The Courier's Tragedy

Martin Howse

04 November 2009

Contents

1 introduction 21.1 The Crying of Lot 49 - signs of W.A.S.T.E: . . . . . . . . . . 2

1.1.1 W.A.S.T.E . . . . . . . . . . . . . . . . . . . . . . . . 21.1.2 . . . as paranoiac steganographia . . . . . . . . . . . . 31.1.3 anti-paranoia - there is no connectivity . . . . . . . . . 3

2 activities 3

3 schedule 43.1 day 1: detect and walk . . . . . . . . . . . . . . . . . . . . . . 4

3.1.1 short introduction on division carrier/signal: . . . . . . 43.1.2 LT detector build and record/walk . . . . . . . . . . . 43.1.3 scrying intro, walk and plot: . . . . . . . . . . . . . . . 4

3.2 day 2: carrier and message . . . . . . . . . . . . . . . . . . . . 43.2.1 list techniques on both sides of the bridge: . . . . . . . 53.2.2 layers of abstraction (physical layer//+) . . . . . . . . 53.2.3 (what else?) . . . . . . . . . . . . . . . . . . . . . . . . 63.2.4 overnight logging setup with wl-hdd and mini-scry . . 6

3.3 day 3: psychogeophysics, visualisation, projects, W.A.S.T.E(how?): . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63.3.1 previous evening's interpretations . . . . . . . . . . . . 63.3.2 burroughs walks . . . . . . . . . . . . . . . . . . . . . 63.3.3 steganography examples: . . . . . . . . . . . . . . . . . 63.3.4 data sedimentation and misc topics for discussion (HD

reconstruction) . . . . . . . . . . . . . . . . . . . . . . 6

1

4 notes/experiments 64.1 iwcon�g rssi logging . . . . . . . . . . . . . . . . . . . . . . . 64.2 mini-scry tests, �xes and re-interpretations . . . . . . . . . . . 74.3 wireshark notes: . . . . . . . . . . . . . . . . . . . . . . . . . . 74.4 driftnet and injection/cracking: . . . . . . . . . . . . . . . . . 74.5 logging with wl-hdd (with large HD): . . . . . . . . . . . . . . 74.6 run through scapy (mostly construction of packets) . . . . . . 74.7 scapy as sni�eur . . . . . . . . . . . . . . . . . . . . . . . . . 94.8 scapy and graphs . . . . . . . . . . . . . . . . . . . . . . . . . 94.9 usrp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94.10 bbn: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104.11 burroughs walks/notes . . . . . . . . . . . . . . . . . . . . . . 104.12 kismet, rssi and GPS . . . . . . . . . . . . . . . . . . . . . . . 104.13 cantenna notes/links . . . . . . . . . . . . . . . . . . . . . . . 114.14 other research vectors . . . . . . . . . . . . . . . . . . . . . . 114.15 steganography . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

5 misc links/notes 12

6 materials etc. . . . 136.1 to get in Newcastle: . . . . . . . . . . . . . . . . . . . . . . . . 13

7 references 13

8 books and papers 13

9 post-documentation 139.1 micro-scrying logs for night of the 25th September . . . . . . 139.2 scrying walk on the 26th September . . . . . . . . . . . . . . 18

9.2.1 GPS track/mapped . . . . . . . . . . . . . . . . . . . . 189.2.2 network log . . . . . . . . . . . . . . . . . . . . . . . . 189.2.3 rough notes . . . . . . . . . . . . . . . . . . . . . . . . 209.2.4 misc photos/images . . . . . . . . . . . . . . . . . . . 339.2.5 link to recordings: . . . . . . . . . . . . . . . . . . . . 44

2

9.2.6 materials // �nd/�ll in . . . . . . . . . . . . . . . . . . 44

1 introduction

The Courier's Tragedy is concerned with a submission of the medium enactedby both ancient and contemporary communication systems. The messengeris rendered redundant (literally killed) on delivery; the message is that whichreally matters. The carrier can be discarded in favour of a meaningful sig-nal, and this is precisely what all radio apparatus enacts, equally eliminatingnoise and uncertainty. Expanding a clear concern with electromagnetic [EM]phenomena as a question of substance, and extending the spectrum of artisticconcerns to embrace modern data space, this workshop attempts to bridgethis impossible divide between the physical (waves) and the protocol (code);asking how, within complex spectral ecologies, it is possible to examine andembrace both the carrier and the signal, to observe the subtle interactions

3

and inherent abstractions? In this context, such an examination becomes amanner of revealing; revealing another city, revealing new modes of commu-nication and transmission (hidden networks).

. . . and how these are revealed? // examples of networks

1.1 The Crying of Lot 49 - signs of W.A.S.T.E:

She could, at this stage of things, recognize signals like that, as the epilepticis said to an odor, color, pure piercing grace note announcing his seizure.Afterward it is only this signal, really dross, this secular announcement,and never what is revealed during the attack, that he remembers. Oedipawondered whether, at the end of this (if it were supposed to end), she toomight not be left with only compiled memories of clues, announcements,intimations, but never the central truth itself, which must somehow eachtime be too bright for her memory to hold; which must always blaze out,destroying its own message irreversibly, leaving an overexposed blank whenthe ordinary world came back.

see also: http://www.social�ction.org/psychogeography/talkwalk.html#

1.1.1 W.A.S.T.E

• the �rst protocol concerned with hiding and the evident(ce).

[an appearance]1] the network exists 2] hallucination 3] it's a plot (against you) 4] fan-

tasying a plot

1.1.2 . . . as paranoiac steganographia

parallels the example of Johannes Trithemius Steganographia (1500)This book is in three volumes, and appears to be about magic - specif-

ically, about using spirits to communicate over long distances. Since thepublication of the decryption key to the �rst two volumes in 1606, they havebeen known to be actually concerned with cryptography and steganography.Until recently, the third volume was widely still believed to be about magic,but the �magical� formulae have now been shown to be covertexts for yetmore cryptography content[???] The work has lent its name to the modern�eld of steganography. [wikipedia]

further:

4

There is little doubt that the two Books of the Steganographia do treatof cryptography, and that the angels and spirits in them can be satisfactorilyexplained as descriptions of the methods of encipherment. . . .

But the Third Book, which is un�nished, does not, like the other two,contain any examples of enciphered messages; one is told to say the messageover the picture of a planetary angel at the moment determined by compli-cated astronomical calculations. It seems most unlikely that these could bedisguised directions for encipherment or any kind of secret writing.

previous accepted position from: http://www.dtc.umn.edu/�reedsj/trit.pdfsee also:http://www.esotericarchives.com/tritheim/stegano.htmhttp://�ndarticles.com/p/articles/mi_qa3926/is_199810/ai_n8820687/

1.1.3 anti-paranoia - there is no connectivity

* no signal/vacuum * encrypted signal * steganographed signal - the carrieris the obvious * an erased signal in this case

2 activities

1] overlap traditional forensics with vast digital domain//a vertiginous gen-eration of paranoiac signals and protocols:

making sense of a landscape from a forensics perspective (a revealing),mapping of event intensity using GPS, reconstruction of unintentional emis-sions, TEMPEST, cryptography, EM psychogeographics=psychogeophysics,data sedimentation, data visualisation and forging of underground transmis-sion networks.

3 schedule

3.1 day 1: detect and walk

3.1.1 short introduction on division carrier/signal:

as abovehow signal as meaningful is also obscured in computer networking (en-

crypted IN the realm of meaning)demonstrate audio(LT), kismet (with spectools), wireshark (�lters) and

perhaps scapy (packet construction)//tshark() sni�ng // gnuradio (tv_rcvfrom kismet channels), driftnet

5

3.1.2 LT detector build and record/walk

(ref: http://petertodd.org/tech/emf-detector/ )

3.1.3 scrying intro, walk and plot:

�le:scrying.gnuplot�le:�/projects/older/scotland/newcastle/scrying.gnuplot

3.2 day 2: carrier and message

carrier<->message walk through: (detection/signal strength, wireless sni�/scapy,usrp -> cantenna)

6

3.2.1 list techniques on both sides of the bridge:

3.2.2 layers of abstraction (physical layer//+)

[see Silence also p.90,91]

• physical layer:

scrying, baudline, LT detector, signal strength(wavemon, rssi shellscript), spectools (wispy)

• protocol layer:

� analysis/creation/exploitation/interpretation

7

(gis)kismet, wireshark, airsnort?, tcpdump (tcpdump -i wlan1 -s 0 -wllog) , scapy (creation and usrp capture), ettercap (Ettercap is a suitefor man in the middle attacks on LAN), hping3

3.2.3 (what else?)

• antenna as bridge: // usrp signal reception(am demodulation, 802.11tv, bbn)

• cantennas, playing//capture

• gps/kismet walk

3.2.4 overnight logging setup with wl-hdd and mini-scry

3.3 day 3: psychogeophysics, visualisation, projects, W.A.S.T.E(how?):

3.3.1 previous evening's interpretations

3.3.2 burroughs walks

3.3.3 steganography examples:

environmental steganography (steghide,nlstego)local: �le:�/xxxxx_2/xxxxx/trunk/org/data_forensics.orghttp://1010.co.uk/org/data_forensics.html#sec-4.8

3.3.4 data sedimentation and misc topics for discussion (HD re-construction)

see below

4 notes/experiments

4.1 iwcon�g rssi logging

#!/bin/bash

while [ 1 = 1 ]

do

iwconfig wlan1 | grep Signal | sed -n "s/.*Signal level=-\([0-9]*\).*/\1/p"

sleep 1

done

8

4.2 mini-scry tests, �xes and re-interpretations

tests: 1-5 working + 6 to testprogramming:plot �/root/projects/older/sommercamp/scry4/monk01� index 0 using

0:($1-170) with lines, �/root/projects/older/sommercamp/scry4/monk01� in-dex 0 using 2 with lines

4.3 wireshark notes:

wireshark and �lters:http://wiki.wireshark.org/CaptureFiltershttp://klasbricks.wikispaces.com/wireshark

4.4 driftnet and injection/cracking:

driftnet tests and injection:airmon-ng start wlan1ifcon�g wlan1 downairodump-ng -w w -c 11 wlan1 [ channel 11]but we need WEP key oder. . .see:http://docs.lucidinteractive.ca/index.php/Cracking_WEP_and_WPA_Wireless_Networkshttp://bricowi�.blogspot.com/2008/06/ettercap-ng-mode-monitor-dns-spoof-

msn.htmlhttp://aircrack-ng.org/doku.php?id=airtun-ng#wep_injectionhttp://www.aircrack-ng.org/doku.php?id=Airodump-nghttp://www.aircrack-ng.org/doku.php?id=aircrack-nghttp://forums.remote-exploit.org/tutorials-guides/2858-howto-use-dsni�-

driftnet-urlsnarf-msgsnarf-802-11-capture-�les.html

4.5 logging with wl-hdd (with large HD):

wired: 192.168.2.20seems a bit shakey but that could be low voltage (use straight 6v PSU)

4.6 run through scapy (mostly construction of packets)

scapy: http://www.secdev.org/projects/scapy/

~/projects/new_df/scapy/run_scapy

9

see also: �le:�/xxxxx_2/xxxxx/trunk/org/shintaro_res.org::*Epistemologyof electromagnetic waves with Shintaro Miyazaki

p=sr1(IP(dst="www.slashdot.org")/ICMP()/"XXXXXXXXXXX")

>>> str(p)

'E\x00\x00\'Kp@\x00\xf0\x01\xf0P\xd8"\xb50\xc0\xa8\x01\x19\x00\x00\xeeE\x00\x00\x00\x00XXXXXXXXXXX\x00\x00\x00\x00\x00\x00\x00'

>>> hexdump(p)

0000 45 00 00 27 4B 70 40 00 F0 01 F0 50 D8 22 B5 30 E..'Kp@....P.".0

0010 C0 A8 01 19 00 00 EE 45 00 00 00 00 58 58 58 58 .......E....XXXX

0020 58 58 58 58 58 58 58 00 00 00 00 00 00 00 XXXXXXX.......

p=sr1(IP(dst="192.168.1.1")/ICMP()/("\xff\x00"*400)*1000)

also:send Ethernet frame/packet::p=Ether()/IP(dst=�192.168.1.1�)/ICMP()/�xxxxx�:sendp(p)further:

ls() - lists supported layers

ls(Raw) - shows layer options

lsc() - list commands

so: p=Ether()/IP(dst=�192.168.1.1�)/Raw(load=�x�)or:

p=Ether()/IP(dst="192.168.1.1")/Raw(load="xo"*500)

p.show2()

str(p)

ls(Dot11Beacon)

also: http://trac.secdev.org/scapy/attachment/wiki/BuildAndDissect/dissect.txt

10

4.7 scapy as sni�eur

to test:

a=sniff(iface="wlan0",prn=lambda x: \

x.sprintf("%Dot11.addr2% ")+("#"*(x.signal/8)))

tshark()pr=sni�(iface=�ath0�,prn=lambda x:x.sprintf(�{Dot11Beacon:%Dot11.addr3

pr[1]

pr=sni�(prn = lambda x: hexdump(x)) ;; function to performpr.pdfdump()also:packets = Ether()/IP(dst=Net(�google.com/30�))/ICMP() # �rst gener-

ate some packets wireshark(packets)links:http://www.thesprawl.org/memdump/doku.php?id=tools:scapyhttp://trac.secdev.org/scapy/wiki/ScapyRecipes

4.8 scapy and graphs

http://www.secdev.org/projects/scapy/doc/usage.htmlpkt.pdfdump() draws a PDF with explained dissection

4.9 usrp

see bbn below�t: usrp_�t.py -d 128 -f 0 -R A:1demodulation: /root/gnuradio/gnuradio-examples/python/usrp/usrp_am_mw_rcv.pytv demodulation/visualisation: (here is record and playblack - live is

simple)usrp_rx_c�le.py -g 48 -s -8 -R B -f 2422M -d 4 �/projects/sommercamp/random_logs/test_vid1// shorts and then->usrp_tv_rcv.py -d 8 �/projects/sommercamp/random_logs/test_vid1recording for later use in audacity::./usrp_rx_c�le.py -s -8 -R A -f 0M -d 4 thunetAAd4.raw[8 bit samples over the USB bus, tuned to 0MHz, decimation of 4][into audacity: Import raw data, Signed 16 bit PCM, Little Endian,

Stereo, 100000 Hz sample rate - slowed down also in e�ects by 99%]

11

4.10 bbn:

location: �/gijon_root/adroitgrdevel/gr-bbn/src/examples`�# ./bbn_80211b_rx.py -R B -d 8 -f 2422e6 -bsee http://www.1010.co.uk/org/shintaro_res.htmlor local: �le:�/xxxxx_2/xxxxx/trunk/org/shintaro_res.org

4.11 burroughs walks/notes

• list of Burrough's techniques: The Adding Machine:

p49:�Walk Exercise�: Basically it consists in taking a walk with the continuity

and perceptions you encounter. The original version of this exercise wastaught me by an old Ma�a Don in Columbus, Ohio: seeing everyone in thestreet before he sees you. [. . . ] Generally speaking, if you see other peoplebefore they see you, they won't see you. I have even managed to get past awhole block of guides and shoeshine boys in Tangier this way, thus earningmy Moroccan monicker: �El Hombre Invisible�

Variations: . . . walking on colors. Pick out all the reds on a street,focusing only on red objects - brick, lights, sweaters, signs. Shift to green,blue, orange, yellow. Notice how the colors begin to stand out more sharplyof their own accord. . .

p103:Take a walk around the block. Come back and write down precisely

what happened with particular attention to what you were thinking whenyou noticed a street sign, a passing car or stranger or whatever caught yourattention. You will observe that what you were thinking just before you sawthe sign relates to the sign. The sign may even complete a sentence in yourmind. You are getting messages.

4.12 kismet, rssi and GPS

up-to-date: http://blog.securityactive.co.uk/2009/07/17/wardriving-with-kismet-newcore-and-backtrack-4/

use gpsd, kismet and giskismet ( http://my-trac.assembla.com/giskismet/)

http://www.parknation.com/gmap/http://blog.papalima.com/?p=46

12

4.13 cantenna notes/links

http://www.reseaucitoyen.be/wiki/index.php/BoiteDeLaithttp://�akey.info/antenna/waveguide/http://www.saunalahti.�/�elepal/antenna2calc.phphttp://www.saunalahti.�/�elepal/antenna2.html[use of tetrapaks was also successfully tested in Berlin: 7cm diameter,

21.5 long means antenna is 31mm high and 69mm in from the end of thepak � where do we get these �gure from as they suggest above min. 75mmdiameter]

4.14 other research vectors

serial port and USB sni�ng, keyboards, hard drive (conventional digitalforensics - dd, strings, AFF-enhanced forensics format), acoustic emanations,timing attacks and entropy, memory, execution and gdb

raw �le/data analysis - baudline (�le open and bit view option), dd,strings, devdisplay, raw �les in octave (histogram):

my�le = fopen(�testrnd_delay_none�, �r+�)x =fread(my�le, �uchar�);hist(x)hist(x(1:50))plot(x)fclose(my�le)

4.15 steganography

For our IRC tool what do we use?http://www.fourmilab.ch/stego/�le:�/soft/steg/stego/READMEeg.

./stego -e -t ~/experiment/crying/crying testfile testout ;; encode

./stego -d -t ~/experiment/crying/crying testout ;; decode

./stego -t ~/experiment/crying/crying -w dict ;; make dictionary

echo "waiting for rabbits" | ./stego -e -f dict - testout ;; encode with dictionary

13

Bibliography: http://data-hiding.com/Bibliography for text-based steganography: http://semantilog.ucam.org/biblingsteg/StegFS (�lesystem): http://www.mcdonald.org.uk/StegFS/[ wbStego: http://wbstego.wbailer.com/ ]Stegtunnel (covert channel in the IPID and sequence number �elds of any

desired TCP connection): http://www.synacklabs.net/projects/stegtunnel/Stepic (Python image steganography): http://domnit.org/2007/02/stepicForensic tools: http://unixsadm.blogspot.com/2007/10/digital-forensic-

tools-imaging.htmlText-based steganography: http://www.siefkes.net/software/nlstego/ and

http://lcamtuf.coredump.cx/soft/snowdrop.tgzText-based2: http://www.fasterlight.com/hugg/projects/stegparty.htmland:http://www.nicetext.com/and:http://www.fourmilab.ch/stego/Steghide (images) : http://steghide.sourceforge.net/Hydan (within executables): http://crazyboy.com/hydan/

5 misc links/notes

LORCON: It is a library for injecting 802.11 (WLAN) frames, capable ofinjecting via multiple driver frameworks, without the need to change theapplication code.

GSM sni�ng: http://wiki.thc.org/gsmradiotap header:http://www.mjmwired.net/kernel/Documentation/networking/radiotap-

headers.txthttp://www.radiotap.org/http://wiki.wireshark.org/CaptureSetup/WLANThe radiotap header format is a mechanism to supply additional informa-

tion about frames, from the driver to userspace applications such as libpcap,and from a userspace application to the driver for transmission.

backtrack distro: http://www.remote-exploit.org/backtrack.htmlalso: http://blag.chaox.net/2009/07/04/chaox-2009-7-is-here/http://forums.remote-exploit.org/tutorials-guides/2858-howto-use-dsni�-

driftnet-urlsnarf-msgsnarf-802-11-capture-�les.html

14

6 materials etc. . . .

LT detector parts, cantenna wire and sockets, cables, scrying + antennas,USRP+PSU, wireless cards, crimper, GPS, copper tape, overnight logging(battery,wll-hdd),mini-sd, programmer, cabels, usb etc.

6.1 to get in Newcastle:

large 6v battery, tins, juice cartons, tetrapaks for cantennas, AA batteries,containers for mini-scry

7 references

�le:�/xxxxx_2/xxxxx/trunk/org/data_forensics.org�le:�/xxxxx_2/xxxxx/trunk/org/df_pres.orgonline:http://1010.co.uk/org/data_forensics.htmlhttp://1010.co.uk/org/df_pres.html

8 books and papers

The Crying of Lot 49, Thomas PynchonSilence on the Wire: A Field Guide to Passive Reconnaissance and Indi-

rect Attacks. Michal Zalewski

9 post-documentation

9.1 micro-scrying logs for night of the 25th September

• 1]

15

Location:

• 2]

16

Location:

• 3]

17

[note issues with CYWM logging here]Location:

• 4]

18

Location:

• 5]

Not functioning.Location:

• Source code:

set terminal png size 1024,768

set output "/root/projects/scotland/newcastle/n2/monk01.png"

plot "/root/projects/scotland/newcastle/n2/monk01" index 0 using

0:($1-160) with lines, "/root/projects/scotland/newcastle/n2/monk01"

index 0 using 2 with lines

19

9.2 scrying walk on the 26th September

9.2.1 GPS track/mapped

9.2.2 network log

From: Kismet-Sep-26-2009-1.pcapdumpExtracted using wireshark - packet belonging to diamond antenna cam-

era:

00000000 4e 4f 54 49 46 59 20 2a 20 48 54 54 50 2f 31 2e NOTIFY * HTTP/1.

20

00000010 31 0d 0a 48 4f 53 54 3a 20 32 33 39 2e 32 35 35 1..HOST: 239.255

00000020 2e 32 35 35 2e 32 35 30 3a 31 39 30 30 0d 0a 43 .255.250 :1900..C

00000030 41 43 48 45 2d 43 4f 4e 54 52 4f 4c 3a 20 6d 61 ACHE-CON TROL: ma

00000040 78 2d 61 67 65 3d 31 38 30 30 0d 0a 4c 4f 43 41 x-age=18 00..LOCA

00000050 54 49 4f 4e 3a 20 68 74 74 70 3a 2f 2f 31 39 32 TION: ht tp://192

00000060 2e 31 36 38 2e 32 2e 31 30 34 3a 31 30 32 34 32 .168.2.1 04:10242

00000070 2f 64 65 73 63 72 69 70 74 69 6f 6e 2e 78 6d 6c /descrip tion.xml

00000080 0d 0a 4e 54 3a 20 75 75 69 64 3a 75 70 6e 70 5f ..NT: uu id:upnp_

00000090 4e 65 74 77 6f 72 6b 43 61 6d 65 72 61 57 69 74 NetworkC ameraWit

000000A0 68 50 61 6e 54 69 6c 74 2d 30 30 30 32 44 31 30 hPanTilt -0002D10

000000B0 33 33 33 33 46 0d 0a 4e 54 53 3a 20 73 73 64 70 3333F..N TS: ssdp

000000C0 3a 61 6c 69 76 65 0d 0a 53 45 52 56 45 52 3a 20 :alive.. SERVER:

000000D0 45 6d 62 65 64 64 65 64 20 55 50 6e 50 2f 31 2e Embedded UPnP/1.

000000E0 30 0d 0a 55 53 4e 3a 20 75 75 69 64 3a 75 70 6e 0..USN: uuid:upn

000000F0 70 5f 4e 65 74 77 6f 72 6b 43 61 6d 65 72 61 57 p_Networ kCameraW

00000100 69 74 68 50 61 6e 54 69 6c 74 2d 30 30 30 32 44 ithPanTi lt-0002D

00000110 31 30 33 33 33 33 46 0d 0a 0d 0a 103333F. ...

0000011B 4e 4f 54 49 46 59 20 2a 20 48 54 54 50 2f 31 2e NOTIFY * HTTP/1.

0000012B 31 0d 0a 48 4f 53 54 3a 20 32 33 39 2e 32 35 35 1..HOST: 239.255

0000013B 2e 32 35 35 2e 32 35 30 3a 31 39 30 30 0d 0a 43 .255.250 :1900..C

21

0000014B 41 43 48 45 2d 43 4f 4e 54 52 4f 4c 3a 20 6d 61 ACHE-CON TROL: ma

0000015B 78 2d 61 67 65 3d 31 38 30 30 0d 0a 4c 4f 43 41 x-age=18 00..LOCA

0000016B 54 49 4f 4e 3a 20 68 74 74 70 3a 2f 2f 31 39 32 TION: ht tp://192

0000017B 2e 31 36 38 2e 32 2e 31 30 34 3a 31 30 32 34 32 .168.2.1 04:10242

0000018B 2f 64 65 73 63 72 69 70 74 69 6f 6e 2e 78 6d 6c /descrip tion.xml

0000019B 0d 0a 4e 54 3a 20 75 72 6e 3a 73 63 68 65 6d 61 ..NT: ur n:schema

000001AB 73 2d 75 70 6e 70 2d 6f 72 67 3a 64 65 76 69 63 s-upnp-o rg:devic

000001BB 65 3a 4e 65 74 77 6f 72 6b 43 61 6d 65 72 61 57 e:Networ kCameraW

000001CB 69 74 68 50 61 6e 54 69 6c 74 3a 31 0d 0a 4e 54 ithPanTi lt:1..NT

000001DB 53 3a 20 73 73 64 70 3a 61 6c 69 76 65 0d 0a 53 S: ssdp: alive..S

000001EB 45 52 56 45 52 3a 20 45 6d 62 65 64 64 65 64 20 ERVER: E mbedded

000001FB 55 50 6e 50 2f 31 2e 30 0d 0a 55 53 4e 3a 20 75 UPnP/1.0 ..USN: u

0000020B 75 69 64 3a 75 70 6e 70 5f 4e 65 74 77 6f 72 6b uid:upnp _Network

0000021B 43 61 6d 65 72 61 57 69 74 68 50 61 6e 54 69 6c CameraWi thPanTil

0000022B 74 2d 30 30 30 32 44 31 30 33 33 33 33 46 0d 0a t-0002D1 03333F..

0000023B 0d 0a ..

9.2.3 rough notes

• The Albion

�Then shall the realm of Albion / Come to great confusion� [King Lear]

22

23

Albion House, Albion Drive, Albion Row, Albion Industrial Estate. . .

Albion (Greek: ) is the oldest known name of the island of GreatBritain. It is thought to derive from the white cli�s of Dover. Today,it is still sometimes used poetically to refer to the island or (incorrectly)England in particular. It is also the basis of the Scottish Gaelic namefor Scotland, Alba.

.. . .

Gallo-Latin Albin (cf. Middle Irish Albbu) derives from the Proto-Celtic * Alb-ien-, sharing the same stem as Welsh elfydd �earth, world�.Together with other toponyms such as Alpes The Latin word alba isthe feminine singular form of albus, meaning white in English.

[Wikipedia]

• DEATH

24

25

26

27

with the letter A replaced by a triangle or diamond (see below).

death gra�ti tag trail

• diamond or Delta

or triangle. in the death tag

also as [delta]-T for example:

Delta T, delta-T, deltaT, or DT is the time di�erence obtained bysubtracting Universal Time from Terrestrial Time.

diamond of antenna close to CCTV cameras (see network dump)

28

29

30

31

32

33

34

9.2.4 misc photos/images

35

36

37

38

39

40

41

42

43

44

45

[All images credited to Will Schrimshaw]

9.2.5 link to recordings:

1] Ben [LT detector from Albion House to Albion Industrial Estate]

9.2.6 materials // �nd/�ll in

martin: gps logTODO, network log, audio from Benwill: 55 images, audio (from detector) from albion house to scarab's

sprawl (to be mapped to GPS)sketches, words (from albion house to ouseburn)Ben: recordings, 4 images, audio (from detector) from albion house to

albion industrial estate (53 minutes)others: photos/images, more photos$1$ FOOTNOTE DEFINITION NOT FOUND: 1

46