--- /dev/null
+++ b/docsrc/Makefile
@@ -0,0 +1,45 @@
+
+.SUFFIXES: .fig .eps .png
+
+FIGS=\
+	dsc-arch.eps \
+	screenshot1.eps
+
+DOC=dsc-manual
+
+$(DOC).pdf: $(DOC).ps
+	ps2pdf $(DOC).ps > $@
+
+$(DOC).ps: $(DOC).dvi
+	dvips $(DOC).dvi > $@
+
+$(DOC).dvi: $(DOC).tex $(FIGS)
+	latex $(DOC).tex
+	latex $(DOC).tex
+	latex $(DOC).tex
+
+.fig.eps:
+	fig2dev -L eps $< > $@
+
+.png.eps:
+	pngtopnm $< | pnmtops -noturn > $@
+	
+
+all: $(DOC).ps $(DOC).pdf
+
+clean-junk:
+	rm -f $(FIGS)
+	rm -f $(DOC).aux
+	rm -f $(DOC).dvi
+	rm -f $(DOC).log
+	rm -f $(DOC).toc
+
+clean: clean-junk
+	rm -f $(DOC).pdf
+	rm -f $(DOC).ps
+
+clean-release: clean-junk
+	rm -f $(DOC).tex
+	rm -f dsc-arch.fig
+	rm -f screenshot1.png
+	rm -f Makefile
--- /dev/null
+++ b/docsrc/dsc-arch.fig
@@ -0,0 +1,231 @@
+#FIG 3.2
+Landscape
+Center
+Inches
+Letter  
+100.00
+Single
+-2
+1200 2
+0 32 #c6b797
+0 33 #eff8ff
+0 34 #dccba6
+0 35 #404040
+0 36 #808080
+0 37 #c0c0c0
+0 38 #e0e0e0
+0 39 #8e8f8e
+0 40 #aaaaaa
+0 41 #555555
+0 42 #8e8e8e
+0 43 #d7d7d7
+0 44 #aeaeae
+0 45 #bebebe
+0 46 #515151
+0 47 #e7e3e7
+0 48 #000049
+0 49 #797979
+0 50 #303430
+0 51 #414141
+0 52 #c7b696
+0 53 #414541
+0 54 #868286
+0 55 #c7c3c7
+0 56 #444444
+0 57 #868686
+0 58 #c7c7c7
+0 59 #e7e7e7
+0 60 #f7f7f7
+0 61 #9e9e9e
+0 62 #717571
+0 63 #757575
+0 64 #effbff
+0 65 #f3f3f3
+0 66 #d7d3d7
+0 67 #aeaaae
+0 68 #c2c2c2
+0 69 #303030
+0 70 #515551
+0 71 #f7f3f7
+0 72 #666666
+0 73 #717171
+0 74 #636363
+0 75 #cdcdcd
+0 76 #6c6c6c
+0 77 #c9c9c9
+0 78 #dfd8df
+0 79 #6e6e6e
+0 80 #333333
+0 81 #949395
+0 82 #747075
+0 83 #b3b3b3
+0 84 #c3c3c3
+0 85 #6d6d6d
+0 86 #454545
+0 87 #9c0000
+0 88 #8c8c8c
+0 89 #424242
+0 90 #8c8c8c
+0 91 #424242
+0 92 #8c8c8c
+0 93 #424242
+0 94 #8c8c8c
+0 95 #424242
+0 96 #8c8c8c
+0 97 #424242
+0 98 #8c8c8c
+0 99 #424242
+0 100 #e2e2ee
+0 101 #94949a
+0 102 #dbdbdb
+0 103 #a1a1b7
+0 104 #ededed
+0 105 #86acff
+0 106 #7070ff
+0 107 #dd9d93
+0 108 #f1ece0
+0 109 #e2c8a8
+0 110 #e1e1e1
+0 111 #d2d2d2
+0 112 #da7a1a
+0 113 #f1e41a
+0 114 #887dc2
+0 115 #d6d6d6
+0 116 #8c8ca5
+0 117 #4a4a4a
+0 118 #8c6b6b
+0 119 #5a5a5a
+0 120 #b79b73
+0 121 #4193ff
+0 122 #bf703b
+0 123 #db7700
+0 124 #dab800
+0 125 #006400
+0 126 #5a6b3b
+0 127 #d3d3d3
+0 128 #8e8ea4
+0 129 #f3b95d
+0 130 #89996b
+0 131 #646464
+0 132 #b7e6ff
+0 133 #86c0ec
+0 134 #bdbdbd
+0 135 #d39552
+0 136 #98d2fe
+0 137 #8c9c6b
+0 138 #f76b00
+0 139 #5a6b39
+0 140 #8c9c6b
+0 141 #8c9c7b
+0 142 #184a18
+0 143 #adadad
+0 144 #f7bd5a
+0 145 #636b9c
+0 146 #de0000
+0 147 #adadad
+0 148 #f7bd5a
+0 149 #adadad
+0 150 #f7bd5a
+0 151 #636b9c
+0 152 #526b29
+0 153 #949494
+0 154 #006300
+0 155 #00634a
+0 156 #7b844a
+0 157 #e7bd7b
+0 158 #a5b5c6
+0 159 #6b6b94
+0 160 #846b6b
+0 161 #529c4a
+0 162 #d6e7e7
+0 163 #526363
+0 164 #186b4a
+0 165 #9ca5b5
+0 166 #ff9400
+0 167 #ff9400
+0 168 #00634a
+0 169 #7b844a
+0 170 #63737b
+0 171 #e7bd7b
+0 172 #184a18
+0 173 #f7bd5a
+0 174 #dedede
+0 175 #f3eed3
+0 176 #f5ae5d
+0 177 #95ce99
+0 178 #b5157d
+0 179 #eeeeee
+0 180 #848484
+0 181 #7b7b7b
+0 182 #005a00
+0 183 #e77373
+0 184 #ffcb31
+0 185 #29794a
+0 186 #de2821
+0 187 #2159c6
+0 188 #f8f8f8
+0 189 #e6e6e6
+0 190 #21845a
+6 5700 3825 6300 4200
+4 0 0 51 -1 0 12 0.0000 4 135 555 5700 3975 HTTPS\001
+4 0 0 51 -1 0 12 0.0000 4 135 435 5700 4200 PUTs\001
+-6
+6 4725 5400 6075 6394
+2 2 0 1 0 7 0 0 -1 0.000 0 0 -1 0 0 5
+	 4729 5404 6071 5404 6071 6388 4729 6388 4729 5404
+2 2 0 1 0 7 100 0 15 0.000 0 0 -1 0 0 5
+	 4729 5404 6071 5404 6071 5493 4729 5493 4729 5404
+-6
+6 2625 5100 3600 6600
+5 1 0 1 -1 -1 0 0 -1 0.000 0 1 0 0 3090.000 4875.000 2640 5475 3090 5625 3540 5475
+5 1 0 1 -1 -1 0 0 -1 0.000 0 1 0 0 3090.000 5775.000 2640 6375 3090 6525 3540 6375
+1 2 0 1 -1 -1 0 0 -1 0.000 1 0.0000 3090 5325 450 150 2640 5175 3540 5475
+2 1 0 1 -1 -1 0 0 -1 0.000 0 0 0 0 0 2
+	 3540 5400 3540 6375
+2 1 0 1 -1 -1 0 0 -1 0.000 0 0 0 0 0 2
+	 2640 5400 2640 6375
+-6
+1 3 0 1 0 7 50 -1 20 0.000 1 0.0000 4875 2475 424 424 4875 2475 5175 2775
+1 3 0 1 0 7 50 -1 20 0.000 1 0.0000 5775 2475 424 424 5775 2475 6075 2775
+1 3 0 1 0 7 50 -1 20 0.000 1 0.0000 6675 2475 424 424 6675 2475 6975 2775
+1 3 0 1 0 7 50 -1 20 0.000 1 0.0000 1950 2250 424 424 1950 2250 2250 2550
+1 3 0 1 0 7 50 -1 20 0.000 1 0.0000 2850 2250 424 424 2850 2250 3150 2550
+1 3 0 1 0 7 50 -1 20 0.000 1 0.0000 1050 2250 424 424 1050 2250 1350 2550
+2 4 0 1 0 7 50 -1 -1 0.000 0 0 7 0 0 5
+	 7350 3150 7350 1725 4200 1725 4200 3150 7350 3150
+2 1 0 1 0 7 51 -1 -1 0.000 0 0 -1 1 0 2
+	0 0 1.00 60.00 120.00
+	 1950 2250 3600 4950
+2 1 0 1 0 7 51 -1 -1 0.000 0 0 -1 1 0 2
+	0 0 1.00 60.00 120.00
+	 2850 2250 3600 4950
+2 1 0 1 0 7 51 -1 20 0.000 0 0 -1 1 0 2
+	0 0 1.00 60.00 120.00
+	 4875 2475 4500 4950
+2 1 0 1 0 7 51 -1 20 0.000 0 0 -1 1 0 2
+	0 0 1.00 60.00 120.00
+	 5775 2475 4500 4950
+2 1 0 1 0 7 51 -1 20 0.000 0 0 -1 1 0 2
+	0 0 1.00 60.00 120.00
+	 6675 2475 4500 4950
+2 2 0 1 0 7 50 -1 -1 0.000 0 0 -1 0 0 5
+	 1725 4950 6900 4950 6900 7200 1725 7200 1725 4950
+2 4 0 1 0 7 50 -1 -1 0.000 0 0 7 0 0 5
+	 3525 2925 3525 1500 375 1500 375 2925 3525 2925
+2 1 0 1 0 7 51 -1 -1 0.000 0 0 -1 1 0 2
+	0 0 1.00 60.00 120.00
+	 1050 2250 3600 4950
+4 1 0 50 -1 0 12 0.0000 4 135 450 6675 2550 node3\001
+4 1 0 50 -1 0 12 0.0000 4 135 450 4875 2550 node1\001
+4 1 0 50 -1 0 12 0.0000 4 135 810 5775 1950 SERVER2\001
+4 1 0 50 -1 0 12 0.0000 4 135 450 5775 2550 node2\001
+4 1 0 50 -1 0 12 0.0000 4 135 780 3900 1275 Collectors\001
+4 1 0 50 -1 0 12 0.0000 4 135 855 3075 6825 STORAGE\001
+4 1 0 50 -1 0 12 0.0000 4 135 780 5400 6825 DISPLAY\001
+4 1 0 50 -1 0 12 0.0000 4 180 840 3075 6975 (extractor)\001
+4 1 0 50 -1 0 12 0.0000 4 180 720 5400 6975 (grapher)\001
+4 1 0 50 -1 0 12 0.0000 4 135 735 1125 6225 Presenter\001
+4 1 0 49 -1 0 12 0.0000 4 135 450 2850 2325 node3\001
+4 1 0 50 -1 0 12 0.0000 4 135 810 1950 1725 SERVER1\001
+4 1 0 49 -1 0 12 0.0000 4 135 450 1050 2325 node1\001
+4 1 0 49 -1 0 12 0.0000 4 135 450 1950 2325 node2\001
--- /dev/null
+++ b/docsrc/dsc-manual.tex
@@ -0,0 +1,1810 @@
+\documentclass{report}
+\usepackage{epsfig}
+\usepackage{path}
+\usepackage{fancyvrb}
+
+\def\dsc{{\sc dsc}}
+
+\DefineVerbatimEnvironment%
+  {MyVerbatim}{Verbatim}
+  {frame=lines,framerule=0.8mm,fontsize=\small}
+
+\renewcommand{\abstractname}{}
+
+\begin{document}
+
+\begin{titlepage}
+\title{DSC Manual}
+\author{Duane Wessels, Measurement Factory\\
+Ken Keys, CAIDA\\
+\\
+http://dns.measurement-factory.com/tools/dsc/}
+\date{\today}
+\end{titlepage}
+
+\maketitle
+
+\begin{abstract}
+\setlength{\parskip}{1ex}
+\section{Copyright}
+
+The DNS Statistics Collector (dsc)
+
+Copyright 2007 by The Measurement Factory, Inc. and Internet Systems
+Consortium, Inc.
+
+{\em info@measurement-factory.com\/}, {\em info@isc.org\/}
+
+\section{License}
+
+{\dsc} is licensed under the terms of the BSD license:
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+
+Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+Redistributions in binary form must reproduce the above copyright
+notice, this list of conditions and the following disclaimer in the
+documentation and/or other materials provided with the distribution.
+Neither the name of The Measurement Factory nor the names of its
+contributors may be used to endorse or promote products derived
+from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
+ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGE.
+
+\section{Contributors}
+\begin{itemize}
+\item Duane Wessels, Measurement Factory
+\item Ken Keys, Cooperative Association for Internet Data Analysis
+\end{itemize}
+\end{abstract}
+
+
+\tableofcontents
+
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+\chapter{Introduction}
+
+{\dsc} is a system for collecting and presenting statistics from
+a busy DNS server.  
+
+\section{Components}
+
+{\dsc} consists of the following components:
+\begin{itemize}
+\item A data collector
+\item A data presenter, where data is archived and rendered
+\item A method for securely transferring data from the collector
+	to the presenter
+\item Utilities and scripts that parse XML and archive files from the collector
+\item Utilities and scripts that generate graphs and HTML pages
+\end{itemize}
+
+\subsection{The Collector}
+
+The collector is a binary program, named {\tt dsc\/}, which snoops
+on DNS messages.  It is written in C and uses {\em libpcap\/} for
+packet capture.
+
+{\tt dsc\/} uses a relatively simple configuration file called {\em
+dsc.conf\/} to define certain parameters and options.  The configuration
+file also determines the {\em datasets\/} that {\tt dsc\/} collects.
+
+A Dataset is a 2-D array of counters of IP/DNS message properties.
+You can define each dimension of the array independently.  For
+example you might define a dataset categorized by DNS query type
+along one dimension and TLD along the other.
+{\tt dsc\/} dumps the datasets from memory to XML files every 60 seconds.
+
+\subsection{XML Data Transfer}
+
+You may run the {\dsc} collector on a remote machine.  That
+is, the collector may run on a different machine than where the
+data is archived and displayed.  {\dsc} includes some Perl and {\tt /bin/sh}
+scripts to move XML files from collector to presenter.  One
+technique uses X.509 certificates and a secure HTTP server.  The other
+uses {\em rsync\/}, presumably over {\em ssh\/}.
+
+\subsubsection{X.509/SSL}
+
+To make this work, Apache/mod\_ssl should run on the machine where data
+is archived and presented.
+Data transfer is authenticated via SSL X.509 certificates.  A Perl
+CGI script handles all PUT requests on the server.  If the client
+certificate is allowed, XML files are stored in the appropriate
+directory.
+
+A shell script runs on the collector to upload the XML files.  It
+uses {\tt curl\/}\footnote{http://curl.haxx.se} to establish an
+HTTPS connection.  XML files are bundled together with {\tt tar\/}
+before transfer to eliminate per-connection delays.
+You could use {\tt scp\/} or {\tt rsync\/} instead of
+{\tt curl\/} if you like.
+
+\path|put-file.pl| is the script that accepts PUT requests on the
+HTTP server.  The HTTP server validates the client's X.509 certificate.
+If the certificate is invalid, the PUT request is denied.  This
+script reads environment variables to get X.509 parameters.  The
+uploaded-data is stored in a directory based on the X.509 Organizational
+Unit (server) and Common Name fields (node).
+
+\subsubsection{rsync/ssh}
+
+This technique uses the {\em rsync\/} utility to transfer files.
+You'll probably want to use {\em ssh\/} as the underlying transport,
+although you can still use the less-secure {\em rsh\/} or native
+rsync server transports if you like.
+
+If you use {\em ssh\/} then you'll need to create passphrase-less
+SSH keys so that the transfer can occur automatically.  You may
+want to create special {\em dsc\/} userids on both ends as well.
+
+\subsection{The Extractor}
+
+The XML extractor is a Perl script that reads the XML files from
+{\tt dsc\/}.  The extractor essentially converts the XML-structured
+data to a format that is easier (faster) for the graphing tools to
+parse.  Currently the extracted data files are line-based ASCII
+text files.  Support for SQL databases is planned for the future.
+
+\subsection{The Grapher}
+
+{\dsc} uses {\em Ploticus\/}\footnote{http://ploticus.sourceforge.net/}
+as the graphing engine.  A Perl module and CGI script read extracted
+data files and generate Ploticus scriptfiles to generate plots.  Plots
+are always generated on demand via the CGI application.
+
+\path|dsc-grapher.pl| is the script that displays graphs from the
+archived data.  
+
+
+\section{Architecture}
+
+Figure~\ref{fig-architecture} shows the {\dsc} architecture.  
+
+\begin{figure}
+\centerline{\psfig{figure=dsc-arch.eps,width=3.5in}}
+\caption{\label{fig-architecture}The {\dsc} architecture.}
+\end{figure}
+
+Note that {\dsc} utilizes the concept of {\em servers\/} and {\em
+nodes\/}.  A server is generally a logical service, which may
+actually consist of multiple nodes.  Figure~\ref{fig-architecture}
+shows six collectors (the circles) and two servers (the rounded
+rectangles).  For a real-world example, consider a DNS root server.
+IP Anycast allows a DNS root server to have geographically distributed
+nodes that share a single IP address.  We call each instance a 
+{\em node\/} and all nodes sharing the single IP address belong
+to the same {\em server\/}.
+
+The {\dsc} collector program runs on or near\footnote{by
+``near'' we mean that packets may be sniffed remotely via Ethernet taps, switch
+port mirroring, or a SPAN port.} the remote nodes.  Its XML output
+is transferred to the presentation machine via HTTPS PUTs (or something simpler
+if you prefer).
+
+The presentation machine includes an HTTP(S) server.  The extractor looks
+for XML files PUT there by the collectors.  A CGI script also runs on
+the HTTP server to display graphs and other information.
+
+
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+
+\chapter{Installing the Presenter}
+
+You'll probably want to get the Presenter working before the Collector.
+If you're using the secure XML data transfer, you'll need to
+generate both client- and server-side X.509 certificates.
+
+Installing the Presenter involves the following steps:
+\begin{itemize}
+\setlength{\itemsep}{0ex plus 0.5ex minus 0.0ex}
+\item
+	Install Perl dependencies
+\item
+	Install {\dsc} software
+\item
+	Create X.509 certificates (optional)
+\item
+	Set up a secure HTTP server (e.g., Apache and mod\_ssl)
+\item
+	Add some cron jobs
+\end{itemize}
+
+
+\section{Install Perl Dependencies}
+
+{\dsc} uses Perl for the extractor and grapher components.  Chances are
+that you'll need Perl-5.8, or maybe only Perl-5.6.  You'll also need
+these readily available third-party Perl modules, which you
+can find via CPAN:
+
+\begin{itemize}
+\setlength{\itemsep}{0ex plus 0.5ex minus 0.0ex}
+	\item CGI-Untaint (CGI::Untaint)
+	\item CGI.pm (CGI)
+	\item Digest-MD5 (Digest::MD5)
+	\item File-Flock (File::Flock)
+	\item File-Spec (File::Spec)
+	\item File-Temp (File::Temp)
+	\item Geography-Countries (Geography::Countries)
+	\item Hash-Merge (Hash::Merge)
+	\item IP-Country (IP::Country)
+	\item MIME-Base64 (MIME::Base64)
+	\item Math-Calc-Units (Math::Calc::Units)
+	\item Scalar-List-Utils (List::Util)
+	\item Text-Template (Text::Template)
+	\item URI (URI::Escape)
+	\item XML-Simple (XML::Simple)
+	\item Net-DNS-Resolver (Net::DNS::Resolver)
+
+\end{itemize}
+
+\noindent
+Also note that XML::Simple requires XML::Parser, which in
+turn requires the {\em expat\/} package.
+
+\section{Install Ploticus}
+
+{\dsc} uses Ploticus to generate plots and graphs.  You can find
+this software at \verb|http://ploticus.sourceforge.net|.  The {\em
+Download\/} page has links to some pre-compiled binaries and packages.
+FreeBSD and NetBSD users can find Ploticus in the ports/packages
+collection.
+
+
+\section{Install {\dsc} Software}
+
+All of the extractor and grapher tools are Perl or {\tt /bin/sh}
+scripts, so there is no need to compile anything.  Still,
+you should run {\tt make} first:
+
+\begin{MyVerbatim}
+% cd presenter
+% make
+\end{MyVerbatim}
+
+If you see errors about missing Perl prerequisites, you may want
+to correct those before continuing.
+
+The next step is to install the files.  Recall that
+\path|/usr/local/dsc| is the hard-coded installation prefix.
+You must create it manually:
+
+\begin{MyVerbatim}
+% mkdir /usr/local/dsc
+% make install
+\end{MyVerbatim}
+
+Note that {\dsc}'s Perl modules are installed in the 
+``site\_perl'' directory.  You'll probably need {\em root\/}
+privileges to install files there.
+
+\section{CGI Symbolic Links}
+
+{\dsc} has a couple of CGI scripts that are installed
+into \path|/usr/local/dsc/libexec|.  You should add symbolic
+links from your HTTP server's \path|cgi-bin| directory to
+these scripts.
+
+Both of these scripts have been designed to be mod\_perl-friendly.
+
+\begin{MyVerbatim}
+% cd /usr/local/apache/cgi-bin
+% ln -s /usr/local/dsc/libexec/put-file.pl
+% ln -s /usr/local/dsc/libexec/dsc-grapher.pl
+\end{MyVerbatim}
+
+You can skip the \path|put-file.pl| link if you plan to use
+{\em rsync\/} to transfer XML files.
+If you cannot create symbolic links, you'll need to manually
+copy the scripts to the appropriate directory.
+
+
+\section{/usr/local/dsc/data}
+
+\subsection{X.509 method}
+
+This directory is where \path|put-file.pl| writes incoming XML
+files.  It should have been created when you ran {\em make install\/} earlier.
+XML files are actually placed in {\em server\/} and {\em
+node\/} subdirectories based on the authorized client X.509 certificate
+parameters.  If you want \path|put-file.pl| to automatically create
+the subdirectories, the \path|data| directory must be writable by
+the process owner:
+
+\begin{MyVerbatim}
+% chgrp nobody /usr/local/dsc/data/
+% chmod 2775 /usr/local/dsc/data/
+\end{MyVerbatim}
+
+Alternatively, you can create {\em server\/} and {\em node\/} directories
+in advance and make those writable.
+
+\begin{MyVerbatim}
+% mkdir /usr/local/dsc/data/x-root/
+% mkdir /usr/local/dsc/data/x-root/blah/
+% mkdir /usr/local/dsc/data/x-root/blah/incoming/
+% chgrp nobody /usr/local/dsc/data/x-root/blah/
+% chmod 2775 /usr/local/dsc/data/x-root/blah/incoming/
+\end{MyVerbatim}
+
+Make sure that \path|/usr/local/dsc/data/| is on a large partition with
+plenty of free space.  You can make it a symbolic link to another
+partition if necessary.  Note that a typical {\dsc} installation
+for a large DNS root server requires about 4GB to hold a year's worth
+of data.
+
+\subsection{rsync Method}
+
+The directory structure is the same as above (for X.509).  The only
+differences are that:
+\begin{itemize}
+\item
+	The {\em server\/}, {\em node\/}, and {\em incoming\/}
+	directories must be made in advance.
+\item
+	The directories should be writable by the userid associated
+	with the {\em rsync}/{\em ssh\/} connection.  You may want
+	to create a dedicated {\em dsc\/} userid for this.
+\end{itemize}
+
+
+\section{/usr/local/dsc/var/log}
+
+The \path|put-file.pl| script logs its activity to
+\path|put-file.log| in this directory.  It should have been
+created when you ran {\em make install\/} earlier.  The directory
+should be writable by the HTTP server userid (usually {\em nobody\/}
+or {\em www\/}).  Unfortunately the installation isn't fancy enough
+to determine that userid yet, so you must change the ownership manually:
+
+\begin{MyVerbatim}
+% chgrp nobody /usr/local/dsc/var/log/
+\end{MyVerbatim}
+
+Furthermore, you probably want to make sure the log file does not
+grow indefinitely.  For example, on FreeBSD we add this line to \path|/etc/newsyslog.conf|:
+
+\begin{MyVerbatim}
+/usr/local/dsc/var/log/put-file.log nobody:wheel        644  10    *    @T00  BN
+\end{MyVerbatim}
+
+You need not worry about this directory if you are using the
+{\em rsync\/} upload method.
+
+\section{/usr/local/dsc/cache}
+
+This directory, also created by {\em make install\/} above, holds cached
+plot images.  It also must be writable by the HTTP userid:
+
+\begin{MyVerbatim}
+% chgrp nobody /usr/local/dsc/cache/
+\end{MyVerbatim}
+
+\section{Cron Jobs}
+
+{\dsc} requires two cron jobs on the Presenter.  The first
+is the one that processes incoming XML files.  It is called
+\path|refile-and-grok.sh|.  We recommend running it every
+minute.  You also may want to run the jobs at a lowerer priority
+with {\tt nice\/}.  Here is the cron job that we use:
+
+\begin{MyVerbatim}
+* * * * * /usr/bin/nice -10 /usr/local/dsc/libexec/refile-and-grok.sh
+\end{MyVerbatim}
+
+The other useful cron script is \path|remove-xmls.pl|.  It removes
+XML files older than a specified number of days.  Since most of the
+information in the XML files is archived into easier-to-parse 
+data files, you can remove the XML files after a few days.  This is
+the job that we use:
+
+\begin{MyVerbatim}
+@midnight find /usr/local/dsc/data/ | /usr/local/dsc/libexec/remove-xmls.pl 7
+\end{MyVerbatim}
+
+\section{Data URIs}
+
+{\dsc} uses ``Data URIs'' by default.  This is a URI where the
+content is base-64 encoded into the URI string.  It allows us
+to include images directly in HTML output, such that the browser
+does not have to make additional HTTP requests for the images.
+Data URIs may not work with some browsers.
+
+To disable Data URIs, edit {\em presenter/perllib/DSC/grapher.pm\/}
+and change this line:
+
+\begin{verbatim}
+        $use_data_uri = 1;
+\end{verbatim}
+
+to
+
+\begin{verbatim}
+        $use_data_uri = 0;
+\end{verbatim}
+
+Also make this symbolic link from your HTTP servers ``htdocs'' directory:
+
+\begin{verbatim}
+# cd htdocs
+# ln -s /usr/local/dsc/share/html dsc
+\end{verbatim}
+
+
+
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+
+\chapter{Configuring the {\dsc} Presenter}
+
+This chapter describes how to create X.509 certificates and configure
+Apache/mod\_ssl.  If you plan on using a different upload
+technique (such as scp or rsync) you can skip these instructions.
+
+\section{Generating X.509 Certificates}
+
+We use X.509 certificates to authenticate both sides
+of an SSL connection when uploading XML data files from 
+the collector to the presenter.
+
+Certificate generation is a tricky thing.  We use three different
+types of certificates:
+\begin{enumerate}
+\item A self-signed root CA certificate
+\item A server certificate
+\item Client certificates for each collector node
+\end{enumerate}
+
+In the client certificates
+we use X.509 fields to store the collector's server and node name.
+The Organizational Unit Name (OU) becomes the server name and
+the Common Name (CN) becomes the node name.
+
+The {\dsc} source code distribution includes some shell scripts
+that we have
+used to create X.509 certificates.  You can find them in the
+\path|presenter/certs| directory.  Note these are not installed
+into \path|/usr/local/dsc|.  You should edit \path|openssl.conf|
+and enter the relevant information for your organization.
+
+\subsection{Certificate Authority} 
+
+You may need to create a self-signed certificate authority if you
+don't already have one.  The CA signs client and server certificates.
+You will need to distribute the CA and client certificates to
+collector sites.  Here is how to use our \path|create-ca-cert.sh|
+script:
+
+\begin{MyVerbatim}
+% sh create-ca-cert.sh 
+CREATING CA CERT
+Generating a 2048 bit RSA private key
+..............................................................................
+............+++
+......+++
+writing new private key to './private/cakey.pem'
+Enter PEM pass phrase:
+Verifying - Enter PEM pass phrase:
+-----
+\end{MyVerbatim}
+
+
+\subsection{Server Certificate} 
+
+The server certificate is used by the HTTP server (Apache/mod\_ssl).
+The clients will have a copy of the CA certificate so they
+can validate the server's certificate when uploading XML files.
+Use the \path|create-srv-cert.sh| script to create a server
+certificate:
+
+\begin{MyVerbatim}
+% sh create-srv-cert.sh 
+CREATING SERVER REQUEST
+Generating a 1024 bit RSA private key
+..........................++++++
+.....................................++++++
+writing new private key to 'server/server.key'
+Enter PEM pass phrase:
+Verifying - Enter PEM pass phrase:
+-----
+You are about to be asked to enter information that will be incorporated
+into your certificate request.
+What you are about to enter is what is called a Distinguished Name or a DN.
+There are quite a few fields but you can leave some blank
+For some fields there will be a default value,
+If you enter '.', the field will be left blank.
+-----
+Country Name (2 letter code) [AU]:US
+State or Province Name (full name) [Some-State]:Colorado
+Locality Name (eg, city) []:Boulder
+Organization Name (eg, company) [Internet Widgits Pty Ltd]:The Measurement Factory, Inc
+Organizational Unit Name (eg, section) []:DNS
+Common Name (eg, YOUR name) []:dns.measurement-factory.com
+Email Address []:wessels@measurement-factory.com
+
+Please enter the following 'extra' attributes
+to be sent with your certificate request
+A challenge password []:
+An optional company name []:
+Enter pass phrase for server/server.key:
+writing RSA key
+CREATING SERVER CERT
+Using configuration from ./openssl.conf
+Enter pass phrase for ./private/cakey.pem:
+Check that the request matches the signature
+Signature ok
+The Subject's Distinguished Name is as follows
+countryName           :PRINTABLE:'US'
+stateOrProvinceName   :PRINTABLE:'Colorado'
+localityName          :PRINTABLE:'Boulder'
+organizationName      :PRINTABLE:'The Measurement Factory, Inc'
+organizationalUnitName:PRINTABLE:'DNS'
+commonName            :PRINTABLE:'dns.measurement-factory.com'
+emailAddress          :IA5STRING:'wessels@measurement-factory.com'
+Certificate is to be certified until Jun  3 20:06:17 2013 GMT (3000 days)
+Sign the certificate? [y/n]:y
+
+
+1 out of 1 certificate requests certified, commit? [y/n]y
+Write out database with 1 new entries
+Data Base Updated
+\end{MyVerbatim}
+
+Note that the Common Name must match the hostname of the HTTP
+server that receives XML files.
+
+Note that the \path|create-srv-cert.sh| script rewrites the
+server key file without the RSA password.  This allows your
+HTTP server to start automatically without prompting for
+the password.
+
+The script leaves the server certificate and key in the \path|server|
+directory.  You'll need to copy these over to the HTTP server config
+directory as described later in this chapter.
+
+\section{Client Certificates}
+
+Generating client certificates is similar.  Remember that
+the Organizational Unit Name and Common Name correspond to the
+collector's {\em server\/} and {\em node\/} names.   For example:
+
+\begin{MyVerbatim}
+% sh create-clt-cert.sh
+CREATING CLIENT REQUEST
+Generating a 1024 bit RSA private key
+................................++++++
+..............++++++
+writing new private key to 'client/client.key'
+Enter PEM pass phrase:
+Verifying - Enter PEM pass phrase:
+-----
+You are about to be asked to enter information that will be incorporated
+into your certificate request.
+What you are about to enter is what is called a Distinguished Name or a DN.
+There are quite a few fields but you can leave some blank
+For some fields there will be a default value,
+If you enter '.', the field will be left blank.
+-----
+Country Name (2 letter code) [AU]:US
+State or Province Name (full name) [Some-State]:California
+Locality Name (eg, city) []:Los Angeles
+Organization Name (eg, company) [Internet Widgits Pty Ltd]:Some DNS Server
+Organizational Unit Name (eg, section) []:x-root  
+Common Name (eg, YOUR name) []:LAX
+Email Address []:noc@example.com
+
+Please enter the following 'extra' attributes
+to be sent with your certificate request
+A challenge password []:
+An optional company name []:
+CREATING CLIENT CERT
+Using configuration from ./openssl.conf
+Enter pass phrase for ./private/cakey.pem:
+Check that the request matches the signature
+Signature ok
+The Subject's Distinguished Name is as follows
+countryName           :PRINTABLE:'US'
+stateOrProvinceName   :PRINTABLE:'California'
+localityName          :PRINTABLE:'Los Angeles'
+organizationName      :PRINTABLE:'Some DNS Server'
+organizationalUnitName:PRINTABLE:'x-root  '
+commonName            :PRINTABLE:'LAX'
+emailAddress          :IA5STRING:'noc@example.com'
+Certificate is to be certified until Jun  3 20:17:24 2013 GMT (3000 days)
+Sign the certificate? [y/n]:y 
+
+
+1 out of 1 certificate requests certified, commit? [y/n]y
+Write out database with 1 new entries
+Data Base Updated
+Enter pass phrase for client/client.key:
+writing RSA key
+writing RSA key
+\end{MyVerbatim}
+
+The client's key and certificate will be placed in a directory
+based on the server and node names.  For example:
+
+\begin{MyVerbatim}
+% ls -l client/x-root/LAX
+total 10
+-rw-r--r--  1 wessels  wessels  3311 Mar 17 13:17 client.crt
+-rw-r--r--  1 wessels  wessels   712 Mar 17 13:17 client.csr
+-r--------  1 wessels  wessels   887 Mar 17 13:17 client.key
+-rw-r--r--  1 wessels  wessels  1953 Mar 17 13:17 client.pem
+\end{MyVerbatim}
+
+The \path|client.pem| (and \path|cacert.pem|) files should be copied
+to the collector machine.
+
+\section{Apache Configuration}
+
+\noindent
+You need to configure Apache for SSL.  Here is what our configuration
+looks like:
+
+\begin{MyVerbatim}
+SSLRandomSeed startup builtin
+SSLRandomSeed startup file:/dev/random
+SSLRandomSeed startup file:/dev/urandom 1024
+SSLRandomSeed connect builtin
+SSLRandomSeed connect file:/dev/random
+SSLRandomSeed connect file:/dev/urandom 1024
+
+<VirtualHost _default_:443>
+DocumentRoot "/httpd/htdocs-ssl"
+SSLEngine on
+SSLCertificateFile /httpd/conf/SSL/server/server.crt
+SSLCertificateKeyFile /httpd/conf/SSL/server/server.key
+SSLCertificateChainFile /httpd/conf/SSL/cacert.pem
+
+# For client-validation
+SSLCACertificateFile /httpd/conf/SSL/cacert.pem
+SSLVerifyClient require
+
+SSLOptions +CompatEnvVars
+Script PUT /cgi-bin/put-file.pl
+</VirtualHost>
+\end{MyVerbatim}
+
+\noindent
+Note the last line of the configuration specifies the CGI script
+that accepts PUT requests.  The {\em SSLOptions\/}
+line is necessary so that the CGI script receives certain HTTP
+headers as environment variables.  Those headers/variables convey
+the X.509 information to the script so it knows where to store
+received XML files.
+
+
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+
+\chapter{Collector Installation}
+
+
+A collector machine needs only the {\em dsc\/} binary, a configuration
+file, and a couple of cron job scripts.
+
+At this point, {\dsc} lacks certain niceties such as a \path|./configure|
+script.   The installation prefix, \path|/usr/local/dsc| is currently
+hard-coded.
+
+
+\section{Prerequisites}
+
+You'll need a C/C++ compiler to compile the {\tt dsc\/} source code.
+
+If the collector and archiver are different systems, you'll need a
+way to transfer data files.  We recommend that you use the {\tt
+curl\/} HTTP/SSL client You may use another technique, such as {\tt
+scp\/} or {\tt rsync\/} if you prefer.
+
+\section{\tt Installation}
+
+You can compile {\tt dsc\/} from the {\tt collector\/} directory:
+
+\begin{MyVerbatim}
+% cd collector
+% make
+\end{MyVerbatim}
+
+Assuming there are no errors or problems during compilation, install
+the {\tt dsc\/} binary and other scripts with:
+
+\begin{MyVerbatim}
+% make install
+\end{MyVerbatim}
+
+This installs five files:
+\begin{Verbatim}
+/usr/local/dsc/bin/dsc
+/usr/local/dsc/etc/dsc.conf.sample
+/usr/local/dsc/libexec/upload-prep.pl
+/usr/local/dsc/libexec/upload-rsync.sh
+/usr/local/dsc/libexec/upload-x509.sh
+\end{Verbatim}
+
+Of course, if you don't want to use the default installation
+prefix, you can manually copy these files to a location
+of your choosing.  If you do that, you'll also need to
+edit the cron scripts to match your choice of pathnames, etc.
+
+\section{Uploading XML Files} 
+\label{sec-install-collector-cron}
+
+This section describes how XML files are transferred from
+the collector to one or more Presenter systems.
+
+As we'll see in the next chapter, each {\tt dsc} process
+has its own {\em run directory\/}.  This is the directory
+where {\tt dsc} leaves its XML files.  It usually has a
+name like \path|/usr/local/dsc/run/NODENAME|\@.  XML files
+are removed after they are successfully transferred.  If the
+Presenter is unreachable, XML files accumulate here until
+they can be transferred.  Make sure that you have
+enough disk space to queue a lot of XML files in the
+event of an outage.
+
+In general we want to be able to upload XML files to multiple
+presenters.  This is the reason behind the {\tt upload-prep.pl}
+script.  This script runs every 60 seconds from cron:
+
+\begin{MyVerbatim}
+* * * * * /usr/local/dsc/libexec/upload-prep.pl
+\end{MyVerbatim}
+
+{\tt upload-prep.pl} looks for \path|dsc.conf| files in
+\path|/usr/local/dsc/etc| by default.  For each config file
+found, it cd's to the {\em run\_dir\/} and links\footnote{as in
+``hard link'' made with \path|/bin/ln|.}
+XML files to one or more upload directories.  The upload directories
+are named \path|upload/dest1|, \path|upload/dest2|, and so on.
+
+In order for all this to work, you must create the directories
+in advance.   For example, if you are collecting stats on
+your nameserver named {\em ns0\/}, and want to send the XML files
+to two presenters (named oarc and archive), the directory structure
+might look like:
+
+\begin{MyVerbatim}
+% set prefix=/usr/local/dsc
+% mkdir $prefix/run
+% mkdir $prefix/run/ns0
+% mkdir $prefix/run/ns0/upload
+% mkdir $prefix/run/ns0/upload/oarc
+% mkdir $prefix/run/ns0/upload/archive
+\end{MyVerbatim}
+
+With that directory structure, the {\tt upload-prep.pl} script moves
+XML files from the \path|ns0| directory to the two
+upload directories, \path|oarc| and \path|archive|.
+
+To actually transfer files to the presenter, use either
+\path|upload-x509.sh| or \path|upload-rsync.sh|.
+
+\subsection{upload-x509.sh}
+
+This cron script is responsible for
+actually transferring XML files from the upload directories
+to the remote server.    It creates a {\em tar\/} archive
+of XML files and then uploads it to the remote server with
+{\tt curl}.  The script takes three commandline arguments:
+
+\begin{MyVerbatim}
+% upload-x509.sh NODE DEST URI
+\end{MyVerbatim}
+
+{\em NODE\/} must match the name of a directory under
+\path|/usr/local/dsc/run|.  Similarly, {\em DEST\/} must match the
+name of a directory under \path|/usr/local/dsc/run/NODE/upload|.
+{\em URI\/} is the URL/URI that the data is uploaded to.  Usually
+it is just an HTTPS URL with the name of the destination server.
+We also recommend running this from cron every 60 seconds.  For
+example:
+
+\begin{MyVerbatim}
+* * * * * /usr/local/dsc/libexec/upload-x509.sh ns0 oarc \
+	https://collect.oarc.isc.org/
+* * * * * /usr/local/dsc/libexec/upload-x509.sh ns0 archive \
+	https://archive.example.com/
+\end{MyVerbatim}
+
+\path|upload-x509.sh| looks for X.509 certificates in
+\path|/usr/local/dsc/certs|.  The client certificate should be named
+\path|/usr/local/dsc/certs/DEST/NODE.pem| and the CA certificate
+should be named
+\path|/usr/local/dsc/certs/DEST/cacert.pem|.  Note that {\em DEST\/}
+and {\em NODE\/} must match the \path|upload-x509.sh|
+command line arguments.
+
+\subsection{upload-rsync.sh}
+
+This script can be used to transfer XML files files from the upload
+directories to the remote server.  It uses {\em rsync\/} and
+assumes that {\em rsync\/} will use {\em ssh\/} for transport.
+This script also takes three arguments:
+
+\begin{MyVerbatim}
+% upload-rsync.sh NODE DEST RSYNC-DEST
+\end{MyVerbatim}
+
+Note that {\em DEST\/} is the name of the local ``upload'' directory
+and {\em RSYNC-DEST\/} is an {\em rsync\/} destination (i.e., hostname and remote directory).
+Here is how you might use it in a crontab:
+
+\begin{MyVerbatim}
+* * * * * /usr/local/dsc/libexec/upload-rsync.sh ns0 oarc \
+	dsc@collect.oarc.isc.org:/usr/local/dsc/data/Server/ns0
+* * * * * /usr/local/dsc/libexec/upload-rsync.sh ns0 archive \
+	dsc@archive.oarc.isc.org:/usr/local/dsc/data/Server/ns0
+\end{MyVerbatim}
+
+Also note that \path|upload-rsync.sh| will actually store the remote
+XML files in \path|incoming/YYYY-MM-DD| subdirectories.  That is,
+if your {\em RSYNC-DEST\/} is \path|host:/usr/local/dsc/data/Server/ns0|
+then files will actually be written to
+\path|/usr/local/dsc/data/Server/ns0/incoming/YYYY-MM-DD| on {\em host},
+where \path|YYYY-MM-DD| is replaced by the year, month, and date of the
+XML files.  These subdirectories reduce filesystem pressure in the event
+of backlogs.
+
+{\em rsync\/} over {\em ssh\/} requires you to use RSA or DSA public keys
+that do not have a passphrase.  If you do not want to use one of 
+{\em ssh\/}'s default identity files, you can create one specifically
+for this script.  It should be named \path|dsc_uploader_id| (and
+\path|dsc_uploader_id.pub|) in the \$HOME/.ssh directory of the user
+that will be running the script.  For example, you can create it
+with this command:
+
+\begin{MyVerbatim}
+% ssh-keygen -t dsa -C dsc-uploader -f $HOME/.ssh/dsc_uploader_id
+\end{MyVerbatim}
+
+Then add \path|dsc_uploader_id.pub| to the \path|authorized_keys|
+file of the receiving userid on the presenter system.
+
+
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+
+\chapter{Configuring and Running the {\dsc} Collector}
+
+\section{dsc.conf}
+
+Before running {\tt dsc\/} you need to create a configuration file.
+Note that configuration directive lines are terminated with a semi-colon.
+The configuration file currently understands the following directives:
+
+\begin{description}
+
+\item[local\_address]
+
+	Specifies the DNS server's local IP address.  It is used
+	to determine the ``direction'' of an IP packet: sending,
+	receiving, or other.  You may specify multiple local addresses
+	by repeating the {\em local\_address} line any number of times.
+
+	Example: {\tt local\_address 172.16.0.1;\/}
+	Example: {\tt local\_address 2001:4f8:0:2::13;\/}
+
+\item[run\_dir]
+
+	A directory that should become {\tt dsc\/}'s current directory
+	after it starts.  XML files will be written here, as will
+	any core dumps.
+
+	Example: {\tt run\_dir "/var/run/dsc";\/}
+
+\item[minfree\_bytes]
+
+	If the filesystem where {\tt dsc\/} writes its XML files
+	does not have at least this much free space, then
+	{\tt dsc\/} will not write the XML files.  This prevents
+	{\tt dsc\/} from filling up the filesystem.  The XML
+	files that would have been written are simply lost and
+	cannot be receovered.  {\tt dsc\/} will begin writing
+	XML files again when the filesystem has the necessary
+	free space.
+
+\item[bpf\_program]
+
+	A Berkeley Packet Filter program string.  Normally you
+	should leave this unset.  You may use this to further
+	restrict the traffic seen by {\tt dsc\/}.  Note that {\tt
+	dsc\/} currently has one indexer that looks at all IP
+	packets.  If you specify something like {\em udp port 53\/}
+	that indexer will not work.
+
+	However, if you want to monitor multiple DNS servers with
+	separate {\dsc} instances on one collector box, then you
+	may need to use {\em bpf\_program} to make sure that each
+	{\tt dsc} process sees only the traffic it should see.
+
+	Note that this directive must go before the {\em interface\/}
+	directive because {\tt dsc\/} makes only one pass through
+	the configuration file and the BPF filter is set when the
+	interface is initialized.
+
+	Example: {\tt bpf\_program "dst host 192.168.1.1";\/}
+
+\item[interface]
+
+	The interface name to sniff packets from.   You may specify multiple
+	interfaces.
+
+	Example: {\tt interface fxp0;\/}
+
+\item[bpf\_vlan\_tag\_byte\_order]
+
+	{\tt dsc\/} knows about VLAN tags.  Some operating systems
+	(FreeBSD-4.x) have a bug whereby the VLAN tag id is
+	byte-swapped.  Valid values for this directive are {\tt
+	host\/} and {\tt net\/} (the default).    Set this to {\tt
+	host\/} if you suspect your operating system has the VLAN
+	tag byte order bug.
+
+	Example: {\tt bpf\_vlan\_tag\_byte\_order host;\/}
+
+\item[match\_vlan]
+
+	A list of VLAN identifiers (integers).  If set, only the
+	packets belonging to these VLANs are counted.
+
+	Example: {\tt match\_vlan 101 102;\/}
+
+\item[qname\_filter]
+
+	This directive allows you to define custom filters
+	to match query names in DNS messages.  Please see
+	Section~\ref{sec-qname-filter} for more information.
+
+\item[dataset]
+
+	This directive is the hart of {\dsc}.  However, it is also
+	the most complex.
+	To save time we recommend that you copy interesting-looking
+	dataset definitions from \path|dsc.conf.sample|.  Comment
+	out any that you feel are irrelevant or uninteresting.
+	Later, as you become more familiar with {\dsc}, you may
+	want to read the next chapter and add your own custom
+	datasets.
+\end{description}
+
+
+\section{A Complete Sample dsc.conf}
+
+Here's how your entire {\em dsc.conf\/} file might look:
+
+\begin{MyVerbatim}
+#bpf_program
+interface em0;
+
+local_address 192.5.5.241;
+
+run_dir "/usr/local/dsc/run/foo";
+
+dataset qtype dns All:null Qtype:qtype queries-only;
+dataset rcode dns All:null Rcode:rcode replies-only;
+dataset opcode dns All:null Opcode:opcode queries-only;
+dataset rcode_vs_replylen dns Rcode:rcode ReplyLen:msglen replies-only;
+dataset client_subnet dns All:null ClientSubnet:client_subnet queries-only
+        max-cells=200;
+dataset qtype_vs_qnamelen dns Qtype:qtype QnameLen:qnamelen queries-only;
+dataset qtype_vs_tld dns Qtype:qtype TLD:tld queries-only,popular-qtypes
+        max-cells=200;
+dataset certain_qnames_vs_qtype dns CertainQnames:certain_qnames
+        Qtype:qtype queries-only;
+dataset client_subnet2 dns Class:query_classification
+        ClientSubnet:client_subnet queries-only max-cells=200;
+dataset client_addr_vs_rcode dns Rcode:rcode ClientAddr:client
+        replies-only max-cells=50;
+dataset chaos_types_and_names dns Qtype:qtype Qname:qname
+        chaos-class,queries-only;
+dataset idn_qname dns All:null IDNQname:idn_qname queries-only;
+dataset edns_version dns All:null EDNSVersion:edns_version queries-only;
+dataset do_bit dns All:null D0:do_bit queries-only;
+dataset rd_bit dns All:null RD:rd_bit queries-only;
+dataset idn_vs_tld dns All:null TLD:tld queries-only,idn-only;
+dataset ipv6_rsn_abusers dns All:null ClientAddr:client
+        queries-only,aaaa-or-a6-only,root-servers-n et-only max-cells=50;
+dataset transport_vs_qtype dns Transport:transport Qtype:qtype queries-only;
+
+dataset direction_vs_ipproto ip Direction:ip_direction IPProto:ip_proto
+        any;
+\end{MyVerbatim}
+
+\section{Running {\tt dsc}}
+
+{\tt dsc\/} accepts a single command line argument, which is
+the name of the configuration file.  For example:
+
+\begin{MyVerbatim}
+% cd /usr/local/dsc
+% bin/dsc etc/foo.conf
+\end{MyVerbatim}
+
+If you run {\tt ps} when {\tt dsc} is running, you'll see two processes:
+
+\begin{MyVerbatim}
+60494  ??  S      0:00.36 bin/dsc etc/foo.conf
+69453  ??  Ss     0:10.65 bin/dsc etc/foo.conf
+\end{MyVerbatim}
+
+The first process simply forks off child processes every
+60 seconds.  The child processes do the work of analyzing
+and tabulating DNS messages.
+
+Please use NTP or another technique to keep the collector's
+clock synchronized to the correct time.
+
+
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+
+\chapter{Viewing {\dsc} Graphs}
+
+To view {\dsc} data in a web browser, simply enter the
+URL to the \path|dsc-grapher.pl| CGI.   But before you
+do that, you'll need to create a grapher configuration file.
+
+\path|dsc-grapher.pl| uses a simple configuration file to set certain
+menu options.  This  configuration file is
+\path|/usr/local/dsc/etc/dsc-grapher.cfg|.  You should find
+a sample version in the same directory.  For example:
+
+\begin{MyVerbatim}
+server f-root pao1 sfo2
+server isc senna+piquet
+server tmf hq sc lgh
+trace_windows 1hour 4hour 1day 1week 1month
+accum_windows 1day 2days 3days 1week
+timezone Asia/Tokyo
+domain_list isc_tlds br nl ca cz il pt cl
+domain_list isc_tlds sk ph hr ae bg is si za
+valid_domains isc isc_tlds
+
+\end{MyVerbatim}
+
+\begin{figure}
+\centerline{\psfig{figure=screenshot1.eps,width=6.5in}}
+\caption{\label{fig-screenshot1}A sample graph}
+\end{figure}
+
+Refer to Figure~\ref{fig-screenshot1} to see how
+the directives affect the visual display.
+The following three directives should always be set in
+the configuration file:
+
+\begin{description}
+\item[server]
+	This directive tells \path|dsc-grapher.pl| to list
+	the given server and its associated nodes in the
+	``Servers/Nodes'' section of its navigation menu.
+	You can repeat this directive for each server that
+	the Presenter has.
+\item[trace\_windows]
+	Specifies the ``Time Scale'' menu options for
+	trace-based plots.
+\item[accum\_windows]
+	Specifies the ``Time Scale'' menu options for
+	``cumulative'' plots, such as the Classification plot.
+\end{description}
+
+Note that the \path|dsc-grapher.cfg| only affects what
+may appear in the navigation window.  It does NOT prevent users
+from entering other values in the URL parameters.  For example,
+if you have data for a server/node in your
+\path|/usr/local/dsc/data/| directory that is not listed in
+\path|dsc-grapher.cfg|, a user may still be able to view that
+data by manually setting the URL query parameters.
+
+The configuration file accepts a number of optional directives
+as well.  You may set these if you like, but they are not
+required:
+
+\begin{description}
+\item[timezone]
+	Sets the time zone for dates and times displayed in the
+	graphs. 
+	You can use this if you want to override the system
+	time zone.
+	The value for this directive should be the name
+	of a timezone entry in your system database (usually found
+	in {\path|/usr/share/zoneinfo|}.
+	For example, if your system time zone is set
+	to UTC but you want the times displayed for the
+	London timezone, you can set this directive to
+	{\tt Europe/London\/}.
+\item[domain\_list]
+	This directive, along with {\em valid\_domains\/}, tell the
+	presenter which domains a nameserver is authoritative for.
+	That information is used in the TLDs subgraphs to differentiate
+	requests for ``valid'' and ``invalid'' domains.
+
+	The {\em domain\_list\/} creates a named list of domains.
+	The first token is a name for the list, and the remaining
+	tokens are domain names.  The directive may be repeated with
+	the same list name, as shown in the above example.
+\item[valid\_domains]
+	This directive glues servers and domain\_lists together.  The
+	first token is the name of a {\em server\/} and the second token is
+	the name of a {\em domain\_list\/}.
+\item[embargo]
+	The {\em embargo\/} directive may be used to delay the
+	availability of data via the presenter.  For example, you
+	may have one instance of {\em dsc-grapher.pl\/} for internal
+	use only (password protected, etc).  You may also have a
+	second instance for third-parties where data is delayed by
+	some amount of time, such as hours, days, or weeks.  The value
+	of the {\em embargo\/} directive is the number of seconds which
+	data availability should be delayed.  For example, if you set
+	it to 604800, then viewers will not be able to see any data
+	less than one week old.
+\item[anonymize\_ip]
+	When the {\em anonymize\_ip\/} directive is given, IP addresses
+	in the display will be anonymized.  The anonymization algorithm
+	is currently hard-coded and designed only for IPv4 addresses.
+	It masks off the lower 24 bits and leaves only the first octet
+	in place.
+\item[hide\_nodes]
+	When the {\em hide\_nodes\/} directive is given, the presenter
+	will not display the list node names underneath the current
+	server.  This might be useful if you have a number of nodes
+	but only want viewers to see the server as a whole, without
+	exposing the particular nodes in the cluster.  Note, however,
+	that if someone already knows the name of a node they can
+	hand-craft query terms in the URL to display the data for
+	only that node.  In other words, the {\em hide\_nodes\/}
+	only provides ``security through obscurity.''
+\end{description}
+
+
+The first few times you try \path|dsc-grapher.pl|, be sure to run
+{\tt tail -f} on the HTTP server error.log file.
+
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+
+\chapter{{\dsc} Datasets}
+
+A {\em dataset\/} is a 2-D array of counters.  For example, you
+might have a dataset with ``Query Type'' along one dimension and
+``Query Name Length'' on the other.  The result is a table that
+shows the distribution of query name lengths for each query type.
+For example:
+
+\vspace{1ex}
+\begin{center}
+\begin{tabular}{l|rrrrrr}
+Len & A & AAAA & A6 & PTR & NS & SOA \\
+\hline
+$\cdots$ & & & & & \\
+11 & 14 & 8 & 7 & 11 & 2 & 0 \\
+12 & 19 & 2 & 3 & 19 & 4 & 1 \\
+$\cdots$ & & & & & & \\
+255 & 0 & 0 & 0 & 0 & 0 & 0 \\
+\hline
+\end{tabular}
+\end{center}
+\vspace{1ex}
+
+\noindent
+A dataset is defined by the following parameters:
+\begin{itemize}
+\setlength{\itemsep}{0ex plus 0.5ex minus 0.0ex}
+\item A name
+\item A protocol layer (IP or DNS)
+\item An indexer for the first dimension
+\item An indexer for the second dimension
+\item One or more filters
+\item Zero or more options and parameters
+\end{itemize}
+
+\noindent
+The {\em dataset\/} definition syntax in \path|dsc.conf| is:
+
+{\tt dataset\/}
+{\em name\/}
+{\em protocol\/}
+{\em Label1:Indexer1\/}
+{\em Label2:Indexer2\/}
+{\em filter\/} 
+{\em [parameters]\/};
+\vspace{2ex}
+
+\section{Dataset Name}
+
+The dataset name is used in the filename for {\tt dsc\/}'s XML
+files.  Although this is an opaque string in theory, the Presenter's
+XML extractor routines must recognize the dataset name to properly
+parse it.  The source code file
+\path|presenter/perllib/DSC/extractor/config.pm| contains an entry
+for each known dataset name.
+
+\section{Protocol}
+
+{\dsc} currently knows about two protocol layers: IP and DNS.
+On the {\tt dataset\/} line they are written as {\tt ip\/} and {\tt dns\/}.
+
+
+\section{Indexers}
+
+An {\em indexer\/} is simply a function that transforms the attributes
+of an IP/DNS message into an array index.  For some attributes the
+transformation is straightforward.  For example, the ``Query Type''
+indexer simply extracts the query type value from a DNS message and
+uses this 16-bit value as the array index.
+
+Other attributes are slightly more complicated.  For example, the
+``TLD'' indexer extracts the TLD of the QNAME field of a DNS message
+and maps it to an integer.  The indexer maintains a simple internal
+table of TLD-to-integer mappings.  The actual integer values are
+unimportant because the TLD strings, not the integers, appear in
+the resulting XML data.
+
+When you specify an indexer on a {\tt dataset\/} line, you must
+provide both the name of the indexer and a label.  The Label appears
+as an attribute in the XML output.  For example,
+Figure~\ref{fig-sample-xml} shows the XML corresponding to this
+{\em dataset\/} line:
+
+\begin{MyVerbatim}
+dataset the_dataset dns Foo:foo Bar:bar queries-only;
+\end{MyVerbatim}
+
+\begin{figure}
+\begin{MyVerbatim}
+<array name="the_dataset" dimensions="2" start_time="1091663940" ...
+  <dimension number="1" type="Foo"/>
+  <dimension number="2" type="Bar"/>
+  <data>
+    <Foo val="1">
+      <Bar val="0" count="4"/>
+      ...
+      <Bar val="100" count="41"/>
+    </Foo>
+    <Foo val="2">
+      ...
+    </Foo>
+  </data>
+</array>
+\end{MyVerbatim}
+\caption{\label{fig-sample-xml}Sample XML output}
+\end{figure}
+
+In theory you are free to choose any label that you like, however,
+the XML extractors look for specific labels.  Please use the labels
+given for the indexers in Tables~\ref{tbl-dns-indexers}
+and~\ref{tbl-ip-indexers}.
+
+\subsection{IP Indexers}
+
+\begin{table}
+\begin{center}
+\begin{tabular}{|lll|}
+\hline
+Indexer & Label & Description \\
+\hline 
+ip\_direction & Direction & one of sent, recv, or other \\
+ip\_proto & IPProto & IP protocol (icmp, tcp, udp) \\
+ip\_version & IP version number (4, 6) \\
+\hline
+\end{tabular}
+\caption{\label{tbl-ip-indexers}IP packet indexers}
+\end{center}
+\end{table}
+
+{\dsc} includes only minimal support for collecting IP-layer
+stats.  Mostly we are interested in finding out the mix of
+IP protocols received by the DNS server.  It can also show us
+if/when the DNS server is the subject of denial-of-service
+attack.
+Table~\ref{tbl-ip-indexers} shows the indexers for IP packets.
+Here are their longer descriptions:
+
+\begin{description}
+\item[ip\_direction]
+	One of three values: sent, recv, or else.  Direction is determined
+	based on the setting for {\em local\_address\/} in the configuration file.
+\item[ip\_proto]
+	The IP protocol type, e.g.: tcp, udp, icmp.
+	Note that the {\em bpf\_program\/} setting affects all traffic
+	seen by {\dsc}.  If the program contains the word ``udp''
+	then you won't see any counts for non-UDP traffic.
+\item[ip\_version]
+	The IP version number, e.g.: 4 or 6.  Can be used to compare how much
+	traffic comes in via IPv6 compared to IPV4.
+\end{description}
+
+\subsection{IP Filters}
+
+Currently there is only one IP protocol filter: {\tt any\/}.
+It includes all received packets.
+
+
+\subsection{DNS Indexers}
+
+\begin{table}
+\begin{center}
+\begin{tabular}{|lll|}
+\hline
+Indexer & Label & Description \\
+\hline 
+certain\_qnames & CertainQnames & Popular query names seen at roots \\
+client\_subnet & ClientSubnet & The client's IP subnet (/24 for IPv4, /96 for IPv6) \\
+client & ClientAddr & The client's IP address \\
+do\_bit & DO & Whether the DO bit is on \\
+edns\_version & EDNSVersion & The EDNS version number \\
+idn\_qname & IDNQname & If the QNAME is in IDN format \\
+msglen & MsgLen & The DNS message length \\
+null & All & A ``no-op'' indexer \\
+opcode & Opcode & DNS message opcode \\
+qclass & - & Query class \\
+qname & Qname & Full query name \\
+qnamelen & QnameLen & Length of the query name \\
+qtype & Qtype & DNS query type \\
+query\_classification & Class & A classification for bogus queries \\
+rcode & Rcode & DNS reply code \\
+rd\_bit & RD & Check if Recursion Desired bit set \\
+tld & TLD & TLD of the query name \\
+transport & Transport & Transport protocol for the DNS message (UDP or TCP) \\
+dns\_ip\_version & IPVersion & IP version of the packet carrying the DNS message \\
+\hline
+\end{tabular}
+\caption{\label{tbl-dns-indexers}DNS message indexers}
+\end{center}
+\end{table}
+
+Table~\ref{tbl-dns-indexers} shows the currently-defined indexers
+for DNS messages, and here are their descriptions:
+
+\begin{description}
+\item[certain\_qnames]
+	This indexer isolates the two most popular query names seen
+	by DNS root servers: {\em localhost\/} and {\em
+	[a--m].root-servers.net\/}.
+\item[client\_subnet]
+	Groups DNS messages together by the subnet of the
+	client's IP address.  The subnet is maked by /24 for IPv4
+	and by /96 for IPv6.  We use this to make datasets with
+	large, diverse client populations more manageable and to
+	provide a small amount of privacy and anonymization.
+\item[client]
+	The IP (v4 and v6) address of the DNS client.
+\item[do\_bit]
+	This indexer has only two values: 0 or 1.  It indicates
+	whether or not the ``DO'' bit is set in a DNS query.  According to
+	RFC 2335: {\em Setting the DO bit to one in a query indicates
+	to the server that the resolver is able to accept DNSSEC
+	security RRs.}
+\item[edns\_version]
+	The EDNS version number, if any, in a DNS query.  EDNS
+	Version 0 is documented in RFC 2671.
+\item[idn\_qname]
+	This indexer has only two values: 0 or 1.  It returns 1
+	when the first QNAME in the DNS message question section
+	is an internationalized domain name (i.e., containing
+	non-ASCII characters).  Such QNAMEs begin with the string
+	{\tt xn--\/}.  This convention is documented in RFC 3490.
+\item[msglen]
+	The overall length (size) of the DNS message.
+\item[null]
+	A ``no-op'' indexer that always returns the same value.
+	This can be used to effectively turn the 2-D table into a
+	1-D array.
+\item[opcode]
+	The DNS message opcode is a four-bit field.  QUERY is the
+	most common opcode.  Additional currently defined opcodes
+	include: IQUERY, STATUS, NOTIFY, and UPDATE.
+\item[qclass]
+	The DNS message query class (QCLASS) is a 16-bit value.  IN
+	is the most common query class.  Additional currently defined
+	query class values include: CHAOS, HS, NONE, and ANY.
+\item[qname]
+	The full QNAME string from the first (and usually only)
+	QNAME in the question section of a DNS message.
+\item[qnamelen]
+	The length of the first (and usually only) QNAME in a DNS
+	message question section.  Note this is the ``expanded''
+	length if the message happens to take advantage of DNS
+	message ``compression.''
+\item[qtype]
+	The query type (QTYPE) for the first QNAME in the DNS message
+	question section.  Well-known query types include: A, AAAA,
+	A6, CNAME, PTR, MX, NS, SOA, and ANY.
+\item[query\_classification]
+	A stateless classification of ``bogus'' queries:
+	\begin{itemize}
+	\setlength{\itemsep}{0ex plus 0.5ex minus 0.0ex}
+	\item non-auth-tld: when the TLD is not one of the IANA-approved TLDs.
+	\item root-servers.net: a query for a root server IP address.
+	\item localhost: a query for the localhost IP address.
+	\item a-for-root: an A query for the DNS root (.).
+	\item a-for-a: an A query for an IPv4 address.
+	\item rfc1918-ptr: a PTR query for an RFC 1918 address.
+	\item funny-class: a query with an unknown/undefined query class.
+	\item funny-qtype: a query with an unknown/undefined query type.
+	\item src-port-zero: when the UDP message's source port equals zero.
+	\item malformed: a malformed DNS message that could not be entirely parsed.
+	\end{itemize}
+\item[rcode]
+	The RCODE value in a DNS reply.  The most common response
+	codes are 0 (NO ERROR) and 3 (NXDOMAIN). 
+\item[rd\_bit]
+	This indexer returns 1 if the RD (recursion desired) bit is
+	set in the query.  Usually only stub resolvers set the RD bit.
+	Usually authoritative servers do not offer recursion to their
+	clients.
+\item[tld]
+	the TLD of the first QNAME in a DNS message's question section.
+\item[transport]
+	Indicates whether the DNS message is carried via UDP or TCP\@.
+\item[dns\_ip\_version]
+	The IP version number that carried the DNS message.
+\end{description}
+
+\subsection{DNS Filters}
+
+You must specify one or more of the following filters (separated by commas) on
+the {\tt dataset\/} line:
+
+\begin{description}
+\item[any]
+	The no-op filter, counts all messages.
+\item[queries-only]
+	Count only DNS query messages.  A query is a DNS message
+	where the QR bit is set to 0.
+\item[replies-only]
+	Count only DNS reply messages.  A query is a DNS message 
+        where the QR bit is set to 1.
+\item[popular-qtypes]
+	Count only DNS messages where the query type is one of:
+	A, NS, CNAME, SOA, PTR, MX, AAAA, A6, ANY.
+\item[idn-only]
+	Count only DNS messages where the query name is in the
+	internationalized domain name format.
+\item[aaaa-or-a6-only]
+	Count only DNS Messages where the query type is AAAA or A6.
+\item[root-servers-net-only]
+	Count only DNS messages where the query name is within
+	the {\em root-servers.net\/} domain.
+\item[chaos-class]
+	Counts only DNS messages where QCLASS is equal to
+	CHAOS (3).  The CHAOS class is generally used
+	for only the special {\em hostname.bind\/} and
+	{\em version.bind\/} queries.
+\end{description}
+
+\noindent
+Note that multiple filters are ANDed together.  That is, they
+narrow the input stream, rather than broaden it.
+
+In addition to these pre-defined filters, you can add your own
+custom filters.
+
+\subsubsection{qname\_filter}
+\label{sec-qname-filter}
+
+The {\em qname\_filter} directive defines a new
+filter that uses regular expression matching on the QNAME field of
+a DNS message.  This may be useful if you have a server that is
+authoritative for a number of zones, but you want to limit
+your measurements to a small subset.  The {\em qname\_filter} directive
+takes two arguments: a name for the filter and a regular expression.
+For example:
+
+\begin{MyVerbatim}
+qname_filter MyFilterName example\.(com|net|org)$ ;
+\end{MyVerbatim}
+
+This filter matches queries (and responses) for names ending with
+{\em example.com\/}, {\em example.net\/}, and {\em example.org\/}.
+You can reference the named filter in the filters part of a {\em
+dataset\/} line.  For example:
+
+\begin{MyVerbatim}
+dataset qtype dns All:null Qtype:qtype queries-only,MyFilterName;
+\end{MyVerbatim}
+
+\subsection{Parameters}
+\label{sec-dataset-params}
+
+\noindent
+{\tt dsc\/} currently supports the following optional parameters:
+
+\begin{description}
+\item[min-count={\em NN\/}]
+	Cells with counts less than {\em NN\/} are not included in
+	the output.  Instead, they are aggregated into the special
+	values {\tt -:SKIPPED:-\/} and {\tt -:SKIPPED\_SUM:-\/}.
+	This helps reduce the size of datasets with a large number
+	of small counts.
+\item[max-cells={\em NN\/}]
+	A different, perhaps better, way of limiting the size
+	of a dataset.  Instead of trying to determine an appropriate
+	{\em min-count\/} value in advance, {\em max-cells\/}
+	allows you put a limit on the number of cells to
+	include for the second dataset dimension.  If the dataset
+	has 9 possible first-dimension values, and you specify
+	a {\em max-cell\/} count of 100, then the dataset will not
+	have more than 900 total values.  The cell values are sorted
+	and the top {\em max-cell\/} values are output.  Values
+	that fall below the limit are aggregated into the special
+	{\tt -:SKIPPED:-\/} and {\tt -:SKIPPED\_SUM:-\/} entries.
+\end{description}
+
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+\chapter{Data Storage}
+
+\section{XML Structure}
+
+A dataset XML file has the following structure:
+
+\begin{MyVerbatim}
+<array name="dataset-name" dimensions="2" start_time="unix-seconds"
+        stop_time="unix-seconds">
+  <dimension number="1" type="Label1"/>
+  <dimension number="2" type="Label2"/>
+  <data>
+    <Label1 val="D1-V1">
+      <Label2 val="D2-V1" count="N1"/>
+      <Label2 val="D2-V2" count="N2"/>
+      <Label2 val="D2-V3" count="N3"/>
+    </Label1>
+    <Label1 val="D1-V2">
+      <Label2 val="D2-V1" count="N1"/>
+      <Label2 val="D2-V2" count="N2"/>
+      <Label2 val="D2-V3" count="N3"/>
+    </Label1>
+  </data>
+</array>
+\end{MyVerbatim}
+
+\noindent
+{\em dataset-name\/},
+{\em Label1\/}, and
+{\em Label2\/} come from the dataset definition in {\em dsc.conf\/}.
+
+The {\em start\_time\/} and {\em stop\_time\/} attributes
+are given in Unix seconds.  They are normally 60-seconds apart.
+{\tt dsc} usually starts a new measurement interval on 60 second
+boundaries. That is:
+
+\begin{equation}
+stop\_time \bmod{60} == 0
+\end{equation}
+
+The LABEL1 VAL attributes ({\em D1-V1\/}, {\em D1-V2\/}, etc) are
+values for the first dimension indexer.  
+Similarly, the LABEL2 VAL attributes ({\em D2-V1\/}, {\em D2-V2\/},
+{\em D2-V3\/}) are values for the second dimension indexer.
+For some indexers these
+values are numeric, for others they are strings.  If the value
+contains certain non-printable characters, the string is base64-encoded
+and the optional BASE64 attribute is set to 1.
+
+There are two special VALs that help keep large datasets down
+to a reasonable size: {\tt -:SKIPPED:-\/}  and {\tt -:SKIPPED\_SUM:-\/}.
+These may be present on datasets that use the {\em min-count\/}
+and {\em max-cells\/} parameters (see Section~\ref{sec-dataset-params}).
+{\tt -:SKIPPED:-\/} is the number of cells that were not included
+in the XML output.  {\tt -:SKIPPED\_SUM:-\/}, on the other hand, is the
+sum of the counts for all the skipped cells.
+
+Note that ``one-dimensional datasets'' still use two dimensions in
+the XML file.  The first dimension type and value will be ``All'',
+as shown in the example below.
+
+The {\em count\/} values are always integers.  If the count for
+a particular tuple is zero, it should not be included in the
+XML file.
+
+Note that the contents of the XML file do not indicate
+where it came from.  In particular, the server and node that
+it came from are not present.  Instead, DSC relies on the
+presenter to store XML files in a directory hierarchy
+with the server and node as directory names.
+
+
+\noindent
+Here is a short sample XML file with real content:
+\begin{MyVerbatim}
+<array name="rcode" dimensions="2" start_time="1154649600"
+        stop_time="1154649660">
+  <dimension number="1" type="All"/>
+  <dimension number="2" type="Rcode"/>
+  <data>
+    <All val="ALL">
+      <Rcode val="0" count="70945"/>
+      <Rcode val="3" count="50586"/>
+      <Rcode val="4" count="121"/>
+      <Rcode val="1" count="56"/>
+      <Rcode val="5" count="44"/>
+    </All>
+  </data>
+</array>
+\end{MyVerbatim}
+
+\noindent
+Please see 
+\path|http://dns.measurement-factory.com/tools/dsc/sample-xml/|
+for more sample XML files.
+
+The XML is not very strict and might cause XML purists to cringe.
+{\tt dsc} writes the XML files the old-fashioned way (with printf())
+and reads them with Perl's XML::Simple module.
+Here is a possibly-valid DTD for the dataset XML format.
+Note, however, that the {\em LABEL1\/}
+and {\em LABEL2\/} strings are different
+for each dataset:
+
+\begin{MyVerbatim}
+<!DOCTYPE ARRAY [  
+
+<!ELEMENT ARRAY (DIMENSION+, DATA))>
+<!ELEMENT DIMENSION>
+<!ELEMENT DATA (LABEL1+)>
+<!ELEMENT LABEL1 (LABEL2+)>
+
+<!ATTLIST ARRAY NAME CDATA #REQUIRED>
+<!ATTLIST ARRAY DIMENSIONS CDATA #REQUIRED>
+<!ATTLIST ARRAY START_TIME CDATA #REQUIRED>
+<!ATTLIST ARRAY STOP_TIME CDATA #REQUIRED>
+<!ATTLIST DIMENSION NUMBER CDATA #REQUIRED>
+<!ATTLIST DIMENSION TYPE CDATA #REQUIRED>
+<!ATTLIST LABEL1 VAL CDATA #REQUIRED>
+<!ATTLIST LABEL2 VAL CDATA #REQUIRED>
+<!ATTLIST LABEL2 COUNT CDATA #REQUIRED>
+
+]> 
+\end{MyVerbatim}
+
+\subsection{XML File Naming Conventions}
+
+{\tt dsc\/} relies on certain file naming conventions for XML files.
+The file name should be of the format:
+
+\begin{quote}
+{\em timestamp\/}.dscdata.xml
+\end{quote}
+
+\noindent
+For example:
+
+\begin{quote}
+1154649660.dscdata.xml
+\end{quote}
+
+NOTE: Versions of DSC prior to 2008-01-30 used a different naming
+convention.  Instead of ``dscdata'' the XML file was named after
+the dataset that generated the data.  The current XML extraction
+code still supports the older naming convention for backward compatibility.
+If the second component of the XML file name is not ``dscdata'' then
+the extractor assume it is a dataset name.
+
+\noindent
+Dataset names come from {\em dsc.conf\/}, and should match the NAME
+attribute of the ARRAY tag inside the XML file.  The timestamp is in
+Unix epoch seconds and is usually the same as the {\em stop\_time\/}
+value.
+
+
+\section{Archived Data Format}
+
+{\dsc} actually uses four different file formats for archived
+datasets.  These are all text-based and designed to be quickly
+read from, and written to, by Perl scripts.  
+
+\subsection{Format 1}
+
+\noindent
+\begin{tt}time $k1$ $N_{k1}$ $k2$ $N_{k2}$ $k3$ $N_{k3}$ ...
+\end{tt}
+
+\vspace{1ex}\noindent
+This is a one-dimensional time-series format.\footnote{Which means
+it can only be used for datasets where one of the indexers is set
+to the Null indexer.}  The first column is a timestamp (unix seconds).
+The remaining space-separated fields are key-value pairs.  For
+example:
+
+\begin{MyVerbatim}
+1093219980 root-servers.net 122 rfc1918-ptr 112 a-for-a 926 funny-qclass 16
+1093220040 root-servers.net 121 rfc1918-ptr 104 a-for-a 905 funny-qclass 15
+1093220100 root-servers.net 137 rfc1918-ptr 116 a-for-a 871 funny-qclass 12
+\end{MyVerbatim}
+
+\subsection{Format 2}
+
+\noindent
+\begin{tt}time $j1$ $k1$:$N_{j1,k1}$:$k2$:$N_{j1,k2}$:... $j2$ $k1$:$N_{j2,k1}$:$k2$:$N_{j2,k2}$:... ...
+\end{tt}
+
+\vspace{1ex}\noindent
+This is a two-dimensional time-series format.  In the above,
+$j$ represents the first dimension indexer and $k$ represents
+the second.  Key-value pairs for the second dimension are
+separated by colons, rather than space.  For example:
+
+\begin{MyVerbatim}
+1093220160 recv icmp:2397:udp:136712:tcp:428 sent icmp:819:udp:119191:tcp:323
+1093220220 recv icmp:2229:udp:124708:tcp:495 sent icmp:716:udp:107652:tcp:350
+1093220280 recv udp:138212:icmp:2342:tcp:499 sent udp:120788:icmp:819:tcp:364
+1093220340 recv icmp:2285:udp:137107:tcp:468 sent icmp:733:udp:118522:tcp:341
+\end{MyVerbatim}
+
+\subsection{Format 3}
+
+\noindent
+\begin{tt}$k$ $N_{k}$
+\end{tt}
+
+\vspace{1ex}\noindent
+This format is used for one-dimensional datasets where the key space
+is (potentially) very large.  That is, putting all the key-value pairs
+on a single line would result in a very long line in the datafile.
+Furthermore, for these larger datasets, it is prohibitive to
+store the data as a time series.  Instead the counters are incremented
+over time.  For example:
+
+\begin{MyVerbatim}
+10.0.160.0 3024
+10.0.20.0 92
+10.0.244.0 5934
+\end{MyVerbatim}
+
+\subsection{Format 4}
+
+\noindent
+\begin{tt}$j$ $k$ $N_{j,k}$
+\end{tt}
+
+\vspace{1ex}\noindent
+This format is used for two-dimensional datasets where one or both
+key spaces are very large.  Again, counters are incremented over
+time, rather than storing the data as a time series.
+For example:
+
+\begin{MyVerbatim}
+10.0.0.0 non-auth-tld 105
+10.0.0.0 ok 37383
+10.0.0.0 rfc1918-ptr 5941
+10.0.0.0 root-servers.net 1872
+10.0.1.0 a-for-a 6
+10.0.1.0 non-auth-tld 363
+10.0.1.0 ok 144
+\end{MyVerbatim}
+
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+\chapter{Bugs}
+
+\begin{itemize}
+
+\item
+	Seems too confusing to have an opaque name for indexers in
+	dsc.conf dataset line.  The names are pre-determined anyway
+	since they must match what the XML extractors look for.
+\item
+	Also stupid to have indexer names and a separate ``Label'' for
+	the XML file.
+
+\item
+	{\dsc} perl modules are installed in the ``site\_perl'' directory
+	but they should probably be installed under /usr/local/dsc.
+
+\item
+	{\dsc} collector silently drops UDP frags
+
+\end{itemize}
+
+\end{document}
--- /dev/null
+++ b/docsrc/screenshot1.png.uu
@@ -0,0 +1,578 @@
+begin 664 screenshot1.png
+MB5!.1PT*&@H````-24A$4@```Y,```+P"`,````])M'[````!&=!34$``+&/
+M"_QA!0```O%03%1%!`($!+($_`($A(*$#$*L[.H$1$)$!/X$!(+\1(;D!`*<
+MA,+\!&KDQ,+$)(;LQ.+\_)XD!"*4_$)$1&*T+&*\)"*$));\##*<I**D-$*<
+M=`)TY.+D9&)D)"(D!';P_,+$%([\1*;\#%;$_'X$[/+T9&*E_**D_"(D)([[
+M%(+P%":,!`)TU-+4'';DI-+\'$*D)'+<-);[9+;\E)*41$*4-(+D!"J<!'[\
+M9'.T?(S$!`+\_(2$_%-4_.7D_&1D_/[\%(KY%!04_!045%-4!!:*%&S4='5T
+M-#0T_-/4_+2T_#0TM+2T_)24_'5T1)CT'%.T_/3TU-KL'$JL/'+$-)[\!!Z,
+MS,S,)(KT'#*4#'KN5*K\'#ZD1)[[)%JWA(J\#(K\E,[\#"*,_$Y\-#*,%#*9
+MI*;,-%:L[.KL'([Z]/+T9&JL-([L'(+L!!!\%#J==+O\A)[4#"J4='*L#!J'
+M#`P,_`P,C(R,%$*D3$Q,#(/\!'+L+(+DU.+T_/X$5%*<1&J\-'K<K*RL;&QL
+M+"PL)'KDG)R<'!P<7%Q<?'Q\/#P\O+R\W.[\M-K\7+#\_$Q,_,O,_*VL_"PL
+M_(R,_%Q<_.OL_&ML_!L<_-S<_+R\_#P\_)N<_'Q\5)[T5&ZXQ,;DS-+D-&J^
+M/$JD%"Z4K+[D%'[L;'J\%'+</%JLK-K\/(KDS,[DW-S<)"J,!`I\-#J4#'[Q
+M+)+[K+K>)$*L/)KT'&[</%*DC,;\S.;\+)C\3*K\%(;\K-;\;+?\/(+D;':T
+M)%:TO.#\/*'\G-#\%$:T/'S<+'[D#&K<'(KZ+(KL#'+D''[D#!Z,'"Z4+&;$
+M##:D!'KS[/;\9&:L%"J4##ZL'$:G-)K\!!J,'$ZN1*+\)%Z\#":2%#:<[.[N
+M')+\]/;T9&ZT'(;T%#ZD#"Z7%$:L+(;JS-;L!`8$_`8$A(:$1$9$!(;\Q,;$
+M!":4_$9$))K\I*:DY.;D9&9D)"8D_,;$_*:D_"8D!`9TU-;4E):4-(;D!"Z<
+M8,DL?````$UT15AT4V]F='=A<F4`6%8@5F5R<VEO;B`S+C$P82!2978Z(#$R
+M+S(Y+SDT("AJ<"UE>'1E;G-I;VX@-2XS+C,@*R!03D<@<&%T8V@@,2XR9"G<
+M>Q,P```@`$E$051XG.V]?8#;Z'W?^8@ZS^UM.O%EV^[)(I%U>K;EU&Q39Y+N
+M1;NKQQCZAK+&V[")0S>VTTW6=L=LZ[AMH#DZUVL[PPZ&I%UIM:N55G9?TDO?
+M63=)G3K;BR_.NDESK9O8EXO?ZO&D=E)(7&9O9K"61[Z_#L_SX.4!"9(`"6"`
+MF>]'$HF7!P\>4OCPP0,\SP^$`@"R!#GJ`@``?,!)`+(%G`0@6\!)`+(%G`0@
+M6\!)`+(%G`0@6\!)`+(%G`0@6\!)`+*%S\G3QY"C^F(!F!&_DT=5BN0XAA\)
+M''/@)`#9`DX"D"W@)`#9`DX"D"W@)`#9(M-.=CNM>;/(VD<"8!IS.EG>UC6M
+M=3#KWC?;6SK1=JVI#96H&T-K%PDQ9\W9`4Z"O#&?DXL&6:<]==;.0#V]896`
+MK+#I!FD$E`Y.@A/'?$Y6B6J]-F=ULK+$2M`DY9&2V!"<NX(3QWQ.$J);K_6E
+MV?9=5]A9*^EIG9&2./FCG@0GCOF<5`AQ&H&'35.UVI6];<7<,XV.H:[0M:;1
+M'U[1[?45I2,V6=@3);A#MIR2'#85I=)C4XU-Q32YDW8&5-HR/'`2Y(WYG-P@
+MA)2*;*JH;M$R;QD2TK9:AMN*-5EOCJZHJCM4YQMWJTX)6M8R7I*BVJ2[3=7*
+ML6&:/5%/NAEX6T8`3H*\,>=UU_J"967;FBBQAJ7.E!'GFQNLD;BY,;J"J#5Z
+MAF_;ZCHE6"0'HB3;Q!+QD)0H;9-%*MJ3;@;>EA&`DR!OS'U_LKS-I=0)ASKJ
+MU31K8:LVNJ)/.OR2#MU;\$I0(@/^KC+_^*NB47L3-P-WRRC`29`W8N@SL,$N
+MOA+%S5%<E]DVZ>HF]:W@%U$;!P:IK%D32MTKP9K:HIZV"G$K55/*P-TR"G`2
+MY(WYG-3O\%?#JML,-T?AY"HI5YAU(RMHL4\JE"Y5Y!)LD77VKHMZTCI1U51G
+M$R\#>\M(P$F0-^:\%])DKYIU%EIQ+\#:]Q1KZB:_2"JMX$Y:6^Q821IZSU>"
+MCB;.89WVY`+IVGFY&=A;1@-.@KPQIY/:*ETK:59]6#;4U;4NL]"I#DMDG;T-
+MKR!E.B`K]/2FG<6NZ+]3YDW.HF:)UU0M,;M$W:BWV>U/-P-[RVC`29`WYG/R
+MP#2(7N(UWJ!C:-;):KE/2(5?4.T2T?8;6M%1J^;*[IIJ-PSW-+N?ZPHO2:^I
+M*$V>WYY).EW"&I-V!FQ+):J2<!+DCB,:%[+93FE'<!+DC2-RLKN;TH[@),@;
+M<SE)9F;V+"(6$4Z"O)'I,<TQ<`P_$CCFP$D`L@6<C)GQ9]>1S[O!R01.1F=B
+MLS:JDR*SF=K*X'@2Q<F+5R[?N)AD81(@`2>%0[-M-SXS&`EL(CCYV.777;WT
+M<J*EB9_DG'1LDBHZOI*(-,[<T"7F8:7]3KI9!VP.3@H1G+QP.=&2)$/B3@X9
+M.N16@'ZAG`Q("4X*P4X^=RT@Z;ESB9<F?E)PDM=FKCMN!3=BU`Q.HJ(\B00Z
+M6;MT-R!I(6AAUDG$23)4F5$ZXB259[W)`"?)Q'H2G#R"G'QLN6!QX:/7[C[W
+MP.U;UQ^Z<OO23?K8.;;P&T=1QGE(IIXD).C<U5D[I4KTU7YV9DXZI](-:'F"
+MDT+PN2NK$M]B*7CK+1<*YRZ]Y:.%1RGJ21?I"HQTC<==Y2T,O,8C)H<S\TGM
+M)8.2)Y#Q3EJORS5ZG;W0Y<L43LK,Z8I_\Y$YF'BB&>/D-?>5O]PMN`MS1@:[
+M04RJ_0(N#8&3QL1Z\J[S<JU`44\"D`KAG+P+)P%(B3%.\EN1<!*`]`EV\G:!
+M]6M%>Q*`]`EV\O';MZ]]]$JA\"RU7B[0"[<+5YYZJ5"XDK<>Z'`2Y`^,U0(@
+M6\#)R(3HADK<E^`,G&P"\QY^&[,_?\^A\5D/=6.8\!G2*_70JO"E]O4#/JY=
+M*N!D9$(<"!-O,GI]Z4:M"!H7$IR1U"?(US5/SEKN>SN\OS&^I%)J?P'#EWHT
+MR;&4$DY&1NY&1Z7;_&-_Y?TU!IEP1(TYN@/J`R(7PWWU9^W;^W`64^NF!$L]
+M5,#0I0[4]O@!)R,C'2Y#AR#Q)7%_Z8.KJ'%G7L0>=2*_C:O5O-\"J5[Q)N1C
+M?=B1`,72++5;^BBEAI/'@B3K2?<MP$GO-W_T-&[2F9=32<B'-AU_=`>+0X?%
+M&:?8L),9+S6</!:DYV3`P2.]C60@'5\!E=%PGJ,IW45CMA_>8W@GTRAU<!4\
+MK=1PTF*C8Z97E$3(EY.!>09[X.4J'Z#^@U7>48).1BZUWZWPI1YU\EAZ.=')
+M+1+Y>8]9(W$GJ:]U*241_T;/`H>OY/M%\:WSOP6FI-Z.W(63<_%]BL#F6O*E
+M]B6)4&I_GN/:MGEG<CWI/DPRM\SNI'U,Q%>4<;N))67@RN0.V7R6.B?`R3'8
+M=5#R4@+@!TX&0]Q72`G299J3K>Z"4>4/3E[J5'5].Z5BQ<;,3HJV#96_(0).
+M++$<C&&//7DFP$GC=+=$+!-K';.7QVISGGJ2!->3J#A!H@0Z6?)66Q+NL(NO
+MI\DBF\W=95@X"?)&H).;U:*SVK1?3,V=S17S.1EXC0=.@D0)/G>]HSBK6_:+
+ML/'D..G<Z@X0$$X"/_=[Q)%=L)/KNK/:J2<UU9W-%4GT&8@_2Y!KTG`RX-QU
+M@=3I26I/3@!.`C]I.'E0<U<[3G9)JTQ[J"<IG`3#!#I)O'Y@$8^8B?="ZAU"
+M-FF?D/X:W3")O@(G*9P$PP0YZ5XDI/$Z.9H:3L)),(SEXAOL?^XR^V8:$5U/
+MO!$R(9X&$]%)M"?A)!AF:CWIWE6S1Y]-S@[U9&3@)/`3YMS5B6,2XNB)XN2B
+MU;*LU":GR1IP$B1.2"?=Y5.(5D_F#S@)$N=^NS$9["2!DW[@)$@<NX[T7>-Q
+M.X)YPXM(B+8DI7!R!N`D2!0X&1DX"1(%3D8&3H)$@9.1@9,@4>!D9.`D2!0X
+M&1DX"1)ELI,W7SIW[I;U_MB%N[>NO36U0L4(G`2)$W,LK<E.7KI\G=ZPE#QW
+MZSI]IO!8'#M,&3@)$H><<DC.27?\Y.UE2E]'Z87"54K?^DS.NM5QX"1(G#2<
+M=.,,/%!XP+*1WEB.8U='`IP$B1/L)''_10S=/3E&5NW"[<*CUVGAW.SE/6+@
+M)$B<0">)Z$X7FY/K3MPZ>O.EPJ-T^?(<!3Y:X"1(G"`G?:,EHSUV9O*YZQ6K
+MJBQ<H\\4/C)?H8\..`D29X*3=G4YOY/N-9["1?I0X7%Z<_GRTS<O/G)SKH(?
+M#7`2)$Z@D_8(YLAGKM/NA=Q:OG3W<>O]XJ.7"]>>QG57CON56?\'\><.\L>D
+M>I)&?XPI^O%$!DX"/W`R$G`2)$Y0/Q[_71`X*9&<D_QW,?[<P8D'3D8&3H)$
+M@9.1@9,@4>!D9.`D2!0X&1DX"1)ELI,;'7/L7#Z`DR!O3'1RB\@/"/'/Y00X
+M"1(GU3'-0P\(R=_C0N`D2![R"@<X&0(X"1('3D8"3H+$"7;2?CY(]//9:4ZR
+M%N2]:D<C[(G-I-5=,*J]J/LX2N`D2)Q`)V<8$.)N*1%<3VZ1,[1.FFS..-TM
+MD>T9=G-DP$F0.$%.RL_2BIJ=/.,<P"5OM>5DE>Q2JFOVW$Z^+K["29`X$YR<
+MY5+LY#@#W,(.6:-45>VYG#4JX21(G$`GW:<RQ]2>=&)D\?;D/;*YNT3:]AQ%
+M/2G>X"2PF7SN&I.3Z[JSFE6*>RVBK[MS)Z.>=&X`!WRA<!+X2<-)_[DKI0L[
+MTMP)<=)Y&_U&X23P,WY,\RRW0J;$R!("UDA[K^S.G1`GB?30ZZ%5X@U.@F28
+M>"]DL4-(LT@/#8T0?:_>8?<H^X3TUU(LX)S,4T\.GWH0'R+^"C@9Q'$L1CGV
+M7((/X'6C3'OK1$NE/'$SSS6>,<T!U),@44(XJ?&+L+H2N#+KP$F0-T(X:9(]
+M2N]IJZF4)V[F.W?%-1Z0/B&</.QK>K64JUZN'C/7DW8;`O="0-H@]D=DX"3P
+M$_.U(#@9&3@)_)#_T0%.A@!.@L1)Q<G7Y/%Q/8'`29`X@4[R$UEQ.ANQAUVP
+MDTI_[G)F!#@)$B?(2;G322Q.5G,U;GD2<!(DSC@G9^R)CO9D9.`D\#/FW)5.
+MO,T](3MY!DZ&`4X"/V.N\;CMR1B<W"TI)J6]OJ)TK+FUDMEI+<U9ZB,#3H+$
+M&7?=U7ER>BSU)`_YH>U0G=)]O=.@VZ0XNFDN@),@<29>XQG7'6Q"=O*,STFB
+M4GJ&T@-2I_3>]NY\I3XRX"1('$(,CJ\?C^\N2!Q.MBA=(!TVD%E7YRKN40,G
+M0=X87T\V#@AIKE&2SS%:#G`2Y(WQ3E):[),*58VTBQ0K<!+DC?%.-JVJTCJ'
+M+9&M]$L5'W`2Y(WQ[4E2IHMDA?8T;;U7/IW3X9-P$N2.("<;'6*T:4>MFBO6
+M7*^BD=;Z$10M%N`DR!OHQQ,9.`G\8$QS).`D2!SRI`.<#`&<!(D3["09\SH]
+M.WD&3H8!3@(_@4[Z!T]&Z8D.)R,#)X&?(">#A0PE)9R,#)P$?N!D).`D2)Q`
+M)_E5V-'7,-G),]X!7&YJ^F%<13Y*X"1(G%3JR:)VIEX=Q%+>(P9.@L1)Q<F#
+M?#Y$*P`X"1(G%2?U<,]][;9")3M*X"1(G%3Z\81[%G.CFOU'-L-)D#>"G"PJ
+MS/@-/MW;5LP]T^C2PZ:B5/CH$&=J7V7)-E,N<$3@),@;T^M)0MH-RU.U27>;
+M:E&>"EF='BEP$N2-$$[RZ6UBU8R'I"1/P4DX">(GK).JZKQZ4W`23OK`%Q(+
+MX^,,4+-EMIQI6S^%R%/VJDP#)U,$7T@LA*TG14A)59>G4$_B$)0XN5](ZO="
+MQ'3);466I/9D]N-,PLG4.+E?"#GKD*J31:U):5/MR5/4(.4XRI`DB3KYY)/Q
+MYYY73IV"D[*3$?ON^+*39^P#N-PGI'(H37>MB5Y349K\_J0WM6*05L8C32;J
+MY-FS\>>>3^Z__WXXZ7>2\+\T)B>/$W`R%4Z=0CTY7$_:3_")?CH+)R-C?V7\
+M_R#^W/,)G!SCY`Q*PLGHI.2D=3J88.ZQXIZYPDEOF?0O:G;R#)P,0TI.YN@`
+M/W4*]>08)W'N.DJ(CS3NKA)Q7P*6I^-D+NK*4Z?@9.+778\34S_2V'N]8Q]$
+MGZZ36;?2.VV%DW`R%-,^DM`Q0$KWN=<!:SAI.)F#P_S4*3AI'3X:_Y-$/Y[V
+MZ6-&>ZJ30=\#M9L"0TX2'^)W,3FL`YSPPSS!?<3`D)-'79RDF%NT"*2ZLQP1
+MY*2WBH%ZDH-Z,G;\]22K6([5W].SGHZ+'T<X.14X&3LGO3W)(,&G"QFXQI.#
+MPQQ.Q@Z<%#T3Q]WS.-I[(3DXS.%D[,#)R'=V\^MD$C=6X&3LP$GOKD=(>%+K
+M\$[<2;O+6EP9\NSBRLP%3J8TIOGX$+(?3Y0ODR<]Q4:%)%U/QGN8)^,,G+2.
+MB/,.<#($<USCF9`<3OISA9,C3HI*T[Y\'ZT"3=G)C4[*(7R2ZH,.)^5<X>2H
+MDP'_PF8GSR3DY!F%&(JN;]?I%DD[U-WTOG61LX23([G"R;PY*6+ZE%MD0%,/
+M=1>BOVM4*^'D2*YP,I].T@'9'G$R\2=S3?](D:6$DR.YPLDQ[4G;QRRV)X6)
+M[+S5[V3R3^8*=8TGFI5P<B17.!E83SKO$0<VI^0DJP[72-6>&GHR5Z^O*)V$
+M]ASJ(T7['8.3([G"R2E.1K^P[Y!L/;E'5L34\).YJNH.U1/:<\B/!"?GRA5.
+M3G,R@^U)A38V5'-'2#C\9"ZBUNB9A/:,>R'^#./*S)_K27<RC_UX6&F5E34J
+M)!Q^,E>?=!*+IQZN'T^DKQ-.CN1ZPIV,F32O\?`I]SJ/]V2NQH%!*FO)[!E.
+MVL3<>=8%3L9.ZDZ:04_F*O9))9D]AQL7<@+ZUB7E#)R,G12ONXHI<_3)7$U*
+M=Y+JWP,G_=G%D]EHOG`R/HZBGAQ^,I?U;\"NR29!V'/7"%G"R8!\X61\I.'D
+M8HN03I=/=0CI%WU/YC):]SIJ54E(2?09&,HNGLQ&\X63\8&Q6I&!DP'YGF@G
+M<WDOY.B`D_[LXLEL--^3[>1_ZY`;)X\RJNVL,9>G;0(G_?G"R6$GB1QA/X/]
+M78^.F9]-,&$3]@(G_?G"R2$GO;[G46.PG7@GQS_#9_P6[`5.^O.%DP%.#ID9
+M.CMYYB0Z&7T`)9P,R#>HL"?&T#'GKA1.!H)K//[LXLEL-%\X.7J-A[A.SC`8
+MT`%.A@%.!N0+)P.NNY)8Z\G'GKU1N/'L8_,4-!O`27]V\60VFB^<G'"-)Q8G
+M+R[?NEJ[>FOYZKRE/7*2=3+)BQIY=S*I'6:0:?="XG"R=NY:C;U=N\'>GKLV
+M9Y&/$CCISRZ>S$;S/=E.IM"/Y^G"-_C[-PI/6V9>NAO'CHX(..G/+I[,1O,]
+MT4[&3*"3MPK7^?OUPBWZV'+!XD9A^5EZ_:7"2]<?OW;W&]=N7WK96GWQRMWE
+M9ZV:].9+Y\[=2KG<88&3_NSBR6PT7S@9'X%.7EZV)Y;91,&J)VO+K+)\^5'Z
+M%DO0*U??>OGR3<O6C]"KA<<IO73Y.KV19J$C`"?]V<63V6B^<#(^`ITL.&>K
+M=PO.W.,%JV:\\!R;9?H];;GX#!/VG#5WVYIX76HEC@:<]&<73V:C^0J>?')D
+M:>P[//X$UY-.K7?CLO528-=X;A:>I35^L8<K^ECA$KU1X%#Z0.&!S%Z@#3=^
+M<M8X`W"2^HQT;P[!R3D8TYZL\?=:@3431:WYP#)]W=/4G;5$+9RSD]<NW"X\
+M>CV-TD8GV>=/PDG92>F&+9R<@T`G'RD\Q=^?8M==;0F?*KSE"O?.KB=?HLNW
+MW0UOOE1X-(7"SD!2SVF&D_Y\3[23:=P+J=VXQ-\O+;/ZTJX/EV\]P]^YDV\M
+MO)4^:IM+K[`:-:,W,>&D/[MX,AO-5YRYGE0G_S>'!,<TOWSYRF/TYA71C^=V
+MX2)[XU=YJ%#TZK(E[<7;RT]=?\XZN[76/\2NOV:1T/%=PV<))P/R%4;"26FA
+MW(-'&B,R_6`;U]_UPO)EI[_KX[=O7_N(=7YJUX2%V^?.W7B<5:`OW[J]?,72
+M]M;RI;L953)LC"Q<XYDGWR<=(^&DMXP*`[TQS>*R18@C;>RXD(<*'_&G?/FM
+MXKV0JVX].;\7\F3FG61?PED/_]Y.N)/4=M+IB4["!1P8ZV3M\KFK]'K-6W#!
+MGCZ63F:PGGR2^7CV2?>6WYPDYZ0/_][@I.NAZ^3TD[+QXR<?NF2=LUZT9ZZ]
+M]%&[FJ19O9H33-@XZ-EK3PHG8QL/!B>38ZJ37$1OW-:T[.29\0?P`[?M!N/5
+M*X7"E1R-JPSIY.A7-3[@6$I.\MSA9!Z8Y"0E_E&4\3F96\+&R!K^JB8$'(.3
+M,G!RXC4>.#G*/''KQ@P0AY,R<'+ZO1#?Z\SW0HX-8<]=`Q:/#!"7(T2[3H8+
+M*#T#KI/Q9&=E]HI7//ED/)E)##GI[<TF]AT>#9./H)#I0@(GQS.IGA2WY/)5
+M3\:7F03JR=B9Z&17(8:I*)4]:WI+)]JN];ZA$G6#TO*VKFFM`^I-B<2F(GXK
+MNA7%,)3F/3NG_4V=Z`?[B7^<$<+V&0CZ@9ODI#@"DW7R25]WM3F!D[EA2CW)
+M'QRYH71VV+1X1F2#-"A=-,@Z[:E$GK*?,MFT)AL5X_0A;71;]G,GRVJGWJAW
+M]'JR'R:`6?O63;O&DX:3_L-\3N!D;@CC)-U7%]ATDSW`56Q2)>SYYTP_;\I.
+MO*Y3VM<&(D/A9$-OL2JV82KLK9O0(YD#F;D/.IE\+X0?@.?A))R,GU!.TCMD
+MU9KN:1UG$T(L\VA]29[RGL:\1^R<RDO\;9V<L9>O6V9639H>28T+84:>AY-P
+M,@&F.2GJM#HY8$GOD"U[$ZO5N"%2>%,B<<7ZUR=KOEPZ['378H=TK#J7G2GJ
+M1%VA:TW27VN;YD:+=%B]>M@T5=9"[?45I1/3YPOG9*0+9G!2!DZF?=W5KOH:
+MI,J3MM0=L<F&M?M2D?JF>.*:84VHJC\7S9G7-3O9KJI84XL5NFIMWAS<,[0B
+M+:I;M,S:K%5K+WH<'R[P(P41?5P(G+2!D]81\=\[).=DR5MMGV>R*I!=T!'U
+MI45]P9*I[9]R?RG(T-FI.Z^X:U=(W=I/E\TR_9;()BTQ<W5KCJ@U>B:.#T>3
+M&Q<")VW@9#I.;E:+SFI_/4E+9.!L4MZV572G6.(&JR?UX7K2J?7<>I+V+`EW
+MJ^XN]JT=Z([3?=(IQ_'9Y(\T'C)3'W0X:0,G@YUT+MS/<#H;?.YZ1W%6^]J3
+ME*ZI+6^3#:+ZIKA=3,XFZ?EVTB&[_+U!.FZ>"RH]<X<Z6[&%Q-EIX\`@%7^+
+M=&9"]:V;X3G-<-(&3HYQ4AHY&34[><8]@->=BLVN)T_SZZYL:HNLLW>=ZZ0;
+M\I1WBMH5=S(I'8B*](Y]&6B#77>UDVV0U?Z.NXLBZ5/5<`M2[)-*U$\2S'0G
+M(_^6$?L`SY>3L68VFB^<'.MD].SDF7'GKD5Q?Y(OZ6C<_2:;UA;D*:=2M3S<
+M)ET^N2*6[.C\+)5657;]U:X/U8YHMO*M[I$M6G$NX#;9%=J8;F*&<S)2EG`R
+M(%\X.7+N2F8XMNQ-)9P#^,`-+\"=7%5:UIGDKKBA41;M+VV5KI6TNCSEU)/L
+M_'2;;%I+BJ9=<P[49I$6FRKOQV.(K@=MLBAV82E:5RUIRX:ZNM:UMK;6#YR:
+M=EYF':LU:0LX.9HOG`QV<H93U\GW0A9U8BB*7EVWFH-[&N_GRJZ86B\'ID'T
+M4D^>LA(3UM]5L?N[6K-Z?\O.J7B@:OJFZ.^Z8I#J/4I[=DUH;:7K*\SW0<?0
+M*I:V';6JQ*1DLDX6X"2<I&.O\=@'54SMR018)%M#"^S^Z<,W3N(EF7LA<'(X
+M7S@9Z&2,UW@2H*$I`]K8]18<-.P2)-K]-?Z/Q(XS[F2A`"?A)".H'T_L]T*2
+M8+%J&"WGOF.KWUYR2I"S>M(^UN"D+]\@)Y,=-W-\.:(QS0N&W6`L]PFI%"<G
+MG@<XZ<\NGLQ&\X63\8$X`U&!DT'YPLGX@)-1R:63IYQ@Y7%DYL.OY/WWWR_O
+M#T[.`IR,"ISTX7?2^4+<_<6_P^//K$YV.VE&"Y@=.,F!DSDBR,E%A1B*KBYL
+M!&T@&)!D+Y?&1NAX/*$O6<-)'W`RI3'-3+A>ATR0,N%;&+$1WLFP7R><]`$G
+MK2.HX)"PD[1')@7@.#Y.,B)$Y(&3/H*<O/_^^V,M?=9)Q\F6]SINPV/5GH23
+MLQ+DI%=+GF0G9_9S0CU9)GPPU5K)[+266`0K1:GPL<J-3<4T>1(6U6JS%F]4
+MJW@)>^X*)V<$3HYQ<L;!DW2"D[N+539"B^[KG0;=)L6>6J&[3;5H*=DR>T);
+M%M6JSD95=;3XHEK%2T@G(^0()WW`R6`G9^I][FWJXCG)$$..#U@PJWO;N]OD
+MT*H7V<(V'[#,G.11K10>U8K&%M4J7I*]%Y+D,0<G<T,Z3IIT9TD,*W;B78GX
+MD"S:E<*G6'M2=2Y8+L08U2I>0CTO)%*.<-('G!SCY.QW1B:T)[=YY&0G<I6X
+MSFH29PF;EZ):$=*,*:I5O(0Z=XV48ZZ=C/]D&TZF5T]2NLKO3SJ1JT1]J5KU
+MI*8Y21*):A4OLS]_<AQPT@><3-/)!A]/5;+C`Y18>[)'MEGX5:<]*4>U:F3S
+MY@B<Y,#)))DPIGFF[.09OY-T0=^Q--2T]5[Y=*^G5FJ47W?M$GVCWF;GK2*J
+MU0*/:K485U2K>)GU67?C@9,^X&3L!#G9U0E1>I:.56UAG_8J&FFM\_N3>I/?
+MG]Q32+5+F)2##M$J`Q[5RLRDDG!2`"=S!,9J105.^O`I>1Y.Q@"<=..+A01.
+M^I"-/`\GXP!.4O'`D-`YPDD?<#)VX&34YS3#21]P,G;@9*:=/)]Y)\^?YS*>
+MAY.Q`2=GNN[ZY),I.6D11V9).BD#)V,`3D8=&&+7DG!2`"=C9YJ3&YT)\03$
+MHP;*34T_E)\Z$)SL:$CH7@B<=/`I68"3,3#.R6Y%,0REN4TF=9G3^]9+43M3
+MKR[RR4G)CHB$SEU3<-)IHL7G9"(/YX.3L1/L9*-BG#ZDC6[+G!AWI\J&6!YH
+M[N2D9$=$_$[RR@9..L#)V`EVLJ\-Q(+)3G+T"0FZ1]XO/>RY:V0GK0,03E+A
+M9*$`)V,DT,D]8D^5EZ8[.2%!HWKDP>UF=M*N.D==/7OV27;5-2TG"X4X,DO%
+M23<8"IR<BT`G^\0;G\S:DVN;9DM;*+JQL,1;HZ2T:%%A)WY;;-)*=V!V6O?<
+MY/L\#L&!6.>$V%IKM\S%OM'JI?/Y9CUW=1X?."JE>X,\#2?9F+PX,DO.2>:C
+M.WP03L9!H).J*B6PJKH66:*+I&FU#%4>"\M^$U6DJ"?9ZYH=3LM-+JTKJDT1
+M8JMK'?^=;INO3H'P<>L"5@0.@DO/25'U9-Y)&3@9`X%.RJ>C;'JSM$AW685)
+MU!J+A66_#3MY0,H\G):;7%JW37IVB"U*]%V_]DDRQ[T0,CPP552H0TZ2I'"=
+MC",SR<DXLI,8<=+9FTW,NSLJYC\2(QUX'LX!K`_5DQ;U=3;1%[&P[+=A)Z7-
+M1')IG7"0O_*%9DJ?<KJ3]G<^VJ"DPTX*TJHG>2,MKGK2:0*CGLP!@4XVB=?:
+MX_7=NKE99Q.-`X-4UIPWL<Z+F>Z&S'*2R^NXG0H_R#/EY+A?0O<*S[%P\JQ]
+M\P9.YH!`)[M.'(]!VS[Q'#A6V;&PQ-MP7:C5^%9>\N$Z5'5;H=EQ4KP&*CGI
+M&@\_!.'DD)/B"X&3<Q%\?W*;A\&BM"WN3QJL`F0334IWK%K/?AOV;IN(N,MN
+M<BGL9$EJ3[+*,UM.CJKG5)U!]T+RZ:1TKR).@ISD9\IP<E;&]*W;)IMUJS8T
+MA9,*&:R=9GZ1,AU8=:C]-NQD3S5X."TW.37851]QW56S1&ZJ/6>#5F:<C-J(
+M3\])FS@R2]=)]_0>3L["^/ZN.B%Z?Z5#2+/7U;7FH4F4_8Y:559JE+_1G0[1
+MVN4^(95#/FG5@Q7-:!NK#J,``"``241!5*WO.LG7Z(IAS8MUO::BL!!;Y2:Q
+M=-ZTLCU,X_.%OL83&CCI`T[&#L9J105.^H"3L0,GHP(G?8QUDMU>A9.S`">C
+MDE<G>5XI.QE3#_H3!IR,"IST`2=C!TY&)==.ON(5KX@C.PDX&3MP,BJY=C+^
+M`L/)V(&348&3/L8XZ0ZKC'EW)X'I,;)8KYO7U)(OB=A3W,!)SA$Y&5/I3Q@3
+M8F01$2.+];I1PD2YNK>@$JUZ,&-!MLC4B`:S`"<Y<#)'C(F1U=3:AW37C9%5
+MW9Z:4;&J[#5HO3-[GSDXZ2/O3L98^A/&N!A9=;%@2HRL16]E2]]G;V?@9$S`
+MR9/*F!A9=\0$BY$UH94GQ<!:LA^QWIL];F0B#U^'DQPXF2/&Q,C:]Q*8=+>D
+M,/<.FZ:Z67."7%4/Z1J/@;7)DRV0'2\?.Z47&,MJ+K86-"OQ]K9N[IE:EX71
+M4A=Z5F:FN=$BU0'?4W?!J/9HAZB;=*U)8HG4#"<YJ3L9:^E/&,$QLG0I@3,>
+MJZANT3I9H:O$"W+EG6YJTB9.2MI3*R(P%KU'SEB+^":DW1!1M[JDPC-K#NYI
+MFI6&:.WN`=FF-97ENEB)Y?/!20Z<S!'!,;(4*8'C9(E%"E!XH`!U5PZMXR6S
+M<5-NDT-[('.'6)OHFIMPL]1ULF8Y+K':ELTVV`GL"HM34%J-Y?,EY*1]:I;D
+M_3<X>5*9'DO2B:NCN@,-O4`!7A-0;++%4JRZ*<5"5H566<18O\;U.UYHNR+I
+M2/;W+$-WJ_%\/CC)@9,Y(M#)BAPCRS'%JSR]@#I>[=BTFZ`Z:7@IQ6J6<HML
+MUI9(V]OD#@NCY0]3X,TNJ/3,>CR?+VDGX^_4[0`G3RJA8F2)"%B&NTV`DWM$
+M2,06NRFEP%A[)E'XQ5Q1M6Z3NBQAD34UO4AW&V2UZ45BGXOXG72?&0`G&7`R
+M=H+O3Y:(:,W9,;+X2X5L.-NX`76DAN>"QNM6MMA-66+MR1[A'0X6=J2-Y3!:
+M[&6+W/-%]U$[TSLIA`-.<N!DC@AV<K=DL!A9/:<?#ZN]RH:ZNM9=H')[4L3`
+MXJQ5]:T&7=.)E+*G5FJ47W>ENZ2]Y\5I9E&W]D48+?8R4*O4Y^0*68SI\\%)
+M#IS,$6%B9)4[Q+":@H,.T2H#>MAD]R17V'(>`VO+V62I:A"US_*P4_+`6'J3
+MUY\]0R-$W:BSD%I=*WM=JY19U"U*#$715QK4VHF5K;6ZO\9^#.+Z?$DXZ3XU
+M`$["R01(::S6NE6A'BX1+:``03WJ!O?BVG&R3B8Q<-\!3IY44G)2="G0E=$U
+M@4X>-.+:,9SDP,D<D9*3)KOL<\_H!A1@Y#2UU6\OQ;9C.,F!DSDB)2</^YK>
+M.AA]#BP+V=PL^I<M&"OQ[3@A)]U#+B=..D6&DSD`L3^B`B=]1'3R_OOOC[D`
+MQP\X&14XZ</OI.AL*']!0\GAY'3@9%3@I`\X&3MP,BK^@Q!.1G,RN>_K^!#D
+M)%%-Q2"*J1*ZIQ.BL!L37848IJ)4]HZ@C/,`)SEP,D<$.ED67>=ZOBZM_$;B
+MAM+9H7D"3G+@9(X(<M*HV=U9O3'([L2^NI!BZ>8'3OHR@Y,Y8%Q[TGV.\I"3
+M]`Z))P!`2L!)7V9).RF*.S0K`R>G,\Y)TW6RY9^HDP/:ZRM*)X7"Q4"J3L9Z
+MP,')D\IT)X?JR0:ITJJZ0W6:"^"D+[/X@Y7`R=B)["2K+XE:HV>2+UL<P$E?
+M9G`R!T1N3[)ZLD\Z99H/X*0O,SB9`V9J3S8.#%*)*6!.PL!)7V9P,@>$/'==
+M=^O)T_RZ:[%/XHF)G#1PTI<9G,P!(9TTG(DBNS_9I'0GD:=[Q`^<]&4&)W-`
+M.">+Q)Y855IKO*//@,0XR#%!9G>22*\RN78RINR"<X:3\1#L9+=#2)4%A-S2
+MB:&8BDJZ.@]F55W?M99VU*J2#R5G=Y)'?+>^GA$IX>2XG.%D/&!<2#!"1N>?
+M#)P<ES.<C`<X.8Y1)\5C4$:<)"Z^F7EQ=Q%K9O%D%YRSFW]A_.YB_8I29/XC
+M,=J1YP(G)<+5DT\^^:2W"O7DU'HRR:<#'A?@Y#C".>D[QN`DG(P!.#F.<-=X
+MX&3*3IZ`!BF<#,9I1$R[%P(GX63<P,FHY,I)IT!P,D?,ZF2W,Z8?3[<Y_1K5
+M!M_X-;7PNQO9Z]C]#P$G_9G!R>P3Y.2B0@Q%5Q<V@C80#$C@<SZL;2==-^Y6
+M6,[-;;&QT@]30+,9M->Q^Q\&3OHS@Y/9)[B>9`=\KT,F2!G\[!V&.<[)1E-K
+M']+=KO-0RVJ8Y[[6"9$'H'A[A9-A@),Y9+R3M$<FQ?>([F1?JXN]F).%6I17
+MKAS8#V4?WFMFG)0.DE@O],/)0$ZNDRWO==R&XU:.<W*/W!$3Y:6).3>JLFWZ
+M6K4:N->0XU).BI-C#M6L.CE[./23ZR33HDQ*;'JM9'9:2Y0>-A6EPI^,U=A4
+M3),G.6R:ZF:-^H)FM<BF;K16*>T0=9.N-8G=;.R3?2KEOUM2I!S6VBUSL6]4
+M#^F:RNY";-H)NTVZ1`ZI?Z_.5&];-_=,K3M<#+DT<-*?&9S,/F.=W%VLLF%9
+M=%_O-.@V*?;4"MUMJD5+B9;9$]H6U2VKP;=BZ:=Y0;-,TJ-UDRS2FLH$6G3&
+M/JM25"VNEIS#JN5AI]LF3>H_*RWMT3729E/>7KTI2DB[,5H,N339<'*6`^E8
+M.SF[62?720:O)>D!L5J!][9WMUEU=<@6M@E[M"MSHJ1:$XK.GF9`W:!9_-QU
+M0!:LMB`96&F<<+!$>DBSZZ2;@Y7%KN6M2OU.ZI9R3;ZAMU=ORDXZ7`RY-'#2
+MGQF<S#YCZ\F=)3%J65?%(JX+?P:ZPJ=8>TYU^LPO2$&S1'M2T]A%HDVZZ[8&
+M557::VLX!['(=*<$&V+U(I7WZDW93@X70R[-,75RY-SO:)RT]CKJI'_AT!:!
+M3D;Y>DZRD]0Z867GKD[U)@Y_)HU8PN;=JJ]Q0$C3OF<A(MZ9AO6RH-(S[E73
+M"O$>T^Q6<E[ER1<))[UZDC\RJ&&4Z.A>I7IRN!AR:8[427>5F(AV.$5V,BAW
+M.)E#)CBYRN]/JH98).I+UBAD5:!(XJRC<M`L44^JS),-LMIT[RYVG6@A@[8G
+ME)=#D),-=CYKG;RR'7I[]:;L*G6T&%YICJF3(UDEXN34`D=WT@X(%-7)A*ZC
+M99,)3C8,)E&);/%%)=:>[)%M=@'5:<]5G%X%31;WU3[EY%Z5A8!J1^H74+*?
+M--(V/2?=',2BEN])7G1+B+7'$GE[[0^W)X>+(9<&3@X7.D(1DG72RQU.^IC@
+M)%W0=RP--6V]5S[=ZZF5&N777;M$WZBWF3EE0UU=ZR[PH%F+3C7(GY)7;;&'
+M5M(5WA2TV2T9FW5KG=./AVGCYB"U)PWBM`;[XFF7#:,I[]6;LLLY7`RY-"?<
+M2:=`(Y*$*DH,3@YG`2>G$^1DEST(ML?,TA;V::^BD=8ZOS^I-WF3<$\AU2YA
+M4@PZ1*L,>-`LTPF:U2)F2X328O[Y=M:M6#GK_96.U=XK=XC1=G,X;+)[DBML
+M.5TQC-:6G=.2];9O)6^Y>]6]_=?[A%18G3E4#+DTV7'2:@+"2;^33JL83OI(
+M=JS6X%[<.48E.TX*:\+7E<?:218R!4Z.(5DG#QIQYQB5;#C)5H1R4KJ>FJ:3
+M8^^D).6D^$*B.VFEA)-ST.JWEV+-<!:.E9/>MB-ML5B==&:3=C+T?N!D3"P8
+M&8C+G+23Y\]+D>OF=U):/=%);T_V%K[?!H\Q3@X+'*N35MG&.VD7@)7_[%GG
+M4\!)'XC]$95A)R41AY_&,>RD>)V4^1Q.!C:T\N&D+R!G($Z"!)R,=C4\#>!D
+M5$Z0DU.OIU@RS>6D_7U-OV[C)("3QX`C==)==5R=].EWA$[.X]4Q<W*C$VZP
+M_Q&2AI/N_VH()Z<<?JDYZ4]\0IP,3)8/)\_P&%GZ=GW*MEMDW&#_+9UHK-?`
+MADK4C>`D*9&:D^S?1">%-6<GRC#%26_;LVZ5FR,GV;1=`/9-Q>YDF.9OR(5'
+MROB^=>46&_XX9>NQ]201G=L:Y(CO4&;#2?L0G.ZD=+4CI)-GV?['.ND4:,C)
+MX<3).2EG,>3D^?/G9W$RZ*FV)\5).B!3`\M-<+(I>JVF^D"B`'+FI+1ZHI,L
+MP^2<=-:FX23O<AC:2:]N]1&3DQG1<U(?].EAJ"8XV=,Z(_D?`4D[Z?8:<)ST
+M>J>,.BE>Y<Q"."EU(YCL9-#!.NKD*<?@,;N59V=STBK;R+?C?M@A)^^_7S@Y
+MS08X*6Q<(U4O,M9:VS0W6J0S8)&IK+4'BA,J8&W3;&D+16NY8NZ91M?)]PX?
+MY,7R=U*P0%C=!:.SL]@TJJPW.XMM=4#]0:UB)E4G"[P72Z"3O"%T?J0Y%,))
+M*4G"3OINW3A[F<B\3A:XD2&<=`HRCY.GAJ\VR]L.3QXE$^K)/:M)6%2;(C)6
+MEQ#2'-PSM*(\=)&]M,@2713!K7C$*C??EKHC\G=2L#PZJP=$J:ZVV9AC%MN*
+M#[2LJEY0JYA)WDGNF^.D?8SQA)*`DI/^0\I_,$E;>'?C3WF]?\1*-C/%2>E*
+ML)B<V\G@HW4F)YTS"I;NE.!\2DX&7P8[ZWS`;#NIT,:&JNS0;1:P@T?&HFR4
+M%%UB41[]3FZ6%NFN%!W'S7>1'(C\I13Z+MT1T;`T.[:5SF-;U=R@5C&3HI-,
+MHR$GG>/'[^3(+W-8)[UQ3NR8%M>#;">]"R:4CCAY2NIN8SOI'^[O<](IA>\'
+M)/AH]>D7U4FQFA/%R:!.^>*K&,G$OVO^N>0D[H^:\P&S[:2%LK+F!+;RPLGM
+ML_-9OY,6]75YSLVW1`9._G(*-\J'[L2VZDM!K6(F#2?Y_^J33[(CW_[=YPGY
+M,>W(Q&=&G7S%*UY!)3,]"WQ..EGZG10'TWFV_[%.NDK[G702S^:D5_XYG+1^
+MO>)R4BKPR`II*I236;!RTC4>=T+QPN2PZLZ-.B=>ULW-NC<GY;NFMD3^/(7G
+MI!-10(IM99"*_%B0^$C-27[P17;2D\$YBQOOI+,RFI/V71.WN+Q*.0HG1;:\
+M!/9O!?_R!&Z68[08=O+44'EX@9U3;CDSZ4PDO)-';.84)[W(6&)9D44U]U=Y
+MV^PV9F`]2;?(.GL?2N%&W@D,L14S*3O)?O3=$ZE1)ZU5GI/B)-(Y;L8ZR2O@
+M4$[ZJP6[L';+4Y+D['0GQ3:3G#PUU$P=[Z1DBG"2S?/?!L_)@JMBH)->09B3
+MWNZ]\O"OT?TRQ4H1V,&SC!=EHI/.#\@1UY>3GA="V>FGUYYDR^ZQBZG$592]
+M&`H=YR3M:#S`CD)]E:MS[BK'MMH)^?R/J!R!D^X!SEIM]L]O@=MX7ERBL#L&
+M>$>!79?YMG"OGO`D+$MQ9(KCI2#N`U+92>_`]KH4B*->[BIN.^GU>_6.RTE.
+MRE='IC@9].W0$2?%Y2''2;<Z'>.D<\)J?TRI"#3021>_D\YOI+N=_>7;,\-.
+M'I&94^K)HF;YTE39C0MVIEE760CE*KDSN..*J9#!VFDI8A5G5_3?*?-PRD,I
+M7"=%;*L.CVTU(,D,MDS127;D\QGG1(H==8Z3_(`H^.Y1,C-]3IX]&^RD^'T_
+M)8Y,]]"VLW$/\L)X)^7+HV>=U"R=LX6H-MURV94Y,]GYU#$ZR?;%RS7J)-NG
+MTY7)^2SN)Z>BH`41-\0N@JW>6??5YZ2U0]9B/^5T-?:<=!UV+JNQ&7N!DT66
+MG%QLL8=WB.E>4U%$9"Q"3%U?8:H-%*-Y2(C29;&N>EU=:QZ:UIP3L<IB3[/[
+MN:ZP_-T436)L4NOE@+*HR(=TT#&T2IT'M5(2&O^<AI/\M%$<^2-.B@INV,E3
+MHHZ4G72N=H1WTCTK%0>YW'9S#JY`)\75E8*O9A%9.4<GO^;"B^`>E7:.;JTZ
+MULE3_B&5GI/VIQ`7JD>=/"N^*>DTPZNRG`L[O*#\5T4ZH;=_S,Y*3KJ%M3M.
+MV:O8MRM=UW8^DQ/Y0.3C9)$Q)\>DS/P8D"!2=]*YV&*;(#DITK*#]KQ[+)P]
+MRW['SSM=[\[;9Z*VT'XGQ9%I'R]!3LK'_U@G>;/3<](^N!T)Q<;<Q;-G@YWT
+M#O7P3MH_/*-.VE^?X^233XI?+6E?CI/NCX?X!,X'M->?MW_2SCJ&GN55KM])
+MY]MEL,K63N]&(W$R<%:$&&N="!&<3*;!ES!'XN0I<16&'77VS^^0D_S_7%SX
+MX>>\3N]/<=2(H^>\G/]YVU*ING%,=@YR<?R+P^B\TV/(.^J]XMJM2Z=R'N?D
+M>?O=N4HEG=CQ+4^)9NTP9X>[$9P7>3O5[["38LK60?PJB1-GVT<F%DOJ9.$X
+MZ6XA?LS$#YKDI%A\RCL%<'[QQ.=AG][^OL2U,9'`<_*L^R%3!_5D5$8/0_Y?
+M+8[\$2>9`J-.VEL$.BD$'^ND6^^Y?6%\3MJUC#T5Z*0]9V\N#O#"*>\"TWG1
+M9K/K+[L])G9K-^6<\\2`R!]CG.0&V`4?=M+WPV:7B']IKE_.C]LI^TNT/Z#L
+MI/0M";=D)[T$?`7[7W0^_5GGYJCX'W&=/)\#)\NLM5A,NC3QDY*3-IY`GI/N
+M"J]*D`X05\-3YX<9R?V\X^1Y[Q18[$-XX&;E..FH.M%)8;M]++-36:F0(K7G
+MI%VW.D=RD)-^UYQ?"N<+\8H;X*3S;4AGH\Z7Q)SDOQ/>3X^\12!20>6OW/G)
+M]+[RL^X-WO.VE>[_R=FI(U82`+$_HA+"2?<_/,C)P./'/4"DW(*<]-*=$CT4
+M1IV4[KJ(DU0YLV`G_;\44B%M)X,*ZM3<(9P<^8!3G#SO[<'[Y-Z7$O3]34*N
+M2#F\#>WE7AARTCY'<+:-_0":"IR,RNAAR(^30.&F.^G5K$-;!#MIG4E*&=I5
+MB-A]X,$ZZHF[V%<Y!Y=JHI/^2T?3G.0%+[@?,&"KB4QS,J2H([\0H]N.&!S[
+M`305.#F9T?&?8YUTCDCI"!AV<O3P*PQ-!SKI'9!>.G=QH),%7Q[G@YV4ZR'?
+M(>MW4N@T\N,AEW&2D_(G\A4WBI6!3@[E'&!FP;?*VY%/.^^S!Y9CS@-HWF,N
+M62>[S2,8X#SG1R*C4@8Z&7!\!<[(CA7\1\RD:J3@'<W2D1;:R<E9^8_+D9^2
+MD>-_>.>!N8]\'>YY0F&:DZ-:^#-QOS?YN_+E[_\IE+[;L:M&_[O<5?,=0+,=
+M=!).GP&%$/7,&>M5T97*4*2LWF;5/)QE3XOB&>DI,Y^3A([6E$&'>=#Q%3A3
+M&'%2.L*\])-REK:0CC/_8>T>LM.**9=(WKFTRN=D<)&G?QW^U&.V'-)O="NY
+MP),R"MIUH)/#&?MRSY23]D`0.U*6X8N4M:ZU9Q[`8>;<23&T+.1!&&UEV`/<
+M=R!-31C2R=#[=&?"^QAE7[[?I8CY1RG):/Z3_D^<`87I$>RDZ3I)![X!&_?(
+M7LB,%T=O9^;=26GA?%D>V>;8^=%L/L?.AIWD/7?8*&:'?2WLB*I&%4Z.S?+(
+M-L?.CV;S.7;F'L`MKY[<(=6FH6[2G2;IT].D*R7O;>OFGJEUW4!:4D@ME57X
+MFSP9"Y&E+O18KINZT5JE/)P6"[-E>N&Q6+BLS9J;96Q1L^*_QI/G@P,[/YK-
+MY]A9T+DKBY2US4]B*VR4UGJ_I37=0!TB*E9/K8A`6M*4U!6/A<CJLC-@D_1H
+MW22+SEI6#W<T'AZ+A<NJ\^%:(LNJ%E/4K/COA>3YX,#.CV;S.78V[*03*6N5
+MQ4_>W&"1K:Q:KMC2>L[67+QM<F@/?/:F)"=72ETQRW,=D`5G+7LA*F7AL7BX
+M+,4=*TT-L7A^$KB]D^.#`SL_FLWGV-FPDSQ2U@ZENUK;6D8=8;I<.NK.BT!:
+MFBY/^8>1U.^P69&KICEKV=8+(CR6ZE[=$EDNQ!4U"TYBYT>^\WEV%M2>Y%@G
+MKZNL<:CQJ%8UUS<[;A9_Y5&OW"EY&,D=.T26R-4TG+7LI<%&-Z]YX;+L[>S%
+M\P,GL?,CW_D\.PMJ3W*LDU?^E*TJ7[Y#G,LO0DXOD-9P2"W.-JE+YZY4]8*`
+M\*UY>"PO7);C>TQ1LXYA=T%PS`GG)%4W^1V1=6*U)^D>N>-LS5.46"NRQY[X
+MXTU)-9\;1(OGR@.?4\/1MLF>O=7RPF796=J+YP=.@KP1TLD266=ONU6S2,NZ
+M>\=2I.BIE1IUKKO:4]0@3H-0(8-]'B*+Y=JKMEA('Q%FRUIFI5JT+!7ALMRK
+M/\[B^8&3(&\$.3GH$-+:Z%:]2%FT2_;Y>V-3U95V32PL.U&Q>DU%%X&TO*D5
+MPVAMB6UUK5(VB;)O$K-57=_ENQ!AMG06'LM<$?O4*@,W2V?QW,!)D#<P5@N`
+M;`$G`<@6<#(4Q/?F3H8=,#"ZN>A*&VYS.ZF4./+.A\8V1-RY/_$,GWR>G1_M
+M)Q_9./3.9P=.AH$0^<V=#.RB'FIS/AUR<S*2+OK.R<BB*#OW_YA$_^0CA8^T
+M<SGM+%^[G'B6KWVVG<\!G`R!W1/=>2/N)`WWOSNRN;?]],V)^W,_Q\[ES6?8
+MN3,WX\ZES:/OW$DZZ]<N;3[;)R>S['P>X&0H[/\;[W_7/2F;:7-_5B&W=@^.
+MV78N'5N1=RX;/</.?;\G47=.Z5Q?N[SY##N?_9//#IP,A2R5MT1^C[0Y\1\O
+M(;;VIXV\\Z'WB#OWGZ_-\LGGV+D_Y0R?W%?R]#[Y[,3@9+>3X:<6Q.GDZ,4&
+M&N7(E#;WIH_"R<@[C]/)&3YY?$ZF^<EG9XR3^P<ZT0]"=0)?)%E^:D$"UUV]
+M\QC__UBDS9W?[*@'QXP[]V^>JYV[7]Z,7[MO\Q0_^>P$.UE6.X/=>D<--U[J
+MV#OI_KZZ4ME+PET7']V<NE5GZ*WE-MD,._>UBW*V<V=NQIU[F\^R\QD_^3P$
+M.MG03=9]KF8JNZ'R./[GK@"D1J"3ZW9TNCW1\WQJ'L>]G@0@10*=[(@GG_.!
+MDFMMT]QHD0Z+\KIV8'9:]Z@4$ZNQJ9@F=Y(%N3J@7M"KC``G0=X(=%)3[0E=
+MHUWK_+DYN&=H1;JF=QITFQ1[:M..A-4PS9ZH)UF0*SXTLJK&%-TJ'N`DR!N!
+M3KHGHSP>.F&*+9%->L"&1-[;WMTF/3L25EL$H6O90:YT*R51:_%$MXH'.`GR
+M1G`]Z51T.H]GQ0S=)U4[LH<3"8N]*AJU$^A.D*M^7-&MX@%.@KPQI3TIC?QO
+MN>$\Q`)6AWHQLMQ0'XT#@U3BB&X5#W`2Y(TQUUU%=)P-LD1M\8JD3U5-!!CP
+M(F&)AB=+X`6YBBNZ53S`29`W`IW<T?D=QUI+9_<G^>W'>V2+;A/14"RY[<D%
+M_JP"EL`-<M5DU6MV;EC"R=DXBN<2`D%P/YZZUB_3P[[HQ\-.2^MJE47`,M9[
+MY=,]=MVU5E%[+$R/NE%OLXM`(LA5A[+H5H-8HEO%`YR,A!?Z>IJ3HDN+NP%)
+MOGO+B6%,?]=BB?5W%7&Q"#%U?86U,`\K&JFNUZ1(6'LFZ70)LW;0,33V_-B.
+M6E6RHR2<C$I8M6PGI1=(&1-CG/0ER7`WG:G`R8@X_3MMT^SW4=]&G00Q$<;)
+M[+0.HP,G(R+'*;%/3`,K03B9&*@G@8]`)P,J2CB9&%.=Y%&0BRF5)G[@9$3\
+M3GKGKV(A\:6#DXD0HI[,-<?P(R7+&">=>M.7#M=X$@%.`A]!#4E_C"PWH2]\
+M%.Z%Q`:<!&&!=>F0GI.OJ=%N,_7_53@)\L88)]?"Q\B2,9OCURG]Q2,XOX&3
+M(&\$.UE6._5&Z!A9+G5"QFM<W7:>:YDF<!+DC3$QLEJL\_FNJ3<B9;9RX`3P
+M632]5XE`)T=2Q0F<!'EC2HRLI4B9Z6M5\0CG1M5T7V6"G!Q-%2=P$N2-,6.:
+M=_A[@U1I;UNQG#E0G#A8FS5KD6[NF5J+J)MTK4GZSN;=)ETBA];$FLHNC9?X
+MZ[9(O%IBX[]:9%,W6JM4RE6DW73RCCO&%IP$>6-RC"P>Y8/WK6.=7ED<K#H?
+MAT5(NT%K*ENQZ(U?+NW1-=(6V9K2*TLL9DS2HW53!/$Q?2]NWATMUAA;<!+D
+MC<DQLOBYIBL.CX.EZ&Z"%3*P%JZZF[/69U.1<I!?;2>MB8$74<1[<?,FUD2,
+M,;;@),@;4V)D\7J2C0OA\3V\$:]<LYYURKE;=;?>$*L7J;.-\VH[V7+:DYKF
+MYNJ^N'DOQ!MC"TZ"O#$Q1E:#L):=6YFY<;`<S194>L:+E%YA%X8:1LE+,%)/
+MMOCN3(..U)-2C"U"FO'%V(*3(&\$.GG'C9'%C'/;DUX<+'M(Y099]?1IJ/SA
+M(DTWO*3[*A*[YZY45>B(DTG%V(*3(&^,N3\ISDBK*JLO#:<%Z<;!<AN<:F?;
+MW7A+B+3'$XEJSWX=:D_R<.E>KB*5'&.K$>,H:C@)\D9P/YZ!UBS28E.MLYDJ
+MN3.XP\01<;"\D*_L*L^BNW%?W--L&*Q_G<%"IMNO0^W)7K75D',5J=R\K9G%
+M&&-LP4F0-\;T=]T_T#4G1M9`,9J'A`6G&W2(5AF(8<XLB"3M>15:BYBL@\%^
+MAS#Y5@RCM<5?VPL\<:-#C#9+U*JN[_IS%6GMO%F,+3/&&%MP$N2-L>-"%LG6
+M]*T']V(N3NS`29`WQCK9T)0Z;4SI[WH0K3_L$0`G0=X8/WYRL6J0UJ1;A:U^
+M.UIWV*,`3H*\,<>8Y@4C0[&5QP$G0=Y`[`\`L@6<!"!;P$D`L@6<!"!;C'.R
+M6U$,0VENJH3H=4KWV#M_DI87!FM?BJ-5WM8UK7602I$C`2=!W@AVLE$Q3A_2
+M1K=EUH@];LM^]\)@E=7.8->.H[5HD'7:4S,8_Q-.@KP1[&1?&X@%IOM4+?M]
+M<]..T=/03?8D]9JI[++.JVR@9?K16Z<#)T'>"'1RC]A3Y76WN[G]KJRUQ)@1
+M+X[6.@OOP6K1>@:[$,!)D#<"G>Q+85K]3KIAL-QQSSMLW+-"W&%<&0-.@KP1
+MZ*2J2@E\3K(P6`8/@^7&T=(U$?:CE,D'XL%)D#<FQ\BBSB.6"!^!16OZKA,&
+MRTVCL"SJ"U:*=O+%C0R<!'DCT$E]7#TIA<'R"@BRI@``(`!)1$%4XFCQ8!^T
+MO)U)*>$DR!N!3C9)STL@.UEAK<;7\#!87GMRP4ZY0225LP*<!'DCT,FN$WQC
+MT/8YV>#Q>6B%U8SK;ARM):NNO,,F=8-F#C@)\D;P_<EMPD-[T+;__J0=!NL,
+MTW%'YRMJ+=;$)+QSC[9`,P><!'EC3-^Z;;)9I[1HFKYZLB\"E(LP6'6M7Z:'
+M?=Z/AVBK=*VDU=,J=7C@),@;X_N[ZH3H_946X7')-ZK6NR+"8!5%&"Q:++'^
+MKCR.UH%I$+W4H]D#3H*\@7$A`&0+.`E`MH"3`&0+.`E`MH"3`&0+.`E`MH"3
+M`&2+E)S<Z,3W^+I(P$F0-X*<7%0(4<^<L5X57:G8G7.&9J.Q1>3A7VD")T'>
+M"*XG^9A(WIVNW#(&3E+_;,3]P$D`0A'LI.DZ20?N@\R'9F46IQH')P$(QT0G
+M>1N05)VD_EF)1G6ZDVA/`A"*8"=;7CVYXSEIS_:V=7//U+KTL*DHE1ZE:RH+
+M/K#ISEM+2F:GM42E)6SC7E]1.JE\JH"/!$!.F'KNNN>,;Y9F"6DW+,74"MUM
+MJD5GE3>_KW<:=)L4AU)TM!VJTW2!DR!O3'12H8T-5=EQDKJSHG&XS8)*'A(6
+M"(0O\.8/2)W2>]N[0RE8;)`SZ7RLT8\$0$Z8Z*2%LK+C)G5GA9,BXB2/E<5;
+MB]Z\$V-K*,4"'XJ9+G`2Y(VI[4DIJ>F?$J]<7S[IS1-%3N>F:!P0TERCJ0(G
+M0=Z8VIZ4DGI.\HNHHC94=6>5-Z_:P;*&4]!B/_!62H+`29`W9G-2Q$1GK<4>
+MV:9VQ>C-E\@6'4YA;=*TJLJT[XG`29`WYG"RIU9J5%Q5-4A9GN]IVGJO?+HG
+MI>#7>,ITT;V*FQ)P$N2-("<'+`C61I>%Q>JZZQ9;SFRY3TB%3?6:BM[D=Q]7
+M#*.UQ>Y&VO.]BD9:Z]1=LFCEV.QUU*J9LI)P$N0.C-4"(%O`20"R!9P$(%O`
+M20"R!9P$(%O`20"R!9P$(%L<J9,;G<2C#\!)D#?&.+F_Z3XS*R)[.B%*(U32
+M+9)\3SLX"?)&L)-EM5-OU#OZ3$'JG%$A89*BG@1@B$`G&WIKE[V9RNXL6881
+MK=L*G70NX"3(&X%.KA,1#F"/K,^290C1[*A:<!*`80*=[!#1(-PA';K6;IF+
+M?:/%8F%MFBUMH<@7=1>,SLYBTZBR/N>'35,]\+)T&HGV8BD'>J_:T0@AVW94
+M+=*R\JDF^7QG.`GR1J"3FAV[@^H:[1(V'J1-FBSZP!)=M";XHM4#HE17VVR,
+M<E'=HF5O$)93^3F+I1RVK`JXSB:<4`7&Z6Z)CZ],"C@)\D:@D^XI)8^'3O1=
+M$5IGL[1(=WDMR!;M$)4MUR@M,85U-R*=L[6WV,VA2G:YZ'+XD)U$+[["29`W
+M@NM)QR]/'S'*F=;7O=`[[G*=<-PL;2>]Q6[*#EFS(V=)(7T2;53"29`WQK0G
+MQ?76!F$ADCTGU\W-NN1DB_I#8CE9VO6>M]C-X1[9W%TB;3>1J'113P+@$>CD
+M';+!WS?X=5?7J&TRD*LV_L(BW#DAL9PL>;VW+BWVK-YK$7W=2X1Z$H!A`IW<
+MT<7S"*HJN_[JUH>&0N6JS36M8BOL9,D=,Z3%;@Z4+MCA8D4E"B<!&":X'\]`
+M;19IL:GR?CQN?:B0P=II+I._/5DVU-6UKOLD$+Z\2*3%;@ZT1MI[/.XRCZH%
+M)P$884Q_U^*!JNF;K+]KN4G("MTDI%GNZEKST"1*MTF,36J]'%`61?F0#CJ&
+MYCPL=DLGAF(J*J'.8B^'0WIH:(3H>R*J5KO*[E'V">DG%X@93H*\,79<R*(=
+MHS56UHTR[:T3+?Z<QP$G0=X8ZV1#4P:T,4M_UPEHO!6IA^^D/C=P$N2-\>,G
+M%ZO6Z67,S]PQB77:>D];C3?72<!)D#?2'=-\V-?T:BG)_JW#P$F0-Q#[`X!L
+M`2<!R!9P$H!L,8N3&YUY>JC.MW54X"3(&T%.+BK$4'1U82-H`Q[::KCG3;3`
+M6(D'%Y"`DR!O!->33)M>AXR1,J@W7*8"8TG`29`WQCM)>Z0SDEQ:/771*(LI
+M!>&1@),@;XQQTAO=&+C1Z(HP@R"=P%AH3P(PG@GU9)F4V#2+=+59HVMMT]QH
+MD>I`K.X0=9.N-4E?WL*7G`?&JAY:B[9:"[[`6*8=&*O75Y1Q57%<P$F0-\8Z
+MN;M8;;'A&BS259VLT%7+I^;@GJ85^>J:RB1<K$A;<.3D=F"L>SPP5L5-1+1V
+M]X`%QNIH.U2GR0(G0=X8XR2#UY(BTI4B(EU9+TM61<?=6F%!!TINSU5?8"R1
+M7+4#8_%((KKA)F*O#78"2ZR59Q+]='`2Y(^Q]>3.DH@.J?HC7179A1\F5,^2
+M<[?JY6,W$J7D3G"!*@^,I;N)W(',"Z03<Q_W4>`DR!L3VI/;S*7A2%?\E4\M
+MJ/2,%R;=J2<#`F-MD<V:'1C+'X2GP49$)S><F0,G0=Z8X.0JOS\Y%.FJR%J(
+M?&J#K$I"30R,91+ECI=("E97[!.W19H,<!+DC0E.-@QV\BI%NF(+M\@]QRVU
+M(P4PMW4;3MZ:%!BK:;<KDP1.@KPQP4FZH.\X`;`6J#!JH%;=U2MD4<J'N=4C
+M<G(W6-VN'!BKYCEIS2UZCS1(!C@)\D:0DUW6>Y7=/ZQJ"_MTT"%:A=^5-!1%
+M7VG0Q8[5#&2KO2KN#-O"5'0>&(LG/VRR6Y$K++06[;'`6.J&'1BK8P?&6ECK
+MJ%4S827A),@=$<:%#/>)&]P+MXMUJSX\7$HS,)8$G`1Y8PXG#\(-!+&?/I)F
+M8"P).`GR1A0GY<LQK7Y[*>0N3';9YY[1C5BR>("3(&^$=K)L-0&;17=VP0C=
+M$F2!L5H':0;&DH"3(&\@]@<`V0).`I`MX"0`V<+O9/OT,:,-)T'>(-.3``!2
+MQ%]/\IKE6/U%/0GR!MJ3`&0+.`E`MH"3`&0+.`E`MH"3`&0+.`E`MDC,R=?4
+M9M\VQD=OP4F0-^)TDJBF8A#%9.$&J-*?EKR\K6M:ZV!T19R/WH*3(&_$ZN2A
+M",#38YE6MZ>D7C3('=I3`SL2P4EP<HG5R5T[4)TQ-2EEH9A9-)`*G`3`1]SM
+M23-T!UK"(TL.`J,5Q!=A$DZ"O)&0D[LEQ>3/UNHN&`MKBTW^'"WGF5L"A;BA
+M8-=*9J>U1-<VS9:ZP!+R>M*7>E;@),@;B=63EE;\V5JK):)45]LLWKGSS"W!
+M!GM,$`\FLJ]W&G2;%%MDB7;=!W#Y4\\*G`1Y(VXG6Y*3XME:.^(!6YK\S"U.
+MO6]9R9P[('5*[VWO;I:Z4I3TH=0S`B=!WDBNGFSY7MAR[YE;-O5MPI[MHZO>
+MDCON)B.I9P).@KR1Y+FK_,+J3S(:XG65/8/277['W*Q[3RZ()2`LG`1Y(RTG
+M>3WINT>B\T=MZ9JW?)N=P[J;J*'NJ$P#3H*\D7![TN>D]\PMGJ#)7K6.U7(D
+M6WR)H<B;^%//"IP$>2/-]J3WS"V>0%NE.R7-JAI[FK;>*Y\^5,A@_S1QQ/2G
+MGA4X"?)&O$ZR1VZU6/76Z!"C+9ZM52'D@!X8I'GH/:*+<6`:1"_Q\.B]BD9:
+M2[2K:Y6R290-\>`N7^I9@9,@;V"L%@#9`DX"D"UB[8.>"/.5"4Z"O(%Z$H!L
+M`2<!R!9P$H!L`2<!R!93G-SHQ#;B_VB`DR!O!#M9O-?GO4VW2'PC_H\&.`GR
+M1J"3*^:V$[LJOL@X1P.<!'ECW+FK"2<!.!+@)`#98JJ3K>Z"$^!*42K61&];
+MM]J8!TK+FE+,/=/HIEC<R,!)D#?&.>F,@R3&Z6Z);+.054VZVU194"MI:"1I
+M-U(KZDS`29`WPIR[[K"+K]O$JB,/28F.#%?.-'`2Y(U0[4D>BH,'LN*O<!*`
+MY)C>GK1?A'X*D9?%&*\\*>`DR!M3VY-.=2@"/JHZ13T)0)*$/G<M2>U)OYB9
+M!DZ"O!':R:+6I+2ILKLB57)G<,<3,]/`29`W`IW<[U0):76*M-YA4:[ZA/37
+M:*^I*$T>TFJ@&,U#0A3V<(%*IN].PDF0/S!6"X!L`2<!R!9P$H!L`2<!R!9P
+M$H!L`2<!R!9P$H!L,<7)IVY=2ZTHB0`G0=X8[^2M`J4?*13NIEN>N(&3(&^,
+M=?+Q0H&]P4D`TF6<DT]=NP$G`3@"QCAY<_GB7>$DVI,`I$JPD[5+'Z&VDW>?
+M>^#VI9O6U,4KY\Y=L29N/G/.JCLOG+MF3=VX^XV[EY]+N<B1@),@;P0[>>%1
+MZCAY^://72@\PVK.1VOTRO)CU#Z?%2^%CUY/M;B1@9,@;P0Z^;ISEFG7W/9D
+MC9W`/E.PZLB+S$[9R<RW-N$DR!M!3EZ\?)6Z]:2CWO(RFUV^0>TVIGB!DP#$
+M3)"3SUR^>_?:W=N%N]=JGI-"OW,%BGH2@"09WV=`NN[*7FY(]:3G9.:ORL))
+MD#>F.NGX=Z%PD=*;A0O6[.UEBGH2@(0([>3-Y2N47EEF=T4N%1YY^9'".0HG
+M`8B?\4ZRZZY7;Q4*S]*7"H67KM.;5\[=8/<G*7WYW.TK%PN%&U>M%5<R?7<2
+M3H+\,:V>S#MP$N0-C)\$(%O`20"R!9P$(%O`20"R!9P$(%O`20"R11@GNYW,
+M/_IU+'`2Y(U@)XOW^H:[=)%D_Y%V8X&3(&\$.KEB;JOR"C@)0&I,>R:L2(1S
+M5P#2(IR3J"<!2(MI3C8V%=-D3JYMFBUMH4@[1%VA:TW23[.4LP,G0=X8YV1+
+MK&B89D_4DRVR1!=)DU)5L98O5M(LY!S`29`WIM23;;)(17MRL[1(=]G$"AE0
+M6NJF6<@Y@),@;TQQ4M%X(M&>K*^SB1[9I+O5M,HW+W`2Y(TI3@H;^>NZN5GG
+M$PLJ/;.>6@'G!$Z"O#&E/:FI/)&EXC8[9>5.;I#5_EIZ)9P/.`GRQI1Z<H&P
+MAB-K1AH*=6Y4JIWMU,HW+W`2Y(TI3G:)NE%O$]UJ69+!VFG"Q+0O_.0#.`GR
+M1J"3^YTJ(:U.T9K<,TFG2RP7N[K6/#2)8IVU]G+4K0=.@KPQRUBMP;TD2I(,
+M<!+DC5F</&@D49)D@),@;T1VLK707DJH+$D`)T'>B.SD@K:24%$2`4Z"O('8
+M'P!D"S@)0+:`DP!DBSF=W,AZ^"PX"?)&B!A9$]C*?/@L.`GR1J"3FRU_C*Q)
+MV\-)`&(E5#R>2=O#20!B96XGT9X$(%8F.]G4M&TV8'*?]OHL*M9ATU0W:U2:
+M8/5DAYBK:98Y"G`2Y(TI]61%MUZ:9(O2Q05*B^H6K9,5:8([N=Y,L<`1@9,@
+M;TR),W"&'-)&JU^A=&6=TA*+.J#HT@1S<K532Z^\48&3(&],J2?WR1(]TU[2
+M:K15I%0E'&G"<K*L[J19X(C`29`WIEWCJ39ILUPDJWP<LP@S($]0HG9(EH=3
+MPDF0-Z8YV=;VJY:9F^MLG>IT)'`GV+EK12LF7<K9@9,@;TQI3](Z*;6M%?I"
+MW9JID`VQU)U@3NZH"\F7<U;@),@;XYQ4G!4JZ3$S^<EJV5!7U[H+T@2_/[F1
+MX;-7.`GR1J"3:]6.$R.+;O-.`?HF7S'H$*TR\";*34(J;)QS):L!7^$DR!L8
+MJP5`MH"3`&0+.`E`MH"3`&0+.`E`MH"3`&0+.`E`MHC+R8U.-@,.P$F0-^:+
+MD>6R13(:<`!.@KP1Z.2*&3I&EI<1ZDD`XF#>>#P675Y#PDD`8F%^)QM5;B.<
+M!"`6)CNYUFZ9W06CL[/8-*H]RF)C*4JE)U8L]HU6C^[SF`.;E+2LA#Q-IH"3
+M(&],'C_9M73KK!X0I;K:9@-`BFJ3[C;5HEC1;1,6'4O4D,0XW2V1[12+'@HX
+M"?+&M'-7HN_2':+N4JIJE&ZSP92'I&2OH"J+E47<<]>=[%U\A9,@;TQUTG1>
+MV!+NH&2B2:CL9`8;E7`2Y(UP3K;L)<(YQ351."FNN[;<R2P!)T'>F!:/QZO^
+MV!)=U),Z13T)0$),K2=Y]>?X5Y+:DT[=:0>6A),`Q$*T]F11:U+:5'M4JCNI
+M0<H43@(0$X%.[G>J(D96N4F,36J]'-`#0IJ'M-=4E*:E)`N.M4(W^;(5PVBU
+MJ^P>99^0?L:"9<%)D#<P5@N`;`$G`<@6<!*`;`$G`<@6J3GY5S[U8S_\UT<7
+M__4?_O*G_DJ"NX63(&_$X>0/O.>=?^'/LHF?_2-?_IG_&IBD\3>_^/:/_^(/
+MCZ[XX?_Y2]_^Q;^Y&[C1?_V9+_^1GV43?_8OO/,K/S!;V>`DR!LQ./F/W_/M
+M+_RQOV=-_.P/_L<7_LEO!B5I_.'?^TL?^MSS/S:ZYLMO_-R'_M*_^\.-H*U^
+MYI^\\!]_D$GY]_[8"]_^GG\\4^'@),@;\SOY*U___0]][EL_2>DO_-!W_^KG
+M7OAR0)+&/_V]G_^E#WWH;9\:7?5C;_O0AW[I^7_W3X.D_/(+G_O5[_[B+U#Z
+MD]_ZW(?^KZ__RBRE@Y,@;\SMY*_\Q+=;NGWK*_07_I=_],\L[P+JPL:_^7]>
+M^-57OO*7WO:#H^L^]?POO?*7?O7C_\V_"9"2^?K+_^CW?H%^Y9];XO[^?_Z?
+M9B@>G`1Y8UXG?_=/O_[#KWSE*[_UGA_XVL]]VIIX_E,C25[S#W_K71_^Y0]_
+M^,//?W%T^Q]\_L.,=_W6/QR5\E//6QE^^N>^]@-?^98U\>'7?_UWHY</3H*\
+M,:>3?_$/7O\G?]GB6U__R1_]Q(>MB>='ZL+&J[[^^4]S'ORAT0Q^Z'FQ[N/_
+MWZM&I/S4\__LEW_YPY_XT9]\S__*]O$GW_<'?S%R`>$DR!OS.?G:'_F-3_SX
+MIZT_;__*7_[$C[.I_W>X+MSY5W_PQF\3//@[HSG\SH.?$+SQ3_^K82F_^*"5
+MXX]_^A-_^;?>SO;QZ4_\QG?\WU%+""=!WIC'R<:[O_"F#WS;![[-^ON]+_"W
+M;_O`<%W8>/=W//C)#WSR`];?3W[U:Z-Y?,]7/V#S\]_Q[AW_NB\^:&?ZPB?M
+MB?_C"\-II@$G0=Z8Q\F_\>:'W_:]G_RD]?>3W^O\_>J0DZ_ZPMO?\8Z_8_VQ
+M7E_]SM$\OO;JO^/P&U_X/O^ZWWF?G;>[D[<]_.:_$:V,<!+DC7F<?,-/O_C$
+MO_VW[_#]>=/0^>D;?O2%+WWI!>N/]?KB5T;S>.>;ONM+WV6M_"Z+'WV#?]WO
+MO)KEZ&9M_?W@B]_YAM$\)@$G0=Z8T\G[7GS^\R]\_FV??\'Z^WDV]<3W#*7Y
+MSN<?%'\>?#'(R?<\\?SGK3_L[_/#OGW/$V_[^-L^;N7Z@O5NO3W_XHLO_C2<
+M!,><^<Y=/WO???>]^.JO/OB^][WO34\\\:;W??7!%X?:C-_WYH??],2;GOC@
+M?8ROC^;QGA??]VKVY\7[[OOLFX?.7;_VP:]^]7VO?N*#KW[U^ZR)]UE)[OOL
+M%W#N"HXY<UWC>167\N&''[[/^7/?PT-MQIUW?^&S]SG\]F@>?_4^J_)CMEE*
+M#E^_^=I]+[+<[_-R_^R;7X5K/."8,^>]D#=_Y\.<G_Z1/R0F'AX^/]UYMY/F
+MX8?_\V@.O^VL^\X1)>E7[%5_Z#M^VDGSVJ@EA),@;\S99^"U;_ZY#S[QP0]^
+M\-^__PO_@4T\\<'W#">QI/RL=>K*_O[$:`8_(=8$U)*6DV_B>?^''WG_O_\@
+MX^>B*PDG0>Z8MV_=:[_P7U[_^@=?_XOO__,_]2>LB;>__G\826*=OG[W;[R)
+M_?G,Z/:?$6N^.^C&XWO>]WHKRS_QF3___E^T=O'@?_E"="7A),@=<_=!?^TW
+M?_WGW_C\G_HF?>]G?OWY-S[_QO]]-(DEY=M__D'KST^-KOLION+M@7T!?MO*
+M[OE?_Y'WTH_]J>??^/-_^YLS*`DG0>Z8?ZS6:S_V_>]ZU]_Z)J7O_1%KXEU_
+M-2"))>7O?_R-;_S\^T=7O?F-'W_CQW__IP*[Y_RVE=VW/O->2K_YM][UKN^?
+M24DX"7)'#&.:7_O-?_Z.=[+;&._]S*^]XS?_7%"2M7=_[/_\TI?^3("3[_\S
+M7WK7]W\LN,?<G_O-=_P:4Y*^ZIWO^.\^-I.2<!+DCCAB?_RU-[SAC_X+-O'>
+M/_Y3_^GO!R;9^;Z/_=K?_=?_<G3%O_S7?_?7/O9]P8&:__Y_^L(?9TK2?_%'
+MW_"&WYVM;'`2Y(W48F3]KB7N/QA=_`\LW?Y:@KN%DR!O()8D`-D"3@*0+>`D
+M`-D"3@*0+>`D`-D"3@*0+>`D`-G"[V3[]#&C#2=!WB#3DP``4L1?3[**Y5C]
+M/8UZ$N0-M"<!R!9P$H!L`2<!R!9P$H!L`2<!R!9P$H!LD0TG&[M)Y0PG0=Y(
+MU,EUC6@KUGN?D`5IL=D<3JCW8]ZS"YP$>2/9>O*05/C[@IQSG9#A^#O54MQ[
+M=H"3(&\D?.ZZ3>K6ZZHNGYMN;I*EV'<T#C@)\D;"3O8,=E:J;,C+E+56-?8=
+MC0-.@KR1]#6>3=*EISORDFZ3+I%#:Z)CD&KCM&IT&B6E9>G;5Y3.F%QF!TZ"
+MO)&TD_M&M:C5Y26E/;IFM-G4%KE#UW16AQ+3:E.J.U2/??]P$N2-Q.^%K!#%
+M=P&GQMJ6385/-[5>A=O)G"1JC9Z)??=P$N2-Q)UL:&1?GM\@G$4VO:_JXK8(
+M<[)/.N7X=P\G0=Y(OL^`:>_";)E6JY%6V+GJ:PQ1=YXFZZ(4UIK&@4$JP0\I
+MF`,X"?)&>DX*&FJ#O54T]KIO-@W>UF3U)*7%OGT[,T;@),@;:3NY):P[0UAU
+MN;"WIIK,4>:D=1:[P^K+>(&3(&^D[61?7,9I&):"[0J[]KI-[6L\93H@*W'O
+M'4Z"O)&TD]T.(=4M=[9%3-:'IV@M;76(LD<7K-4[':*U:4>M*K$K"2=![LC&
+MN)#D.(8?"1QSX"0`V2)9)TEDXBX!G`1Y`_4D`-D"3@*0+>`D`-D"3@*0+8[(
+MR;=>>\OXE4_?>BJV'<%)D#?&./G8LS<*-YY]+$)&SYTKW#YW8_G6!-<\'KAT
+M<W3ALQ]UIJ[>>#;"GB<")T'>"';RXO*MJ[6KMY:O1LFJ<)?2F[<*WYB>\MG+
+M`;;?O%%SIR\6WAIESQ.`DR!O!#I9.W>-^5&[)FDR'>8DO5FXY5OXW+71A(\5
+M'@_8_-&GI9DK-R+L>!)P$N2-0">?MBN[;Q2>'DX_@<(U[]6A=NGN:,)'"B^/
+M+KQZ3I[[2"&F)B6<!'DCT,E;A>O\_;I5Z=U\YIREU85S3+6+5^XN/UNS%MVX
+M^XV[EZ\5EI^EUU\JO&1OQ>O)BX4+;,-G[UZ[_,!-^MARP>)99T.;EPKVY-.W
+M+MU8?L9>^#KKY>9+Y\[Q>O9J8%4Z`W`2Y(U`)R\OVQ/+;(*[QEX>6_Z(+4NA
+M\-'KM+;,5KS\J+.UE:3V\K5+K*EXS6H//E1XU-G8VY!S[C)_J]VZ=M.M5\4Y
+M[J7+URD_:WW,-7U.X"3(&X%.%IP3SKL%*CEY@1EZ[H:;X'%V#GKA.6=K5B7R
+M6M):PY9RVWA*;T/.;7&:^DCA(6]?E_CUVMM6PM>)S`+:H;,`)T'>"*XG'7UN
+ML!I-N&6]\!/1@JLIO6F=E=8\=ZR%U]_JUH97'Q$NL_7>ADY"QMW+WLPW'N"+
+M'B@\8%_JA9/@I#*F/2D:?#5^$=6M)PON91C;J@>6Z>N\JT!\X3.B*?K(W6>O
+MNMM)&W+L>E(L%5F=$RK6+MPN/'J=[QE.@A-*H)./V%<]G^+775VWEF\["6UC
+MGBJ\Y<IU=VN>[CF^Z:.%J_*YJ[<AYX9HKHI6*T_U5K=1>O,EW@Q%>Q*<6(+O
+M3]ZXQ-\O+;/Z\K9SH>=1]P:%T^!<OO6,MS5?6.,GKY?/4;F*?-1_9\.^[OH2
+M$Y>GJMVPN_5<<6K(JX68>O+`29`W@OOQO'SYRF/TYA71C^=2X9&7'V%N7;R]
+M_-3UY]S366I?Y7$0"Q^X8=6<-PI7'^.;T-N%B_*&G$>XC%:5>NVBU2:UMOJH
+M(Z"5^"$N->Y/@A/+N/ZN%Y8O._U=7SYW^\K%0N&&-77K]O*5J_3J2X7"%7ZY
+M]:;7ZGON1J%PSJKN;EZZ_,!CS]VX?.7BM<*YQ^CCMV]?^XBSH<W-@NC9^M2U
+MPHW'V96A&TY7NUO+E^[RBT17EFD\P$F0-\:."WFH\)'I6[\\6[?49Y>E5N@U
+MJ?.YPU7T=P4GEK%.UBZ?NTJO3^GO>B%*?U@I;VE<B%5//C><R]4;%V;*-P`X
+M"?+&^/&3#UVR3CLO3MCTVDL?G;DV\\9/NOT3/)Z^%&)L24C@),@;<XQI?N#V
+M_'U2'[*:IH_.5MF&`TZ"O('8'P!D"S@)0+:`DP!DB\2=+#<U_3#*!HW=.'</
+M)T'>"'+RC$(,1=>WZS'D7]3.U*L#,;V_J1/]8'_R!E3OQ[!;%S@)\D9P/<F>
+M!UEND<'\^1]H[F19[=0;]8X^1?5J:?Z]>L!)D#?&.TD'_'&MX>D&/619-YVI
+MAMYB9Z4-4XGUY'0*<!+DC0E.TFA/,F]4S8"EQ%VX3L0CFO?(>I1LYP1.@KPQ
+MQDEFXQJI4GK8--4#2GO;BKEG&EVZ=F!V6O?<Y6OMEKG8-UH]NJ^R1]5MBNT/
+MFXI2Z5FM284MW.#+.J3!WW=(Q\I.M_9PH+3H\!Y62_)"VNLK2F>>SP<G0=Z8
+M4$_ND15:5+=HF;!'FA/2MIQ:TSL-NDV*SO*NI5RGVR9-*E>)1;5)=YMJT;=0
+M4^T)77.6LY?A/?@75M4=JL_S^>`DR!MCG%1H8T-5=FB)B:0S*X1<!Z1,Z59E
+M5UJN6\U#5:6R?MO$JB,/2<FWT)U2")6<'-Z#?R%1:_3,/)\/3H*\,<9)"V5E
+MS?+"?7JR,$:W*[NAY::7@L$5'195<^H[?STYO`?_PC[IE.?Z?'`2Y(U)UW@H
+MKS"=J98\+RWWG&SY-U?\"SM$7&]MD(ZSG+T,[\&_L'%@D,K:C)_-]Y$`R`E3
+MG%0-_R)5JP4M'ZHG16VJZKZ%=^QK/1O\NJM;3P[O86@A+?9)9;:/YO](`.2$
+M"===&15;),>8;?N&AK2<)15.NC5>*:@]N:-7^7M5Y5=R'&&']^!?V&1ZSA.'
+M```!'4E$0537:2/=DAD"3H*\,:6>+!OJZEJWXR[JJ<9ZKWRZ-[2\Q;(QB-/T
+M*VJ62TVU)^=$Z4!M%FFQJ?)^/%5R9W"'B3F\!]&'R%EH93G@%V5G!4Z"O!'D
+MY&*+W>`0TX..H57JM-PGI,(6'58T4EVON<N;Q%)FDY#F(5TQ2&M+;-5K*DK3
+M4I)OYO9`+QZHFKXI^KL.%*-Y2%C5ZM_#3H=H;7<A[:A591XEX23('>F.U5HD
+M6TGO8@@X"?)&NDXV-&40\V"L*<!)D#=2'M.\6#6,UGQW'*,!)T'>0)P!`+(%
+MG`0@6\!)`+(%G`0@6_B=;)\^9K3A),@;9'H2`$"*P$D`L@6<!"!;P$D`L@6<
+M!"!;P$D`L@6<!"!;P$D`LL7_#SFP880TL7==````!W1)344'U0,2$@\0MAJY
+-30````!)14Y$KD)@@@``
+`
+end
