delete the third rule from the FORWARD chain, use this command:

 * <tt>iptables -D FORWARD 3</tt>

iptables { -L | --list | -F | --flush | -Z | --zero } [ chain ] [ options ]

This form of the command is used to list the rules in a chain (<tt>-L</tt> or <tt>--list</tt>), flush (i.e., delete) all rules from a chain (<tt>-F</tt> or <tt>--flush</tt>), or zero the byte and packet counters for a chain (<tt>-Z</tt> or <tt>--zero</tt>). If no chain is specified, the operation is performed on all chains. For example, to list the rules in the OUTPUT chain, use this command:

 * <tt>iptables -L OUTPUT</tt>

To flush all chains, use this command:

 * <tt>iptables -F</tt>

To zero the byte and packet counters for the PREROUTING chain in the nat table, use this command:

 * <tt>iptables -t nat -Z PREROUTING</tt>

iptables { -N | --new-chain } chain iptables { -X | --delete-chain } [ chain ]

This form of the command is used to create (<tt>-N</tt> or <tt>--new-chain</tt>) a new user-defined chain or to delete (<tt>-X</tt> or <tt>--delete-chain</tt>) an existing user-defined chain. If no chain is specified with the <tt>-X</tt> or <tt>--delete-chain</tt> options, all user-defined chains are deleted. It is not possible to delete built-in chains, such as the INPUT or OUTPUT chains in the filter table.

iptables { -P | --policy } chain target

This form of the command is used to set the policy target for a chain. For instance, to set the policy target for the INPUT chain to DROP, use this command:

 * <tt>iptables -P INPUT DROP</tt>

iptables { -E | --rename-chain } old-chain-name new-chain-name

This form of the command is used to rename a user-defined chain.

ipset
ipset is used to set up, maintain and inspect so called "IP sets" in the Linux kernel. An IP set usually contains a set of IP addresses, but can also contain sets of other network numbers, depending on its "type".

Any entry in one set can be bound to another set, allowing for sophisticated matching operations.

A set can only be removed (destroyed) if there are no iptables rules or other sets referring to it.

Commands
These options specify the specific action to perform. Only one of them can be specified on the command line unless otherwise specified below. For all the long versions of the command and option names, you need to use only enough letters to ensure that ipset can differentiate it from all other options.

Create a set identified with setname and specified type. Type-specific options must be supplied.
 * <tt>-N setname type type-specific-options</tt>
 * <tt>--create setname type type-specific-options</tt>

Destroy the specified set, or all sets if none or the keyword ":all:" is specified. Before destroying the set, all bindings belonging to the set elements and the default binding of the set are removed. If the set is still referenced, nothing is done.
 * <tt>-X [setname]</tt>
 * <tt>--destroy [setname]</tt>

Delete all entries from the specified set, or flush all sets if none or the keyword ":all:" is given. Bindings are not affected by the flush operation.
 * <tt>-F [setname]</tt>
 * <tt>--flush [setname]</tt>

Rename a set. Set identified by to-setname must not exist.
 * <tt>-E from-setname to-setname</tt>
 * <tt>--rename from-setname to-setname</tt>

Swap two sets as they referenced in the Linux kernel. iptables rules or ipset bindings pointing to the content of from-setname will point to the content of to-setname and vice versa. Both sets must exist.
 * <tt>-W from-setname to-setname</tt>
 * <tt>--swap from-setname to-setname</tt>

List the entries and bindings for the specified set, or for all sets if none or the keyword ":all:" is given. The -n, --numeric option can be used to suppress name lookups and generate numeric output. When the -s, --sorted option is given, the entries are listed sorted (if the given set type supports the operation).
 * <tt>-L [setname]</tt>
 * <tt>--list [setname]</tt>

Save the given set, or all sets if none or the keyword :all: is specified to stdout in a format that—restore can read.
 * <tt>-S [setname]</tt>
 * <tt>--save [setname]</tt>

Restore a saved session generated by—save. The saved session can be fed from stdin.
 * <tt>-R</tt>
 * <tt>--restore</tt>

When generating a session file please note that the supported commands (create set, add element, bind) must appear in a strict order: first create the set, then add all elements. Then create the next set, add all its elements and so on. Finally you can list all binding commands. Also, it is a restore operation, so the sets being restored must not exist.

-A, --add setname IP Add an IP to a set.

-D, --del setname IP Delete an IP from a set.

-T, --test setname IP Test whether an IP is in a set or not. Exit status number is zero if the tested IP is in the set and nonzero if it is missing from the set.

-T, --test setname IP—binding to-setname Test whether the IP belonging to the set points to the specified binding. Exit status number is zero if the binding points to the specified set, otherwise it is nonzero. The keyword :default: can be used to test the default binding of the set.

-B, --bind setname IP—binding to-setname Bind the IP in setname to-setname.

-U, --unbind setname IP Delete the binding belonging to IP in set setname.

-H, --help [settype] Print help and settype specific help if settype specified. At the -B, -U and -T commands you can use the token :default: to bind, unbind or test the default binding of a set instead of an IP. At the -U command you can use the token :all: to destroy the bindings of all elements of a set.

OTHER OPTIONS

The following additional options can be specified:

-b, --binding setname The option specifies the value of the binding for the -B binding command, for which it is a mandatory option. You can use it in the -T test command as well to test bindings.

-s, --sorted Sorted output. When listing sets, entries are listed sorted.

-n, --numeric Numeric output. When listing sets, bindings, IP addresses and port numbers will be printed in numeric format. By default the program will try to display them as host names, network names or services (whenever applicable), which can trigger slow DNS lookups.

-q, --quiet Suppress any output to stdout and stderr. ipset will still return possible errors.

Set types
ipset supports the following set types:

ipmap

The ipmap set type uses a memory range, where each bit represents one IP address. An ipmap set can store up to 65536 (B-class network) IP addresses. The ipmap set type is very fast and memory cheap, great for use when one want to match certain IPs in a range. Using the—netmask option with a CIDR netmask value between 0-32 when creating an ipmap set, you will be able to store and match network addresses: i.e. an IP address will be in the set if the value resulted by masking the address with the specified netmask can be found in the set.

Options to use when creating an ipmap set:

--from from-IP—to-IP Create an ipmap set from the specified range. --network IP/mask Create an ipmap set from the specified network. --netmask CIDR-netmask When the optional—netmask parameter specified, network addresses will be stored in the set instead of IP addresses, and the from-IP parameter must be a network address.

macipmap

The macipmap set type uses a memory range, where each 8 bytes represents one IP and a MAC addresses. A macipmap set type can store up to 65536 (B-class network) IP addresses with MAC. When adding an entry to a macipmap set, you must specify the entry as IP%MAC. When deleting or testing macipmap entries, the %MAC part is not mandatory.

Options to use when creating an macipmap set:

--from from-IP—to-IP Create a macipmap set from the specified range. --network IP/mask Create a macipmap set from the specified network. --matchunset When the optional—matchunset parameter specified, IP addresses which could be stored in the set but not set yet, will always match. Please note, the set and SET netfilter kernel modules always use the source MAC address from the packet to match, add or delete entries from a macipmap type of set.

portmap

The portmap set type uses a memory range, where each bit represents one port. A portmap set type can store up to 65536 ports. The portmap set type is very fast and memory cheap.

Options to use when creating an portmap set:

--from from-port—to-port Create a portmap set from the specified range. iphash

The iphash set type uses a hash to store IP addresses. In order to avoid clashes in the hash double-hashing, and as a last resort, dynamic growing of the hash performed. The iphash set type is great to store random addresses. By supplyig the—netmask option with a CIDR netmask value between 0-32 at creating the set, you will be able to store and match network addresses instead: i.e. an IP address will be in the set if the value of the address masked with the specified netmask can be found in the set.

Options to use when creating an iphash set:

--hashsize hashsize The initial hash size (default 1024) --probes probes How many times try to resolve clashing at adding an IP to the hash by double-hashing (default 8). --resize percent Increase the hash size by this many percent (default 50) when adding an IP to the hash could not be performed after probes number of double-hashing. --netmask CIDR-netmask When the optional—netmask parameter specified, network addresses will be stored in the set instead of IP addresses. Sets created by zero valued resize parameter won't be resized at all. The lookup time in an iphash type of set approximately linearly grows with the value of the probes parameter. At the same time higher probes values result a better utilized hash while smaller values produce a larger, sparse hash.

nethash

The nethash set type uses a hash to store different size of network addresses. The IP "address" used in the ipset commands must be in the form IP-address/cidr-size where the CIDR block size must be in the inclusive range of 1-31. In order to avoid clashes in the hash double-hashing, and as a last resort, dynamic growing of the hash performed.

Options to use when creating an nethash set:

--hashsize hashsize The initial hash size (default 1024) --probes probes How many times try to resolve clashing at adding an IP to the hash by double-hashing (default 4). --resize percent Increase the hash size by this many percent (default 50) when adding an IP to the hash could not be performed after An IP address will be in a nethash type of set if it is in any of the netblocks added to the set and the matching always start from the smallest size of netblock (most specific netmask) to the biggest ones (least specific netmasks). When adding/deleting IP addresses to a nethash set by the SET netfilter kernel module, it will be added/deleted by the smallest netblock size which can be found in the set.

The lookup time in a nethash type of set is approximately linearly grows with the times of the probes parameter and the number of different mask parameters in the hash. Otherwise the same speed and memory efficiency comments applies here as at the iphash type.

ipporthash

The ipporthash set type uses a hash to store IP address and port pairs. In order to avoid clashes in the hash double-hashing, and as a last resort, dynamic growing of the hash performed. An ipporthash set can store up to 65536 (B-class network) IP addresses with all possible port values. When adding, deleting and testing values in an ipporthash type of set, the entries must be specified as "IP%port".

The ipporthash types of sets evaluates two src/dst parameters of the set match and SET target.

Options to use when creating an ipporthash set:

--from from-IP—to-IP Create an ipporthash set from the specified range. --network IP/mask Create an ipporthash set from the specified network. --hashsize hashsize The initial hash size (default 1024) --probes probes How many times try to resolve clashing at adding an IP to the hash by double-hashing (default 8). --resize percent Increase the hash size by this many percent (default 50) when adding an IP to the hash could not be performed after probes number of double-hashing. The same resizing, speed and memory efficiency comments applies here as at the iphash type.

iptree

The iptree set type uses a tree to store IP addresses, optionally with timeout values. Options to use when creating an iptree set: --timeout value The timeout value for the entries in seconds (default 0) When adding an IP address to a set, one may add it with a specific timeout value using the syntax IP%timeout-value.

Le système d'exploitation GNU-Linux/Protection avec iptables

title: Communication Networks/IP Tables


text:
Horticulture/Halyomorpha halys

Halyomorpha halys, the brown marmorated stink bug, is an agricultural pest that can cause widespread damage to fruit and vegetable crops. In Japan it is a pest to soybean and fruit crops. In the U.S., the brown marmorated stink bug feeds on a wide range of fruits, vegetables, and other host plants beginning in late May/early June including peaches, apples, green beans, soybeans, cherry, raspberries, and pears. It is a sucking insect that uses its stylet to pierce the host plant in order to feed. This feeding results, in part, in the formation of small, necrotic areas on the outer surface of fruits but ranges from leaf stippling, cat-facing on tree fruits, seed loss, and transmission of plant pathogens.

The bug is native to China and Japan, and is believed to have "hitched a ride" to North America as a stowaway in packing crates from China or Japan. The first documented specimen was collected in Allentown, Pennsylvania, during the fall of 1996. In 1999, the brown marmorated stink bug was first recovered in New Jersey from a black light trap run by the Rutgers Cooperative Extension (RCE) Vegetable IPM program in Milford, New Jersey. In 2002, it was again collected from black light traps located in Phillipsburg and Little York and found on plant material in Stewartsville. It is now documented and established in many counties in the tri-state area (New Jersey, Pennsylvania and New York) on the eastern coast of the United States. This agricultural pest has already reached large parts of Western Maryland and West Virginia, and studies continue to establish just how extensive the infestation may go.

Description
It looks similar in appearance to other native species of shield bugs including ../Acrosternum/, ../Euschistus/, and ../Podisus/, except that several of the abdominal segments protrude from beneath the wings and are alternatively banded with black and white (visible along the edge of the bug even when wings are folded) and a white stripe or band on the next to last (4th) antennal segment. The adults are approximately ⅝ in long and he underside is white or pale tan, sometimes with grey or black markings. The legs are brown with faint white banding.

Symptoms and Signs
The most economically important damage is necrotic areas on the outer surface of fruits but also ranges from leaf stippling, cat-facing on tree fruits, seed loss, and possibly the transmission of plant pathogens

Ecology
The brown marmorated stink bug survives the winter as adults by entering houses and structures when fall evenings start to turn cold. Adults can live for several years and look for buildings to overwinter in that shield them from the elements. They will work their way under siding, into soffits, around window and door frames, under roof shingles and into any crawl space or attic vent which has openings big enough to fit through. Once inside the home they will go into a state of hibernation where they wait for winter to pass, but often the warmth inside the home causes them to become active, especially in winter months, and they will fly clumsily around light fixtures. They leave a powerful scent behind on everything they land on, including the buildings where they hibernate, and this odor is one of the reasons they will return year after year; it is a beacon to other stinkbugs that this location is a good hibernation nest.

The stinkbug's ability to emit a vile odor through holes in its abdomen is a defense mechanism meant to prevent it from being eaten by birds and lizards. However, simply jostling the bug, cornering it, scaring or injuring it, or attempting to remove one from one's home can "set it off," and the odor is extremely powerful, unpleasant, and long-lasting. It can make a whole room uninhabitable until aired out, and some people are even allergic to the smell. Squashing it is a surefire way of expelling its noxious odor, and most times the best way of extracting one from the inside of a home is to allow it to walk onto something like a newspaper and then simply taking it outside. The stink glands are located on the underside of the thorax, between the first and second pair of legs.

Host plants

 * ../Acer/ (Maple)
 * ../Abelia/
 * ../Arctium/ (burdock)
 * ../Buddleia/
 * ../Catalpa/
 * ../Diospyros/ (persimmon)
 * ../Ficus/ (fig)
 * ../Glycine/ (soya)
 * ../Lonicera/ (honeysuckle)
 * ../Malus/ (apple)
 * ../Morus/ (mulberry)
 * ../Paulownia/ (empress tree)
 * ../Phaseolus/ (bean),
 * ../Prunus/ (cherry, peach, and apricot)
 * ../Pyrus/ (pear)
 * ../Rosa/
 * ../Rubus/ (raspberry)
 * ../Vitis/ (grape)

Control
Control methods have yet to be established for agricultural situations.

license: Creative Commons - Attribution Share-Alike - https://creativecommons.org/licenses/by-sa/4.0/

title: Horticulture/Halyomorpha halys


text:
Talk:Movie Making Manual/Digital Video/Analog vs. Digital

This page seems to be more of an argument for digital film editing than a neutral reference differentiating between analog and digital editing.


text:
Talk:False Friends of the Slavist/Map storna

Untitled
"strona" means "page" in Polish, too. 80.109.103.163 17:47, 11 May 2007 (UTC)

*storna in Russian
Russian word for *storna is ‘сторона’. Although ‘страна’ also exists, it is only a loanword borrowed from Old Church Slavonic. ‘Сторона’ means a side, while ‘страна'’ means a country. Best regards, 78.25.180.222 (discuss) 18:07, 9 January 2012 (UTC).

Ukrainian "сторнінка"
Why there is Russian "страница", Belarusian "старонка", but no Ukrainian "сторінка"? Picture should be updated, Ukrainian have "page" meaning too. -- Upliner (discuss • contribs) 11:07, 28 October 2015 (UTC)

Upd: Picture updates automatically, that's good :) Upliner (discuss • contribs) 11:10, 28 October 2015 (UTC)


text: User:Emprovision~enwikibooks

title: User:Emprovision~enwikibooks


text:
User talk:Emprovision~enwikibooks

Your account will be renamed
Hello,

The developer team at Wikimedia is making some changes to how accounts work, as part of our on-going efforts to provide new and better tools for our users like cross-wiki notifications. These changes will mean you have the same account name everywhere. This will let us give you new features that will help you edit and discuss better, and allow more flexible user permissions for tools. One of the side-effects of this is that user accounts will now have to be unique across all 900 Wikimedia wikis. See the announcement for more information.

Unfortunately, your account clashes with another account also called Emprovision. To make sure that both of you can use all Wikimedia projects in future, we have reserved the name Emprovision~enwikibooks that only you will have. If you like it, you don't have to do anything. If you do not like it, you can pick out a different name.

Your account will still work as before, and you will be credited for all your edits made so far, but you will have to use the new account name when you log in.

Sorry for the inconvenience.

Yours, Keegan Peterzell Community Liaison, Wikimedia Foundation 23:11, 17 March 2015 (UTC)

Renamed
 This account has been renamed as part of single-user login finalisation. If you own this account you can |log in using your previous username and password for more information. If you do not like this account's new name, you can choose your own using this form after logging in: . -- Keegan (WMF) (talk) 04:56, 19 April 2015 (UTC)

title: User talk:Emprovision~enwikibooks


text:
C++ Programming/Code/Variables/Examples/Adds two numbers and prints their sum

|6


text:
User:Lady Aquarius23

hi, how are you? It's nice to talk to you.

title: User:Lady Aquarius23


text:
User:Tom kananzy

Hello, to everyone who is reading my page, I am currently doing a school project on wikibooks. It is called "How to write a good book for children". Though this project is not completed, I will keep you guys up to date.

 * --Tom kananzy 18:59, 11 May 2007 (UTC)

title: User:Tom kananzy


text:
User talk:Huskii

we are doing a good job don't you think--Skirtsz18 13:47, 15 May 2007 (UTC)

title: User talk:Huskii


text:
User:Sunshine 12

this is our first wikibook! check it out and help if you want to. How to write a good book for children?

title: User:Sunshine 12


text:
User:Milkyway12

hola its milkyway12 here!!!!!!!

title: User:Milkyway12


text:
User:LRainbowz,x

Hi Peoplezz! Zup. I Am Working On How To Write A Good Book For Children! Enjoy My Username Account :D:D

Bye Bye!

title: User:LRainbowz,x


text: C++ Programming/Examples/Displays a string


text:
Ada Programming/Types/limited

Limited Types
When a type is declared this means that objects of the type cannot be assigned values of the same type. An Object b of limited type LT cannot be copied into an object a of same type LT.

Additionally, there is no predefined equality operation for objects of a limited type.

The desired effects of declaring a type limited include prevention of shallow copying. Also, the (unique) identity of an object is retained: once declared, a name of a variable of type LT will continue to refer to the same object.

The following example will use a rather simplifying type Boat.

Boat Choose Load  Sailors_Units Speed Sailors_Units Boat Set_Sail The_Boat   Boat

When we declare a variable to be of type Boat, its name will denote one boat from then on. Boats will not be copied into one another.

The full view of a boat might be implemented as a record such as

Boat Max_Sail_Area Sailors_Units Max_Freight   Sailors_Units Sail_Area     Sailors_Units Freight       Sailors_Units

The Choose function returns a <tt>Boat</tt> object depending on the parameters <tt>Load</tt> and <tt>Speed</tt>. If we now declare a variable of type Boat we will be better off Choosing an initial Boat (or else we might be dropping into uninitialized waters!). But when we do so, the initialization looks suspiciously like assignment which is not available with limited types:

Travel People Positive Average_Speed  Sailors_Units Henrietta Boat Choose Load  People  Average_Weight  15 Speed Average_Speed  15 Set_Sail Henrietta Travel

Fortunately, current Ada distinguishes initialization from copying. Objects of a limited type may be initialized by an initialization expression on the right of the delimiter .

(Just to prevent confusion: The Ada Reference Manual discriminates between assignment and assignment statement, where assignment is part of the assignment statement. An initialisation is of course an assignment which, for limited types, is done in place. An assignment statement involves copying, which is forbidden for limited types.)

Related to this feature are aggregates of limited types and “constructor functions” for limited types. Internally, the implementation of the <tt>Choose</tt> function will return a limited record. However, since the return type <tt>Boat</tt> is limited, there must be no copying anywhere. Will this work? A first attempt might be to declare a <tt>result</tt> variable local to <tt>Choose</tt>, manipulate <tt>result</tt>, and return it. The <tt>result</tt> object needs to be “transported” into the calling environment. But <tt>result</tt> is a variable local to <tt>Choose</tt>. When <tt>Choose</tt> returns, <tt>result</tt> will no longer be in scope. Therefore it looks like <tt>result</tt> must be copied but this is not permitted for limited types. There are two solutions provided by the language: extended return statements (see ) and aggregates of limited types. The following body of <tt>Choose</tt> returns an aggregate of limited type <tt>Boat</tt>, after finding the initial values for its components.

Choose Load  Sailors_Units Speed Sailors_Units Boat Capacity  Sailors_Units  Capacity_Needed Load Boat Max_Freight   Capacity Max_Sail_Area Sail_Needed Capacity Freight       Load Sail_Area     00 Choose

The object that is returned is at the same time the object that is to have the returned value. The function therefore initializes <tt>Henrietta</tt> in place.

In parallel to the predefined type <tt>.Controlled</tt>, Ada provides the type <tt>Limited_Controlled</tt> in the same package. It is a limited version of the former.

Initialising Limited Types
A few methods to initialise such types are presented.

Limited_Private_Samples Uninitialised   ; Preinitialised  ; Dynamic_Initialisation  ; Constructor (X: Integer) Dynamic_Initialisation; Needs_Constructor (<>)  ; Constructor (X: Integer) Needs_Constructor; Uninitialised I: Integer; ;   Preinitialised I: Integer := 0; ;   Void   ; Constructor (Object: Dynamic_Initialisation)  Void; Dynamic_Initialisation Hook: Void := Constructor (Dynamic_Initialisation'); Bla : Integer; ;   Needs_Constructor I: Integer; ; Limited_Private_Samples;

Limited_Private_Samples Constructor (Object: Dynamic_Initialisation)  Void Object.Bla := 5; ;   Constructor; Constructor (X: Integer) Dynamic_Initialisation (Hook =>,            Bla  => 42); Constructor; Constructor (X: Integer) Needs_Constructor (I => 42); Constructor; Limited_Private_Samples;

Limited_Private_Samples Limited_Private_Samples Try U Uninitialised P Preinitialised D1 Dynamic_Initialisation D2 Dynamic_Initialisation Constructor 0 D3 Dynamic_Initialisation Constructor 0 N Needs_Constructor Constructor 0 Try Note that D3 is a constant, whereas all others are variables.

Also note that the initial value that is defined for the component of Preinitialised is evaluated at the time of object creation, i.e. if an expression is used instead of the literal, the value can be run-time dependent.

X, Y: Preinitialised;

In this declaration of two objects, the initial expression will be evaluated twice and can deliver different values, because it is equivalent to the sequence:

X: Preinitialised; Y: Preinitialised;

So X is initialised before Y.

title: Ada Programming/Types/limited


text: C++ Programming/Examples/Displays a string1


text: C++ Programming/Examples/Displays a string2


text:
WebObjects/GVC Frameworks

The GVC Frameworks evolved from projects implemented by GVC Village Consulting] for over 10 years. One of the most recent projects that use these frameworks is ], an Open Source CMS that allows non-technical users to create highly customized websites and web databases.

The following are some of the main frameworks included in this release:

• GVCEOFExtensions – Provides loads of Enterprise Objects Frameworks (EOF) additions and custom qualifiers.

• GVCEOFValidation – Provides enhancements to standard EOF validation, including code-free, customizable, localizable validation messages and more extensive validation.

• GVCFoundation – Contains Foundation extensions such as Boolean, Date, BigDecimal, String, NSArray.

• GVCEOPrototypes – Contains standard set of Enterprise Objects (EO) prototypes that can be used for multiple frameworks and WebObjects applications. It currently supports prototypes for DB2, FrontBase, JDBC, MySQL and Oracle databases.

• GVCGenericObjects – Contains classes designed for easy lookup, localization and archival of objects.

• GVCSecurity – Contains classes that provide security or different access rights for users or groups in a WebObject’s application.

• GVCVirtualTables – Contains classes that provide a virtual representation of database tables which can be accessed via Key Value Coding (KVC).

• GVCKerberos – Contains a simple wrapper class around some of the functionality in the WedgeTail JSCI Kerberos classes. It implements a very simple Kerberos authentication of a user ID and password.

• GVCMail – Contains convenience classes for sending email messages and support for fault tolerant sending of bulk messages.

• GVCWOExtensions – Contains extensions to WOApplication, WOComponent, WODirectAction, WOSession and other AppServer classes.

• GVCJNDIAdditions – Extends the JNDI adaptor to support secure communication with an LDAP server. Transport Layer Security (TLS) provides a mechanism for ensuring the integrity and confidentiality of the transferred data.

The GVC Frameworks were developed in parallel with Project Wonder so you will find a lot of duplication in the extensions to Foundation, EOF, and WO areas. But there is a lot of unique stuff too and alternative implementations of things like localization. Eventually this might all get merged into Wonder, but that is a lot of effort and we are busy now.

Download from ] - see File Releases.

title: WebObjects/GVC Frameworks


text:
Talk:Miskito/Contents

Untitled
I recommend making this into PDF format, but I don't know how. Icelandic Hurricane 21:30, 11 May 2007 (UTC)

This language course is maybe the most professional and well-planned language course on all of Wikibooks! I have tried in vain to get people to develop goals and a curriculum before writing something in a lesson. Junesun 15:51, 16 May 2007 (UTC)

The syntax of this language seems to be based on that of Japanese. Just thought I should add that, as I speak Japanese. From what I understand, this language is not even real, but I do admit that the course is well planned. The editors have done splendidly here. 74.133.179.182 (talk) 03:37, 14 December 2007 (UTC)
 * What do you mean with "not real"? Miskito is an indigenous language of Nicaragua and Honduras, and it is the second most spoken language in Nicaragua (next to Spanish). Junesun (talk) 09:34, 14 December 2007 (UTC)
 * Hi there. Yes, it is a real language indeed.
 * It has been quite heavily relexicalized from English but that does not make it any less real. As it happens, English was heavily relexicalized from French, and as the Japanese-speaking anonymous contributor must surely know, for that matter Japanese was very heavily relexicalized from Chinese. If that is what she or he is bothered by, then we can say Miskito is at least as real as English and Japanese. Lol.
 * I should also correct anonymous' other assertion. Miskito syntax is not "based on" Japanese (of course). There is some degree of typological affinity, but the affinity is not all that great either considering some notable differences. If your native language is not a verb final language, and you learn one (like Japanese), and then you encounter another verb final language, you will notice the resemblance, because of where you are looking from. This is a bit like a person of white race thinking that all Africans look the same. It is only true from where you are looking! :) --A R King (discuss • contribs) 11:03, 27 August 2011 (UTC)

title: Talk:Miskito/Contents


text:
Autistic Survival Guide/Preamble

The work on Marc Segar's A Survival Guide for People with Asperger Syndrome stopped early in Marc Segar's life. It says nothing about managing a job, getting married, or raising kids. The aim of this project is to collaboratively write an updated survival guide for autistic people right here on Wikibooks. Feel free to contribute to any of the chapters in this book.

Marc Segar's designation of "typical" behaviours is interesting, but its usefulness is questionable. These behaviours are not necessarily desirable, nor are they helpful to neuroatypical people, other than for understanding how they are different from a majority of people. Moreover, only few people are good in all these things Marc Segar lists, and valuing oneself based on his list of "typical behaviors" may be harmful rather than useful. While, according to the Monotropism hypothesis, the main difficulties for autistic people relate to multitasking, many neurotypical people feel the same, even if their capacity to multi-task may be better than those labelled as autistic. What I find much more helpful is what typical and atypical people have in common, because that is going to be the basis of mutual understanding, when it happens.

It is also worth noting that the question "what is normal anyway" keeps re-occurring when talking about psychology in general, and that question may possibly be answered in the works of five- time New York teacher of the year John Taylor Gatto and author Thom Hartmann. The central premise behind these works is the fact that the compulsory school system is designed to "socialise" children into the work force by making them docile, predictable, willing to take the word of leaders as truth, and dependent upon others for a sense of self worth. This goes a long way towards explaining neurotypical behaviour, and why neurodivergents don't fit in: Neurodivergents simply fail to be socialised this way.

These talks by Dinah Murray might also be helpful: Finding and maintaining a niche and Creating social space for autism, and here is a list of links from the Autism and Computing website. A detailed practical Field Guide into the behaviour of neurotypicals from an Asperger perspective was written by Ian Ford - Field Guide to Earthlings.

The key for understanding other people and being understood is to understand that what people feel often matters much more than how they look, dress or behave. People's empathy labels them attracted to what feels good, and pushed away from what feels bad. That means people like you more if you feel good, and like you less when you feel bad. Thus working towards yourself feeling good rather than pleasing other people's norms is the key for social interaction. If you work on feeling good for yourself, other people might pick up on it. On the other hand, if you feel insecure trying to pretend to be someone else, people feel that as well and might turn away after some time.

title: Autistic Survival Guide/Preamble


text:
Autistic Survival Guide/Introduction

This project is an attempt to continue Marc Segar's book A survival guide for people with Asperger Syndrome. It is done in the same style as this book because the rationale behind that style appears to be sound. The sections are designed to be small and specific enough to allow people with possibly conflicting perspectives to collaborate in its development by adding new sections, while preserving the "structural integrity" of the thoughts contained within each section.

It is becoming increasingly obvious that every autistic individual has a different life experience that other autists can learn from, and everyone is therefore encouraged to contribute to this work by adding new sections in a brainstorming fashion. When contributing, it is worth bearing in mind that the rules in Marc's book are clear, unambiguous, and constructive, and they typically promote Positive Mental Attitude (PMA). Those rules, however, aren't always explained, which may be a problem in this work since other collaborators typically need to understand the reasoning before being able to build upon the ideas.

This book will probably not make much sense if you haven't read Marc's guide and see the value in it. Be aware that Marc seems to have spent much of his life working not only on this problem, but on how to express the things he has learned properly. His work is quite difficult to live up to.

It should be noted that this book is NOT intended to be an instruction manual to teach autistic spectrum people how to become non-autistic. It is designed to be used in many different ways, particularly in ways not yet envisaged, in the same way that a map shows how to get from any of many different locations to any of many other locations.

title: Autistic Survival Guide/Introduction


text:
Autistic Survival Guide/A Note to Professionals

In the time since autism was first described in the early 20th century, remarkably little has been established about it, and virtually all of the "discoveries" ultimately come from autistic people themselves. The fact that social skills training is now being used as a treatment is due in no small part to the line at the end of Marc Segar's survival guide, which this book is based on, and which reads "autistic people have to understand scientifically what non-autistic people already understand instinctively". We fear that this line may have been misinterpreted, or not articulated properly. The idea of social skills training is based on the interpretation that "autistic people have to understand scientifically what non-autistic people LEARN instinctively", and it entirely misses the interpretation that autistic spectrum people may need to understand scientifically how non-autistic people instinctively learn. It's unclear whether Marc Segar understood this before he died, but he was very close to it, since he left clues in his guide referring to "solving the puzzle" and how non-autistic people think.

Perhaps a good example of the impact autistic spectrum people have had on this world is the fact that "the autism problem" is so intractable. Autistic people are the most likely people to "solve" it and from this perspective, it is impossible to do so without knowing what the non-autistic world is. Perhaps the wrong question is being asked—what we should be studying is what non-autistic people have that autistic spectrum people do not. Knowing this appears to be part of any practical "solution" anyway.

To this date, Marc Segar's guide is the only thing I have found on the internet that actually talks about how non-autistic people think in any constructive way. A majority of self help material available today is locked away under copyright with steep license purchasing fees to access, which is particularly offensive given that Marc Segar's work likely contributed to the development of it all. This wikibook is licensed under the GFDL and CC-BY-SA license, and as such, people are free to do what they want with it. However if, as a professional, you find yourself using the material here, we ask that you make both this document and copies of Marc Segar's survival guide available to your clients.


text:
Autistic Survival Guide/Ways to maintain self esteem

= Ways to maintain self esteem =
 * See also the "worrying" section in Marc Segar's Survival Guide. In particular, learning to laugh at yourself, and to recognise your mistake, apologise and just move on can save many a bad situation.
 * The single best way to reinforce self esteem is to know where to go to be safe from making mistakes that have ongoing consequences, and to know that you can get there. These can be places, behaviours, or frames of mind.
 * Having a reliable visualised understanding of the environment you are in that you can fall back on in times of distress can help a great deal to pacify overwhelming negative thoughts, and help you plan ways out of bad situations.
 * If your failures keep haunting you, knowing that you have learned as much as you can from them can help that stop.
 * Non-autistic people learn from experience this way anyway, so worrying excessively about possible future failure is probably overkill.
 * Faking self esteem can have its merits:
 * It means that you will be less of a target for social predators.
 * Being less of a target means your self esteem has more time to rebuild naturally.
 * A person who is supremely confident has no need to prove oneself and therefore has no need for ego. This is directly at odds with the idea that ego helps a great deal in the competition phase mentioned in the section "the art of self confidence".
 * A person who is supremely confident settles conflicts so that every party wins as much as possible and therefore has no need for aggression.
 * A person who is supremely confident has little to be scared of and therefore displays their more positive emotions rather than their negative ones.
 * There are also some thoughts about emotions in relation to maintaining one's self esteem.
 * It is necessary to let some negative emotions "radiate". If you don't permit yourself to do this sometimes, things can reach a boiling point and explode inappropriately.
 * Although autistic people seem to be incapable of reading the emotions of others, the emotions they express are VERY readable by others. The confusion others have in reading those emotions are in the fact that the emotions often don't make sense.
 * Fear and anger are emotions that are communicated across species, and between autistic and non autistic people. They are "reliable emotions".


text:
User:Ypetrachenko

My HQ are in English Wikipedia

title: User:Ypetrachenko


text:
User:Kitty-11

Hi everybody wats up!!!

title: User:Kitty-11


text:
User talk:60.242.25.74

Please do not add inappropriate external links to Wikibooks. Wikibooks is intended to be read without the need for external reference and requires content rather than external links particularly those which are for advertising or promotion. Inappropriate links may include (but are not limited to) links to personal web sites, links to web sites with which you are affiliated, and links that exist to attract visitors to a web site or promote a product. If you feel the link should be added to the article, then please discuss it on the article's talk page rather than re-adding it. See the welcome page to learn more about Wikibooks. Thank you.

Xania talk 00:51, 12 May 2007 (UTC)

title: User talk:60.242.25.74


text:
Radiation Oncology/Sarcoma/Hemangiopericytoma

Hemangiopericytoma

Overview

 * Malignant vascular tumor
 * Tumor cells appear like smooth muscle cells, but don't arise from endothelial cells
 * Cell of origin not clear, possibly derived from pericytes
 * Most commonly in pelvic, proximal femur, humerus, and vertebral bodies
 * Median age in 4th and 5th decade
 * Typically slow growing
 * Radiography not definitive
 * Easily confused with meningioma. No calcifications or hyperostosis on CT (where as meningiomas have these features)
 * larger lesions will show flow voids on MRI.
 * Treatment frequently surgical, role of chemo and RT not clear, although small series show lower rates of recurrence with addition of radiotherapy.

 * Heidelberg, 2005 (Germany) (1984-2004) PMID 16222690 — "Precision radiotherapy for hemangiopericytomas of the central nervous system." (Combs SE et al. Cancer. 2005 Dec 1;104(11):2457-65.)
 * Retrospective. 25 patients. 23 surgical resection. Treated with fractionated stereotactic RT or IMRT for tumors of the CNS and spine. Median dose 54 (in 1.8-2 Gy/fx)
 * OS: 5-years 100%, 10-years 64%. 5-year PFS 61%
 * Conclusion: "High precision" RT effective and safe

 * SEER Analysis, 2013 (1990-2008) PMID 22867893 - The Role of Postoperative Radiation Therapy in the Treatment of Meningeal Hemangiopericytoma—Experience From the SEER Database (Stessin AM et al. Int J Radiat Oncol Biol Phys. 2013 Mar 1;85(3):784-90.)
 * SEER analysis from 1990-2008 of 76 patients in, of these 38 (50%) underwent gross total resection (GTR), whereas the other half underwent subtotal resection (STR), with a mean follow-up time is 7.9 years (95 months). There were Postoperative RT was administered to 42% (16/38) of the patients in the GTR group and 50% (19/38) in the STR group. The 1-year, 10-year, and 20-year cause-specific survival rates were 99%, 75%, and 43%, respectively. On multivariate analysis, postoperative RT was associated with significantly better survival (HR = 0.269, 95% CI 0.084-0.862; P=.027), in particular for patients who underwent STR (HR = 0.088, 95% CI: 0.015-0.528; P<.008).
 * Conclusion: Based on the current literature, the practical approach is to deliver limited field RT to doses of 50-60 Gy while respecting the normal tissue tolerance, especially for cases of STR.


text:
The Poetry of Gaius Valerius Catullus/13

=Text and Translation=

Meter - Hendecasyllabic

=Connotations of The Text=

This poem is an dinner invitation to Catullus's friend, Fabullus.

Line 3

 * si - if...

This is the catch for Fabullus - he will dine well if he does all the things about to be listed. It is put at the beginning of the line for emphasis.

Line 4

 * candida - white; fair

Can mean white, but here means beautiful/of pale skin - pale skin was a sign of beauty in Roman times.

Line 5

 * sale - salt

This word means salt normally, but came to mean wit. This was because salt was used to add flavour the meat, and so in a literary terms the 'flavour' to words is wit.

 * cachinnis - laughs

This word is probably derived from Greek since the letter ch was not a Latin sound. The harsh sound that comes from saying this word may reflect the sounds of the laughter described.

Line 8

 * plenus sacculus est aranearum - lit. - full the purse is of cobwebs'

The poem makes use of hyperbaton. This is the re-arranging of the word order to create emphasis and effect. Hyperbaton is particularly common in inflected languages, such as Latin and Ancient Greek where the word order does not matter. The joke here is still used today - cobwebs sprung up where nothing has been touched for a while - and Catullus is broke.

Line 11

 * unguentum - perfume; oil

The reference to the "oil" or perfume, may be a subtle compliment to Catullus's girl. Both Roman men and women would wear perfume to make themselves smell more attractive.

=Vocabulary=

=Sources=

 * Oxford Latin Reader by Maurice Balme and James Morewood (1997)

=External Links=

 * Catullus 13 A Translation of Catullus 13


text:
The Poetry of Gaius Valerius Catullus/43

Text & Translation
Meter - Hendecasyllabic

Connotations of The Text
This poem is in hendecasyllabic metre. It regards a girl who has been compared in beauty to Catullus's love, "Lesbia". As offensive as it sounds, it can be assumed that it was intended really as a compliment to Lesbia, rather than an insult to the girl adressed.

Line 2

 * nigris ocellis - dark eyes

Dark eyes were considered a sign of beauty in Roman times.

 * nec... nec... - nor... nor...

This poem uses liberal use of anaphora with phrases containing nec. This emphasises the negativity of the girl from Formia.

Line 5

 * Formia

Formia was a city not far from Rome. It could also be a subtle reference to the word "formosa" which means beauty.

Lines 6-7

 * provincia - country people

There is an air of snobbery here, sneering at country people who Catullus deems to be ignorant of what real beauty is.

 * ...bellam? ....comparatur?

Ending these two lines with forceful questions shows the reader the passion that Catullus feels and clearly indicates his view on such a thing.

Line 8

 * insapiens et infacetum - stupid and tasteless

The alliteration here emphasises his disgust at girls that people will label as 'beautiful' in the countryside.


text:
Radiation Oncology/Paraganglioma

Overview

 * Paragangliomas are still sometimes called glomus tumors (not to be confused with glomus tumors of the skin) and chemodectomas, but paraganglioma is the currently accepted and preferred term
 * A rare neoplasm that can be found in the abdomen (85%), thorax (12%), and in the head and neck region (3%)
 * Incidence estimated at 1:1,000,000
 * Categorized as a neuroendocrine tumor
 * Usually considered benign and complete surgical removal results in cure. However, in about 3-5% of cases they are malignant and have the ability to metastasize.
 * Most occur as single tumors. When they occur in multiple sites they are usually found as a part of a heritable syndrome such as MEN types II-A and II-B and Carney syndrome.

Inheritance

 * Familial paragangliomas account for ~25% of cases, are often multiple and bilateral, and occur at an earlier age.
 * Mutations of the genes SDHD (previously known as PGL1), PGL2, and SDHC (previously PGL3) have been identified as causing familial head and neck paragangliomas.
 * Mutations of SDHB play an important role in familial adrenal pheochromocytoma and extra-adrenal paraganglioma (of abdomen and thorax), although there is considerable overlap in the types of tumors associated with SDHB and SDHD gene mutations.

Pathology

 * Arise from the glomus cells, which are special chemoreceptors located along blood vessels that have a role in regulating blood pressure and blood flow.
 * The glomus cells are a part of the paraganglion system, composed of the extra-adrenal paraganglia of the autonomic nervous system, derived from the embryonic neural crest. Thus, paragangliomas are a type of neuroendocrine tumor, and are closely related to pheochromocytomas.  Although all paragangliomas contain neurosecretory granules, only about 1-3% have clinical evidence of oversecretion.
 * According to the WHO classification of neuroendocrine tumors, paragangliomas are classified as having a neural cell line of origin. In the categorization proposed by Wick, the paragangliomas belong to Group II.
 * The main concentration of glomus cells are found are in the carotid body and the aortic bodies
 * Individual tumor cells are polygonal to oval and are arranged in distinctive cell balls, called Zellballen. These cell balls are separated by fibrovascular stroma and surrounded by sustentacular cells.
 * The paragangliomas appear grossly as sharply circumscribed polypoid masses and they have a firm to rubbery consistency. They are highly vascular tumors and may have a deep red color.
 * With IHC, the chief cells located in the cell balls are positive for chromogranin, synaptophysin, NSE, serotonin and neurofilamen; they are S-100 negative. The sustentacular cells are S-100 positive and focally positive for GFAP.  By histochemistry, the paraganglioma cells are argyrophilic, PAS negative, mucicarmine negative, and argentaffin negative.

Clinical characteristics
Paragangiomas are described by their site of origin and are often given special names:

 * Carotid paraganglioma (carotid body tumor): Is the most common of the head and neck paragangliomas. It usually presents as a painless neck mass, but larger tumors may cause cranial nerve palsies, usually of the vagus nerve and hypoglossal nerve.

 * Glomus tympanicum and Glomus jugulare: Both commonly present as a middle ear mass resulting in tinnitus (in 80%) and hearing loss (in 60%). The cranial nerves of the jugular foramen may be compressed, resulting swallowing difficulty.

 * Vagal paragangliomas: These are the least common of the head and neck paragangliomas. They usually present as a painless neck mass, but may result in dysphagia and hoarseness.

 * Other sites: Rare sites of involvement are the larynx, nasal cavity, paranasal sinuses, thyroid gland, and the thoracic inlet.

Treatment

 * The main treatment modalities are surgery, embolization and radiotherapy.
 * When radiation is given, doses are in the range of 45-50 Gy.
 * For stereotactic radiosurgery, median margin dose (50% isodose) used is ~16 Gy

Overview

 * Typically considered slow-growing (estimated doubling time 4.2 years) benign tumors, <5% malignant potential
 * However, they are locally agressive neoplastic lesions, involving bony erosion and destruction of neurovascular structures
 * Commonly arise from the paraganglia of the jugular bulb
 * Typically invade the tympanic cavity and jugular foramen
 * Can extensively invade petroclival region
 * Can invade cavernous sinus above
 * Can invade hypoglossal canal below
 * Clinical presentation typically with tinnitus or hearing loss, but may also impact jugular foramen CNs
 * Glasscock-Jackson Classification:
 * Fisch Classification:

 * Optimal treatment strategy is not clear, with multiple options:
 * Surgery: primary option if brainstem compression, or in patients under 45 years old with functional cranial nerve loss. Surgical morbidity not insignificant, typically with additional cranial nerve sacrifice.
 * Fractionated RT: typical doses 45-55 Gy, mechanism of action likely related to fibrosis of feeding vessels and not direct glomus cell destruction. Complication rate low. Critical to avoid nearby cranial nerves or blood vessels.
 * SRS: No long-term experience yet, but appears a good option due to high conformality. RT dose typically ~16 Gy at 50% margin isodose. Typically ~1/3 have volume shrinkage, and ~2/3 no change, <10% further growth. Clinically ~50% may experience improvement
 * Embolization: typically considered an adjunctive treatment to surgery or RT. Not adequate alone due to poor tumor coverage and frequent re-vascularization

Stereotactic Radiosurgery

 * UT Southwestern, 2014 (2007-2013) PMID 24818638 -- "A Retrospective Analysis of Tumor Volumetric Responses to Five-Fraction Stereotactic Radiotherapy for Paragangliomas of the Head and Neck (Glomus Tumors)." (Chun SG, Stereotact Funct Neurosurg. 2014 May;92(3):153-9)
 * Retrospective. CyberKnife radiotherapy. 31 patients (23 definitive, 8 recurrence post surgery. Average volume 10 cm3, prescription dose 25 Gy in 5 fractions. Median F/U 2 years
 * Outcome: Local control and overall survival 100%, significant tumor volume reduction in patients with >2 years F/U of 37% (p < 0.05), tinnitus improved in 12 patients of whom 6 had resolution
 * Toxicity: Grade 1 toxicity 16%, one patient had Grade 2 headache requiring steroids, no progressive cranial nerve deficit
 * Conclusion: 5 fraction CyberKnife SRS of skull based paragangliomas can be considered as a safe and effective option

 * Verona, 2006 (Italy)(1996-2005) PMID 16955038 -- "Glomus jugulare tumors: the option of gamma knife radiosurgery." (Gerosa M, Neurosurgery. 2006 Sep;59(3):561-9; discussion 561-9.)
 * Retrospective. 20 patients (3 primary GKS, 8 recurrence post surgery, 11 recurrence after embolization). Average volume 7 cm3, mean marginal dose 17.3 Gy (13-24). Estimated doubling 4.2 years. Mean F/U 4.2 years
 * Outcome: Improved volume 40%, no change 55%
 * Toxicity: Improved CN function 25%, no neuro change 65%, hearing loss 10%
 * Conclusion: GKS effective, negligible side effects

 * Virginia, 2005 PMID 15662818 -- "Gamma knife surgery for glomus jugulare tumors: an intermediate report on efficacy and safety." (Sheehan J, J Neurosurg. 2005 Jan;102 Suppl:241-6.)
 * Retrospective. 8 patients. Median margin dose 15 Gy (12-18). Median F/U 2.7 years
 * Outcome: clinically 100% stability or improvement; radiographically 4/7 decreased, 3/7 stable
 * Toxicity: None
 * Conclusion: Effective local control and preservation of neurologic function

 * Mayo Clinic, 2004 PMID 15329025 -- "Stereotactic radiosurgery in patients with glomus jugulare tumors." (Pollock BE, Neurosurg Focus. 2004 Aug 15;17(2):E10.)
 * Retrospective. 42 patients treated with GKS. Mean volume 13.2 cm3. Mean margin dose 14.9 Gy. Mean F/U 3.7 years
 * Outcome: 31% decreased, 67% unchanged, 2% grew. PFS at 7 years 100%, at 10 years 75%
 * Toxicity: 15% new deficit (hearing loss, facial numbness, vocal cord paralysis, vertigo). Hearing preservation 81% at 4 years
 * Conclusion: GKS good tumor control, safe

 * Stanford, 2004 PMID 15329026 -- "Efficacy and safety of stereotactic radiosurgery for glomus jugulare tumors." (Lim M, Neurosurg Focus. 2004 Aug 15;17(2):E11.)
 * Retrospective. 13 patients with 16 tumors. Treated with LINAC/Cyberknife to 14-27 Gy. Median F/U 3.4 years
 * Outcome: clinically 100% stable; radiographically 100% decreased or stable
 * Toxicity: one transient ipsilateral vocal cord paralysis (however, patient also had prior EBRT)
 * Conclusion: RS effective and safe

 * Vienna, 2001 (Austria)(1993-1999) PMID 11696882 -- "Efficiency of gamma knife radiosurgery in the treatment of glomus jugulare tumors." (Saringer W, Minim Invasive Neurosurg. 2001 Sep;44(3):141-6.)
 * Retrospective. 12 patients. All Fisch Class D. Mean F/U 4.2 years
 * Outcome: clinically 50% improved, 50% no change; radiographically decreased 25%, stable 75%
 * Toxicity: transient cranial neuropathy in 17%.
 * Conclusion: GKS attractive treatment option

 * European Multicenter, 1999 (1992-1998) PMID 10592113 -- "Gamma Knife radiosurgery of the glomus jugulare tumour - early multicentre experience." (Liscak R, Acta Neurochir (Wien). 1999;141(11):1141-6.)
 * Retrospective. 6 sites, 52/66 patients. Median margin dose 16.5 Gy (10-30). Median F/U 2 years
 * Outcome: clinically 29% improved, 65% stable; radiographically decreased 40%, stable 60%
 * Conclusion: safe, with no acute morbidity; need longer follow-up

 * Graz, 1999 (Austria)(1992-1998) PMID 10536716 -- "Gamma knife radiosurgery for glomus jugulare tumours." (Eustacchio S, Acta Neurochir (Wien). 1999;141(8):811-8.)
 * Retrospective. 10/13 patients with imaging followup. Median marginal dose 13.5 Gy to 50% isodose line. Median F/U 3.1 years
 * Outcome: 40% decreased volume, 60% unchanged. Improved clinical status in 50%, stable in 50%
 * Toxicity: none
 * Conclusion: effective treatment option

 * Prague, 1998 (Czech Republic)(1993-1997) PMID 9782246 -- "Leksell gamma knife radiosurgery of the tumor glomus jugulare and tympanicum." (Liscak R, Stereotact Funct Neurosurg. 1998 Oct;70 Suppl 1:152-60.)
 * Retrospective. 14 patients. Mean maximum dose 37.4 Gy (20-44); mean margin dose 19.4 Gy (10-25). Mean F/U 1.7 years
 * Outcome: radiographically 30% improved, 70% stable; clinically 36% improved
 * Toxicity: worsening hearing in 21%
 * Conclusion: GKS safe treatment; will need long follow-up

Surgery vs. SRS

 * Meta-analysis, 2004 (1994-2004) PMID 15329019 -- "Comparison of radiosurgery and conventional surgery for the treatment of glomus jugulare tumors." (Gottfried ON, Neurosurg Focus. 2004 Aug 15;17(2):E4.)
 * 7 surgical series 374 patients, 8 GKS series 142 patients. Mean F/U surgery 4.1 years, GKS 3.3 years
 * Outcome: local control surgery 92%, recurrence 3%; GKS decrease 36%, stable 61%, recurrence 2%
 * Toxicity: surgery CSF leak 8%, mortality 1.3%; GKS morbidity 8%, no mortality
 * Conclusion: Both treatments safe and efficacious; surgery higher morbidity but long term GKS outcomes unknown

title: Radiation Oncology/Paraganglioma


text:
Radiation Oncology/Neuroendocrine

Neuroendocrine tumor overview on Wikipedia

Summary of human GEP-NETs by site of origin and by symptom

 * The endocrine system is a communication system in which hormones act as biochemical messengers to regulate physiological events in living organisms. The nervous system performs the same functions using electrical impulses as messengers. The neuroendocrine system is the combination of those two systems, or more specifically, the various interfaces between the two systems. A GEP-NET is a tumor of any such interface.

 * Carcinoids (about two thirds of GEP-NETs)
 * with carcinoid syndrome (about 10 percent of carcinoids)
 * without carcinoid syndrome (about 90 percent of carcinoids)
 * Pancreatic endocrine tumors (about one third of GEP-NETs)
 * Nonfunctioning (15 to 30 percent of PETs)
 * Functioning (70 to 85 percent of PETs)
 * Gastrinoma - producing excessive gastrin and causing Zollinger-Ellison Syndrome (ZES)
 * Insulinoma - producing excessive insulin
 * Glucagonoma - producing excessive glucagon
 * VIPoma - producing excessive vasoactive intestinal peptide (VIP)
 * PPoma, producing excessive pancreatic polypeptide
 * Somatostatinoma - producing excessive somatostatin
 * CRHoma - producing excessive corticotropin-releasing hormones (CRH)
 * Calcitoninoma - producing excessive calcitonin
 * GHRHoma - producing excessive growth-hormone-releasing hormone (GHRH)
 * Neurotensinoma - producing excessive neurotensin
 * ACTHoma - producing excessive adrenocorticotropic hormone (ACTH)
 * GhRFoma - producing excessive growth-hormone release factor (GRF)
 * Parathyroid hormone–related peptide tumor
 * Other NETs
 * Medullary carcinoma of the thyroid
 * Merkel cell cancer
 * Small-cell lung cancer
 * Large-cell neuroendocrine carcinoma of the lung
 * Extrapulmonary high grade neuroendocrine tumors
 * Neuroendocrine carcinoma of the cervix
 * Multiple Endocrine Neoplasia type 1 (MEN-1)
 * Multiple Endocrine Neoplasia type 2 (MEN-2)
 * Neurofibromatosis type 1
 * Tuberous sclerosis
 * Von Hippel-Lindau (VHL) disease
 * Neuroblastoma
 * Pheochromocytoma
 * Paraganglioma
 * Neuroendocrine tumor of the anterior pituitary
 * Carney's complex

Topics

 * Overview

External resources

 * NANETS - North American Neuroendocrine Tumor Society

title: Radiation Oncology/Neuroendocrine


text:
Radiation Oncology/Sarcoma/Angiomyxoma

Angiomyxoma

 * Usually of the pelvic soft tissue and perineum, almost always in women. In men, the scrotum
 * Locally aggressive but don't metastasize
 * Treatment overview
 * Treated by wide local excision
 * Can also treat with GnRH agonists if ER+/PR+ — used as adjuvant treatment for recurrent tumors or as primary therapy for small tumors

title: Radiation Oncology/Sarcoma/Angiomyxoma


text:
Talk:Korean/Essential Pronunciation Rules

Aspirated versus unvoiced
In the Korean dialect spoken by a native friend of mine (and according to literature such as this), ㄱ, ㄷ, ㅈ, and ㅂ in initial position do not become aspirated at all. They just become unvoiced. I'm editing the text to reflect that. If they are spoken with aspiration, they sound like ㅋ, ㅌ, ㅊ, and ㅍ. If somebody disagrees, let's discuss. Rodasmith 04:39, 12 May 2007 (UTC)
 * They are devoiced, but sometimes they have weak aspiration as well. (If you're not a trained phoneticist, you might not notice this, especially if you're a native speaker of Korean.) Nevertheless, I think your edit was in the right direction. --Kjoonlee 04:10, 29 November 2008 (UTC)

 * Korean speakers distinguish by tone contour, where the first syllable is a lower tone in words beginning with ㄱ, ㄷ, ㅈ, and ㅂ. Doubled consonants receive a higher tone, while the aspirated series is flat. Otherwise, it would be very difficult to be able to tell ㄱ from ㄲ in the beginning of a word. -Iopq (discuss • contribs) 10:55, 21 May 2018 (UTC)

Vowels
I don't get it. There's nothing here but consonants; same with the advanced section.JohndanR (discuss • contribs) 05:01, 7 March 2015 (UTC)

 * That's because they're pronounced mostly the same way. -Iopq (discuss • contribs) 10:56, 21 May 2018 (UTC)


text:
Karrigell/Set Content-type header

To set response headers, use the built-in RESPONSE dictionary

RESPONSE['Content-type'] = "text/plain" print "content type is set to text/plain"

title: Karrigell/Set Content-type header


text:
User talk:24.80.23.43

--AdRiley 06:51, 12 May 2007 (UTC)

title: User talk:24.80.23.43


text:
User talk:124.190.48.34

--AdRiley 06:55, 12 May 2007 (UTC)

title: User talk:124.190.48.34


text:
User talk:208.76.92.2

--AdRiley 07:02, 12 May 2007 (UTC)

title: User talk:208.76.92.2


text:
Talk:Java Programming/API/java.lang.String

= Compare Strings = You can use == to compare equality of string references. It might be a good idea to explain the String Pool and limitation of using only ==, and then what the differences are between equals and compareTo. The main one being that equals will first do == to see if the string references are equivalent as this is extremely fast (compareTo probably does this to?), and if this fails, will then go on to do a lexical comparison, which is slow. Matt Oates
 * Yes, someone please write an explanation, why I shouldn't just use == whenever I feel like it. CannibalSmith 12:04, 11 June 2007 (UTC)
 * Well, "It is not really neccessary for a Java programmer to know byte code." - Strings are an exception. Strings are "==" if they are the same Reference. The Java Compiler will merge all optimize the constant pool and as a result all String literals with the same content will be merged into one constant pool entry. Newer versions of the JVM merge all constant String instances, so "Hello World" from class A is the same reference as "Hello World" from class B. BUT you can't use this magic if your Strings are created on the fly - e.g. by io/deserialisation or any kind of string manipulation. Let's see the Code

public class StringTest {

public static String myString = "Hello World"; public static class A { public final static String myString = "Hello World"; }	public static class B { public final static String myString = "Hello World"; }	public static void main(String[] args) { // Same class, same constant pool if (myString == "Hello World") { System.out.println("References in the same class match"); }		// Different classes, runtime string pool if (A.myString == B.myString) { System.out.println("References across classes match"); }		// Manipulated Strings <-> No string pool String v = "Hello ".concat("World"); if (v != myString) { System.out.println(v); System.out.println(myString); System.out.println("--> See the difference - equals=" + v.equals(myString)); }	} }
 * Output on sun java 1.6.0_06-b02 for linux (other implementations can differ)

References in the same class match References across classes match Hello World Hello World --> See the difference - equals=true
 * You can use javap to see what's going on

$ javap -c StringTest Compiled from "StringTest.java" public class StringTest extends java.lang.Object{ public static java.lang.String myString; static {}; Code: 0:  ldc     #10; //String Hello World 2:  putstatic       #12; //Field myString:Ljava/lang/String; 5:  return public de.rtjava.test.StringTest; Code: 0:  aload_0 1:  invokespecial   #17; //Method java/lang/Object." ":V 4:  return public static void main(java.lang.String[]); Code: 0:  getstatic       #12; //Field myString:Ljava/lang/String; 3:  ldc     #10; //String Hello World 5:  if_acmpne       16 8:  getstatic       #23; //Field java/lang/System.out:Ljava/io/PrintStream; 11: ldc     #29; //String References in the same class match 13: invokevirtual   #31; //Method java/io/PrintStream.println:(Ljava/lang/String;)V 16: getstatic       #23; //Field java/lang/System.out:Ljava/io/PrintStream; 19: ldc     #37; //String References across classes match 21: invokevirtual   #31; //Method java/io/PrintStream.println:(Ljava/lang/String;)V 24: ldc     #39; //String Hello 26: ldc     #41; //String World 28: invokevirtual   #43; //Method java/lang/String.concat:(Ljava/lang/String;)Ljava/lang/String; 31: astore_1 32: aload_1 33: getstatic       #12; //Field myString:Ljava/lang/String; 36: if_acmpeq       63 39: getstatic       #23; //Field java/lang/System.out:Ljava/io/PrintStream; 42: aload_1 43: invokevirtual   #31; //Method java/io/PrintStream.println:(Ljava/lang/String;)V 46: getstatic       #23; //Field java/lang/System.out:Ljava/io/PrintStream; 49: getstatic       #12; //Field myString:Ljava/lang/String; 52: invokevirtual   #31; //Method java/io/PrintStream.println:(Ljava/lang/String;)V 55: getstatic       #23; //Field java/lang/System.out:Ljava/io/PrintStream; 58: ldc     #49; //String --> See the difference 60: invokevirtual   #31; //Method java/io/PrintStream.println:(Ljava/lang/String;)V 63: return }
 * As you can see the first comparison used the same constant pool entry. The strings in A and B are merged during class loading/initialisation. But the created String can't match as it is a different string instance with the same content. Not sure how this can be presented without a long paragraph about the java bytecode and the jvm.... Also note that merging across classes and merging the constant pool are optional features, so none of the == compares is guaranteed to work. I'm damn sure that merging between classes wasn't a feature from the beginning. Hope this clarifies the confusion. Understanding the byte format, the compiler and the jvm helps a lot. Especially when it comes to Strings (jvm+bytecode), Generics (compiler, bytecode), Autoboxing (compiler) etc. The rule for == is simple: If you don't intend to check for the same reference - don't use it. Every "equals" implementation should start with "if (this == o) {return true}". This is a requirement for java.util. Collections may break if a.equals(b) == false while a == b.

Strings Cannot Be Garbage Collected?
I believe this statement on the page is incorrect:

"Remember that no String objects are ever eligible for garbage collection. Once a String is created, it takes up memory until the JVM terminates."

Yes, Strings are immutable objects.

Yes, literal strings, and strings created at compile time via constant expressions, are interned, and interned Strings won't be garbage collected.

But... not all Strings are interned!

And why shouldn't a non-interned String be eligible for garbage collection? If there are no references to it, it should be able to be garbage collected... and if it's not interned, then it certainly can be the case that nothing else points to it anymore.

In short: I'm pretty sure the statement is incorrect.

I'd really like to see some sort of reference, from Sun's website, or the JLS, indicating why Strings are *never* garbage collected. Otherwise, the statement should be replaced with something more accurate.

The code example is still valid; it does create a large number of temporary String objects that get thrown away quickly, and that does create a performance issue, mitigated a bit by generational garbage collection (since the temporary Strings don't live very long). But I don't believe it counts as a memory leak.

For more information, see:

http://java.sun.com/developer/TechTips/1999/tt0114.html

http://java.sun.com/docs/books/jls/third_edition/html/j3TOC.html

SarahAnnAlien

 * You are right about that the String objects are garbage collected. I made the change, see the page. Thanks.

Ervinn (talk) 18:32, 16 April 2008 (UTC)


text:
Horticulture/Udea rubigalis

Udea rubigalis is a pest insect of greenhouses, field crops, and landscape ornamentals, native to North America. They can cause heavy damage, particularly to greenhouse plants.

Description
Larvae (caterpillars) are yellow to green, with a white stripe on the back. Older caterpillars create webbing which ties leaves together for protection.

Adult is a small brown moth (wingspan about 3/4 inch).

Symptoms and Signs
Tied leaves, heavy feeding damage.

Ecology
White eggs are laid on the leaves. Complete life cycle takes about 40 days.

Host plants

 * ../Ambrosia/ (Ragweeds)
 * ../Anemone/
 * ../Antirrhinum/ (Snapdragon)
 * ../Begonia/
 * ../Beta/ (Beets)
 * ../Calendula/ (Pot Marigold)
 * ../Camellia/
 * ../Canna/
 * ../Chrysanthemum/
 * ../Cirsium/ (Thistle)
 * ../Coleus/
 * ../Daucus/ (Carrot)
 * ../Dianthus/ (Carnation)
 * ../Glechoma/ (Ground Ivy)
 * ../Lactuca/ (Lettuce)
 * ../Lathyrus/ (Sweet Pea)
 * ../Pelargonium/
 * ../Pericallis/
 * ../Rhododendron/ (Azalea)
 * ../Rosa/ (Rose)
 * ../Petroselenium/ (Celery)
 * ../Petunia/
 * ../Phaseolus/ (Beans)
 * ../Salvia/ (Sage)
 * ../Spinacia/ (Spinach)
 * ../Viola/ (Violets)

title: Horticulture/Udea rubigalis