Full version of Distributed Denial of Service

Attacks Real world Detection and Mitigation 1st

Edition ■lker Özçelik – high-quality PDF.

Press to download now => https://textbookfull.com/product/distributed-denial-of-service-attacks...

Distributed Denial of Service Attacks Real world Detection and Mitigation 1st
Edition ■lker Özçelik

If the link above isn’t working, try clicking some of the

buttons below.

MIRROR 1 MIRROR 2

Original Link: https://textbookfull.com/product/distributed-denial-of-

service-attacks-real-world-detection-and-mitigation-1st-edition-ilker-
ozcelik/

Review:
★★★★★ 4.7/5.0
downloads: 957
"Makes studying so much easier." – Chloe T.

textbookfull.com
Distributed Denial of
Service Attacks
 Distributed Denial of
Service Attacks
Real-world Detection and Mitigation

Richard R. Brooks
Professor
Holcombe Department of Electrical and Computer Engineering
Clemson University

İlker Özçelik
Assistant Professor
Department of Computer Engineering
Recep Tayyip Erdogan University
MATLAB R is a trademark of The MathWorks, Inc. and is used with permission. The Mathworks does not
warrant the accuracy of the text or exercises in this book. This book’s use or discussion of MATLAB R
software or related products does not constitute endorsement or sponsorship by The MathWorks of a par-
ticular pedagogical approach or particular use of the MATLAB R software.

First edition published 2020

by CRC Press
6000 Broken Sound Parkway NW, Suite 300, Boca Raton, FL 33487-2742

and by CRC Press

2 Park Square, Milton Park, Abingdon, Oxon, OX14 4RN

c 2020 Taylor & Francis Group, LLC

CRC Press is an imprint of Taylor & Francis Group, LLC

Reasonable efforts have been made to publish reliable data and information, but the author and publisher
cannot assume responsibility for the validity of all materials or the consequences of their use. The authors
and publishers have attempted to trace the copyright holders of all material reproduced in this publication
and apologize to copyright holders if permission to publish in this form has not been obtained. If any
copyright material has not been acknowledged please write and let us know so we may rectify in any future
reprint.

Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced, trans-
mitted, or utilized in any form by any electronic, mechanical, or other means, now known or hereafter
invented, including photocopying, microfilming, and recording, or in any information storage or retrieval
system, without written permission from the publishers.

For permission to photocopy or use material electronically from this work, access www.copyright.com or
contact the Copyright Clearance Center, Inc. (CCC), 222 Rosewood Drive, Danvers, MA 01923, 978-750-
8400. For works that are not available on CCC please contact [email protected]

Trademark Notice: Product or corporate names may be trademarks or registered trademarks, and are used
only for identification and explanation without intent to infringe.

Library of Congress Cataloging-in-Publication Data

Names: Özçelik, İlker, author. | Brooks, R. R. (Richard R.), author.
Title: Distributed denial of service attacks : real-world detection and
mitigation / İlker Özçelik and R.R. Brooks.
Description: Boca Raton : CRC Press, 2020. | Includes bibliographical
references and index.
Identifiers: LCCN 2019058641 | ISBN 9781138626812 (paperback) |
ISBN 9781315213125 (ebook)
Subjects: LCSH: Computer networks--Security measures. | Denial of service
attacks.
Classification: LCC TK5105.59 .O97 2020 | DDC 005.8/7--dc23
LC record available at https://lccn.loc.gov/2019058641

ISBN: 9780367491543 (hbk)

ISBN: 9781138626812 (pbk)
ISBN: 9781315213125 (ebk)

Typeset in CMR
by Nova Techset Private Limited, Bengaluru & Chennai, India
Explore our comprehensive library of test banks and solution
manuals at https://textbookfull.com and take advantage of
current promotions.
Dedication

This book is the result of many years of research on Distributed Denial of Service DDoS
attacks. A number of students have helped along the way. These included undergraduates,
M. S., and Ph. D. students at Penn State and Clemson Universities. All were advised
or co-advised by Dr. Brooks. Other students of note include Dr. Chris Griffin (Ph.D.
Penn State), Ms. Chinar Dingankar (M.S. Clemson), Ms. Devaki Shah (B. S. Penn State),
and Dr. Glenn Carll (Ph.D. Penn State). We would like to thank Mr. Jim Bottum and
Dr. Kevin McKenzie of Clemson University CCIT who allowed us to utilize Clemson Uni-
versity resources in this work. They both have a clear vision that sees the university’s role
in supporting faculty research. The vast majority of the work in this book was done by
Dr. Özçelik. Dr. Özçelik’s studies at Clemson were supported by the Turkish government.
Both Dr. Brooks and Dr. Özçelik have been fortunate to have supportive students, work
environments and families during this work.

v
 In Loving Memory of My Father
Mustafa Özçelik
Your determination taught me to never give up.

To My Wife Jacqui and Our Sons Ömer James and Ali Joseph
Your love, patience and support made this book possible.
Love y’all.
Contents

Foreword xv

About the Authors xvii

Acknowledgments xix

Preface xxi

Contributors xxiii

1 Introduction 1
1.1 Performance Testing and Analysis of DDoS Detection Approaches . . . . . 2
1.2 Deceiving DDoS Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
1.3 DDoS Mitigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.4 Organization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

2 What is DDoS? 5
2.1 Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2.2 Classification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.2.1 Resource Saturation . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.2.1.1 System/Device Resources . . . . . . . . . . . . . . . . . . . 8
2.2.1.2 Network Bandwidth . . . . . . . . . . . . . . . . . . . . . . 9
2.2.2 Exploiting Vulnerability . . . . . . . . . . . . . . . . . . . . . . . . . 12
2.2.3 Tampering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
2.2.4 Misuse . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.2.4.1 Fragmentation and Reassembly . . . . . . . . . . . . . . . . 15
2.2.4.2 TCP-based . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
2.2.4.3 Low and Slow Attacks . . . . . . . . . . . . . . . . . . . . . 18
2.2.4.4 Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
2.2.4.5 Others . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
2.2.5 Physical Destruction . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
2.3 Botnet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
2.3.1 Botnet Architectures . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
2.3.2 Botnet Topologies . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
2.3.2.1 Star . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
2.3.2.2 Multi-server . . . . . . . . . . . . . . . . . . . . . . . . . . 27
2.3.2.3 Hierarchical . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
2.3.2.4 Random . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
2.3.3 Botnet Resilience and CnC Resolution . . . . . . . . . . . . . . . . . 30
2.3.3.1 IP Flux . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
2.3.3.2 Domain Flux . . . . . . . . . . . . . . . . . . . . . . . . . . 33
2.3.3.3 Blind Proxy Redirection . . . . . . . . . . . . . . . . . . . . 33

vii
viii Contents

2.4 Attack Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

2.4.1 Classification of Attack Tools . . . . . . . . . . . . . . . . . . . . . . 34
2.4.2 Popular Attack Tools . . . . . . . . . . . . . . . . . . . . . . . . . . 36
2.5 Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
2.6 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

3 History and Motivation 43

3.1 A Brief History of Computers and Computer Crime . . . . . . . . . . . . . 44
3.2 DDoS Tools and Technologies . . . . . . . . . . . . . . . . . . . . . . . . . 46
3.2.1 DDoS Bots and Stressers . . . . . . . . . . . . . . . . . . . . . . . . 46
3.2.2 Botnets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
3.2.3 Worms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
3.2.4 DNS DDoS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
3.2.5 BGP Exploits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
3.3 DDoS History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
3.3.1 Early DoS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
3.3.2 Hackers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
3.3.2.1 L0pht . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
3.3.2.2 Mafiaboy . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
3.3.3 Commercial Exploitation . . . . . . . . . . . . . . . . . . . . . . . . 53
3.3.3.1 DDoS for Hire . . . . . . . . . . . . . . . . . . . . . . . . . 53
3.3.3.2 Ransomware . . . . . . . . . . . . . . . . . . . . . . . . . . 54
3.3.4 Censorship . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
3.3.4.1 Myanmar . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
3.3.4.2 Kyrgyzstan . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
3.3.4.3 Kazakh . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
3.3.4.4 Iran . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
3.3.4.5 Vietnam . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
3.3.4.6 Radio Free Europe/Radio Liberty . . . . . . . . . . . . . . 56
3.3.4.7 Krebs on Security . . . . . . . . . . . . . . . . . . . . . . . 56
3.3.5 Cyberwar . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
3.3.5.1 Hainan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
3.3.5.2 Estonia . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
3.3.5.3 Georgia . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
3.3.5.4 Ukraine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
3.3.5.5 Israel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
3.3.5.6 US and Korea . . . . . . . . . . . . . . . . . . . . . . . . . 59
3.3.6 Hacktivism and/or Terrorism . . . . . . . . . . . . . . . . . . . . . . 59
3.3.6.1 Electronic Disturbance Theater . . . . . . . . . . . . . . . 59
3.3.6.2 Electrohippies . . . . . . . . . . . . . . . . . . . . . . . . . 60
3.3.6.3 Lufthansa . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
3.3.6.4 Russian Election . . . . . . . . . . . . . . . . . . . . . . . . 60
3.3.6.5 Chanology . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
3.3.6.6 CNN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
3.3.6.7 Operations Titstorm and Payback . . . . . . . . . . . . . . 61
3.3.6.8 Lizard Squad . . . . . . . . . . . . . . . . . . . . . . . . . . 61
3.3.6.9 Black Lives Matter . . . . . . . . . . . . . . . . . . . . . . 62
3.3.6.10 Syrian Electronic Army . . . . . . . . . . . . . . . . . . . . 62
3.3.6.11 Daesh . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
3.3.7 Internet Blackouts . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Contents ix

3.4 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
3.5 Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
3.6 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66

4 Legal Considerations 67
4.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
4.2 Laws against DDoS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
4.3 Jurisdiction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
4.4 DDoS Liability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
4.5 Protest . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
4.6 Cyberwar . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
4.7 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
4.8 Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
4.9 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

5 DDoS Research: Traffic 75

5.1 Dataset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
5.1.1 Classification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
5.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
5.2 Traffic Generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
5.2.1 Approaches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
5.2.2 Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
5.2.2.1 Stress Testing / Attack Traffic Generation Tools . . . . . . 82
5.2.2.2 Background Traffic Generation Tools . . . . . . . . . . . . 84
5.2.2.3 Replay Tools . . . . . . . . . . . . . . . . . . . . . . . . . . 86
5.3 (D)DoS Benchmark Datasets . . . . . . . . . . . . . . . . . . . . . . . . . . 86
5.4 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
5.5 Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
5.6 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91

6 DDoS Research: Testing 93

6.1 Network Simulators / Emulators . . . . . . . . . . . . . . . . . . . . . . . . 93
6.1.1 Popular Network Simulators / Emulators . . . . . . . . . . . . . . . 94
6.1.1.1 NS2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
6.1.1.2 NS3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
6.1.1.3 OMNET++ . . . . . . . . . . . . . . . . . . . . . . . . . . 95
6.1.1.4 Shadow . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
6.1.1.5 GNS3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
6.1.1.6 IMUNES . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
6.1.1.7 CORE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
6.1.1.8 Mininet . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
6.1.1.9 VNX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
6.1.1.10 Wistar . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
6.2 Network Testbeds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
6.2.1 Technologies and Concepts . . . . . . . . . . . . . . . . . . . . . . . 99
6.2.2 Popular Network Testbeds . . . . . . . . . . . . . . . . . . . . . . . . 101
6.2.2.1 Emulab . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
6.2.2.2 PlanetLab . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
6.2.2.3 GENI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
6.2.2.4 KREONET . . . . . . . . . . . . . . . . . . . . . . . . . . 102
6.2.2.5 FIRE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
Head over to https://textbookfull.com to browse premium-
quality test banks and solution manuals with special
discounts.
x Contents

6.2.2.6 SAVI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102

6.2.2.7 JGN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
6.3 Case Study - Network Mirroring . . . . . . . . . . . . . . . . . . . . . . . . 103
6.3.1 Experiment Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
6.3.2 Advantages of Experiment Setup . . . . . . . . . . . . . . . . . . . . 105
6.4 Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
6.5 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106

7 DDoS Research: Evaluation 107

7.1 Performance Evaluation Metrics . . . . . . . . . . . . . . . . . . . . . . . . 107
7.1.1 Detection Performance . . . . . . . . . . . . . . . . . . . . . . . . . . 108
7.1.2 Mitigation Performance . . . . . . . . . . . . . . . . . . . . . . . . . 111
7.1.3 System Cost . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
7.1.4 Qualitative Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . 112
7.2 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
7.3 Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
7.4 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113

8 Attack Detection 115

8.1 Classification of DDoS Detection Algorithms . . . . . . . . . . . . . . . . . 115
8.2 An Empirical Study: DDoS Detection Using Operational Network Data . . 117
8.2.1 Literature . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
8.2.2 Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
8.2.2.1 Cumulative Sum (CUSUM) . . . . . . . . . . . . . . . . . . 119
8.2.2.2 Wavelet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
8.2.2.3 Entropy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
8.2.3 Performance Testing Using Operational Network Data . . . . . . . . 123
8.2.3.1 Traffic Volume-based Detection . . . . . . . . . . . . . . . . 123
8.2.3.2 Entropy-based Detection . . . . . . . . . . . . . . . . . . . 132
8.2.3.3 Comparison and Discussion . . . . . . . . . . . . . . . . . . 132
8.2.4 Cusum-Entropy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
8.2.4.1 Cusum - Entropy Algorithm . . . . . . . . . . . . . . . . . 135
8.3 Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137
8.4 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137

9 Deceiving DDoS Detection 139

9.1 A Case Study: Deceiving Entropy-based DDoS Detection Systems . . . . . 140
9.1.1 Entropy Spoofing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140
9.1.1.1 Controlling Entropy Value . . . . . . . . . . . . . . . . . . 142
9.1.2 Experimental Results . . . . . . . . . . . . . . . . . . . . . . . . . . 143
9.1.3 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144
9.2 Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148
9.3 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148

10 Attack Mitigation 151

10.1 Classification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151
10.1.1 Classification-based on Mitigation Time . . . . . . . . . . . . . . . . 151
10.1.1.1 Before An Attack (Prevention) . . . . . . . . . . . . . . . . 152
10.1.1.2 During An Attack (Detection) . . . . . . . . . . . . . . . . 152
10.1.1.3 After An Attack (Reaction / Source Identification) . . . . . 152
Contents xi

10.1.2 Classification-based on Deployment Type . . . . . . . . . . . . . . . 153

10.1.2.1 Centralized . . . . . . . . . . . . . . . . . . . . . . . . . . . 153
10.1.2.2 Distributed . . . . . . . . . . . . . . . . . . . . . . . . . . . 153
10.1.3 Classification-based on Deployment Location . . . . . . . . . . . . . 154
10.1.3.1 Source-based . . . . . . . . . . . . . . . . . . . . . . . . . . 154
10.1.3.2 Destination-based . . . . . . . . . . . . . . . . . . . . . . . 155
10.1.3.3 Network-based . . . . . . . . . . . . . . . . . . . . . . . . . 155
10.1.3.4 Hybrid . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155
10.1.4 Classification-based on Reaction Place . . . . . . . . . . . . . . . . . 155
10.1.4.1 On The Premises . . . . . . . . . . . . . . . . . . . . . . . 156
10.1.4.2 In The Cloud . . . . . . . . . . . . . . . . . . . . . . . . . . 156
10.1.5 Classification-based on Reaction Type . . . . . . . . . . . . . . . . . 156
10.1.5.1 Filtering-based . . . . . . . . . . . . . . . . . . . . . . . . . 157
10.1.5.2 Increasing Attack Surface . . . . . . . . . . . . . . . . . . . 158
10.1.5.3 Moving Target . . . . . . . . . . . . . . . . . . . . . . . . . 160
10.2 Content Delivery Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . 162
10.3 Deflect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168
10.4 DDM: Dynamic DDoS Mitigation System . . . . . . . . . . . . . . . . . . 170
10.4.1 DDM Building Blocks . . . . . . . . . . . . . . . . . . . . . . . . . . 171
10.4.1.1 Resource Manager . . . . . . . . . . . . . . . . . . . . . . . 172
10.4.1.2 DNS Module . . . . . . . . . . . . . . . . . . . . . . . . . . 172
10.4.1.3 Deflect Module . . . . . . . . . . . . . . . . . . . . . . . . . 173
10.4.1.4 Data Collection Module . . . . . . . . . . . . . . . . . . . . 175
10.4.1.5 Decision Module . . . . . . . . . . . . . . . . . . . . . . . . 175
10.4.1.6 DDM Controller . . . . . . . . . . . . . . . . . . . . . . . . 175
10.4.2 DDM Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176
10.4.2.1 Attack Scenarios . . . . . . . . . . . . . . . . . . . . . . . . 178
10.4.2.2 Test Results . . . . . . . . . . . . . . . . . . . . . . . . . . 180
10.4.3 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188
10.5 DDoS Mitigation Using Game Theory . . . . . . . . . . . . . . . . . . . . . 190
10.5.1 Distributed Denial of Service Mitigation Approach - Traffic Flow . . 192
10.5.1.1 Player 1 - Blue . . . . . . . . . . . . . . . . . . . . . . . . . 193
10.5.1.2 Player 2 - Red . . . . . . . . . . . . . . . . . . . . . . . . . 197
10.5.2 Distributed Denial of Service Mitigation Approach - Reconfiguration
Strategies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204
10.5.2.1 Game . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204
10.5.2.2 Sum of Games and Thermographs . . . . . . . . . . . . . . 207
10.6 Economic Denial of Sustainability . . . . . . . . . . . . . . . . . . . . . . . 218
10.7 Discussion and Comparison . . . . . . . . . . . . . . . . . . . . . . . . . . . 219
10.8 Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221
10.9 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221

11 Security and DDoS in SDN: Opportunities and Challenges 223

Mehmet Demirci
11.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223
11.2 Fundamentals of SDN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224
11.3 Improving Network Security with SDN . . . . . . . . . . . . . . . . . . . . 225
11.3.1 Implementing Flexible and Cost-effective Security Functions . . . . . 226
11.3.2 Deception and Moving Target Defense . . . . . . . . . . . . . . . . . 227
11.3.3 Securing Protocols against Spoofing . . . . . . . . . . . . . . . . . . 228
11.3.4 Other Opportunities . . . . . . . . . . . . . . . . . . . . . . . . . . . 230
xii Contents

11.4 New Security Threats against SDN . . . . . . . . . . . . . . . . . . . . . . 231

11.4.1 Reconnaissance against SDN . . . . . . . . . . . . . . . . . . . . . . 232
11.4.2 Taking Advantage of the Widened Attack Surface . . . . . . . . . . 233
11.5 DDoS in SDN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234
11.5.1 New DDoS Attacks Threatening SDN . . . . . . . . . . . . . . . . . 234
11.5.2 Using SDN for Better DDoS Defense . . . . . . . . . . . . . . . . . . 235
11.6 Discussion and Future Trends . . . . . . . . . . . . . . . . . . . . . . . . . 236
11.7 Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237
11.8 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237

12 Denial of Service Attack in Control Systems 239

Zoleikha Abdollahi Biron and Pierluigi Pisu
12.1 DoS Attack in Cyber Physical Systems . . . . . . . . . . . . . . . . . . . . 240
12.2 Modeling DoS Attack From Control Perspective . . . . . . . . . . . . . . . 243
12.3 DoS Attack Estimation and Countermeasure . . . . . . . . . . . . . . . . . 244
12.3.1 Overview on Observer Design and Diagnostics . . . . . . . . . . . . 244
12.3.2 Adaptive Observer Design . . . . . . . . . . . . . . . . . . . . . . . . 246
12.4 Proposed Algorithm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247
12.5 Case Study and Simulation Results . . . . . . . . . . . . . . . . . . . . . . 251
12.6 Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258
12.7 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259

13 Denial of Service Attack on Phasor Measurement Unit1 261

Paranietharan Arunagirinathan, Richard R. Brooks, Iroshani Jayawardene, Dulip
Tharaka Madurasinghe, Ganesh Kumar Venayagamoorthy, Fu Yu, and Xingsi Zhong
13.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261
13.2 Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262
13.2.1 The Synchrophasor Protocol . . . . . . . . . . . . . . . . . . . . . . 262
13.2.2 Security Gateways . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262
13.2.3 Side-Channel Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . 264
13.2.3.1 Hidden Markov Models . . . . . . . . . . . . . . . . . . . . 265
13.2.4 Man-In-The-Middle Attack . . . . . . . . . . . . . . . . . . . . . . . 266
13.3 Two-Area Four Machine Power System with Utility-Scale PV Plant and
PMUs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 266
13.3.1 PMU Traffic Separation Algorithm . . . . . . . . . . . . . . . . . . . 268
13.3.2 DoS Attack on PMU Measurement Traffic . . . . . . . . . . . . . . . 270
13.4 AGC Operation Under Attack . . . . . . . . . . . . . . . . . . . . . . . . . 271
13.4.1 Experimental Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . 272
13.5 Consequences of DoS Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . 272
13.5.1 Fault and Attack without Countermeasure . . . . . . . . . . . . . . . 272
13.5.2 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 272
13.6 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 276
13.7 Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 276
13.8 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 276

14 DDoS Lab 279

14.1 Toolbox . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279
14.1.1 Wireshark / tshark . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279
14.1.2 Scapy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280
14.1.3 JMeter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 281
14.1.4 Apache Traffic Server (ATS) . . . . . . . . . . . . . . . . . . . . . . 282
Contents xiii

14.1.5 Apache HTTP Server . . . . . . . . . . . . . . . . . . . . . . . . . . 282

14.1.6 BIND Domain Name Server . . . . . . . . . . . . . . . . . . . . . . . 282
14.1.7 Virtualbox . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 282
14.1.8 Deflect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 284
14.1.9 Distributed DDoS Mitigation Tool (DDM) . . . . . . . . . . . . . . . 284
14.2 Lab Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 284
14.2.1 Data Handling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285
14.2.1.1 Course Background . . . . . . . . . . . . . . . . . . . . . . 285
14.2.1.2 Attestation . . . . . . . . . . . . . . . . . . . . . . . . . . . 286
14.2.2 Assignment / Project Report . . . . . . . . . . . . . . . . . . . . . . 287
14.2.2.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . 287
14.2.2.2 Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . 287
14.2.2.3 Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 288
14.2.2.4 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . 288
14.2.2.5 Comments . . . . . . . . . . . . . . . . . . . . . . . . . . . 288
14.2.2.6 Bibliography . . . . . . . . . . . . . . . . . . . . . . . . . . 288
14.2.2.7 Appendix . . . . . . . . . . . . . . . . . . . . . . . . . . . . 288
14.3 Assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289
14.3.1 Attack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289
14.3.1.1 Sniffing Network . . . . . . . . . . . . . . . . . . . . . . . . 289
14.3.1.2 Man in the Middle . . . . . . . . . . . . . . . . . . . . . . . 291
14.3.1.3 Spoofing . . . . . . . . . . . . . . . . . . . . . . . . . . . . 292
14.3.1.4 Network Background Traffic Generation . . . . . . . . . . . 294
14.3.1.5 DDoS Simulation . . . . . . . . . . . . . . . . . . . . . . . 297
14.3.1.6 Syn Flood . . . . . . . . . . . . . . . . . . . . . . . . . . . 298
14.3.1.7 Bandwidth Starvation Attack . . . . . . . . . . . . . . . . . 300
14.3.1.8 Amplification / Reflection . . . . . . . . . . . . . . . . . . . 302
14.3.1.9 HTTP GET / POST . . . . . . . . . . . . . . . . . . . . . 304
14.3.2 Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306
14.3.2.1 Thresholding . . . . . . . . . . . . . . . . . . . . . . . . . . 308
14.3.2.2 Cusum . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 308
14.3.2.3 Cusum - Wavelet . . . . . . . . . . . . . . . . . . . . . . . . 308
14.3.2.4 Wavelet - Cusum . . . . . . . . . . . . . . . . . . . . . . . . 309
14.3.2.5 Entropy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309
14.3.2.6 Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309
14.3.3 Deception . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 310
14.3.4 Mitigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 311

15 Conclusion 319
15.1 Analysis and Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319
15.2 Suggestions for Future Research . . . . . . . . . . . . . . . . . . . . . . . . 320
15.3 Final Words . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 321

16 Appendix 323
Xingsi Zhong and Oluwakemi Ade Aina
16.1 Generate TCP Traffic with Ostinato . . . . . . . . . . . . . . . . . . . . . . 323
16.2 Mininet Quick Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 327
16.2.1 Mininet Quick Hands-On . . . . . . . . . . . . . . . . . . . . . . . . 327
16.2.1.1 Install Mininet . . . . . . . . . . . . . . . . . . . . . . . . . 327
16.2.1.2 Access Mininet VM . . . . . . . . . . . . . . . . . . . . . . 328
16.2.1.3 Start and Stop Mininet . . . . . . . . . . . . . . . . . . . . 328
xiv Contents

16.2.2 Mininet Lab Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . 329

16.2.2.1 Create a Topology . . . . . . . . . . . . . . . . . . . . . . . 329
16.2.2.2 Run Applications on the Network . . . . . . . . . . . . . . 330
16.3 NS2 DDoS Simulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 332
16.3.1 Explanation of Script “attack.tcl” . . . . . . . . . . . . . . . . . . . 333
16.3.1.1 Key Concepts . . . . . . . . . . . . . . . . . . . . . . . . . 333
16.3.1.2 Explanation of the Script . . . . . . . . . . . . . . . . . . . 334
16.3.1.3 SYN Flood . . . . . . . . . . . . . . . . . . . . . . . . . . . 337
16.4 TCP SYN Flooding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 338
16.4.1 Set up the Victim Server . . . . . . . . . . . . . . . . . . . . . . . . 338
16.4.1.1 Set up a Web Server . . . . . . . . . . . . . . . . . . . . . . 338
16.4.1.2 Toggle The SYN Settings . . . . . . . . . . . . . . . . . . . 339
16.4.2 Client Script . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 339
16.4.3 Lunch the Attack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 339
16.5 DNS Amplification Attack . . . . . . . . . . . . . . . . . . . . . . . . . . . 339
16.5.1 Simple DNS Request . . . . . . . . . . . . . . . . . . . . . . . . . . . 340
16.5.2 A Spoofed DNS Request . . . . . . . . . . . . . . . . . . . . . . . . . 340
16.5.3 Build a DNS Record on the Master DNS Server . . . . . . . . . . . . 340
16.5.4 DNS Amplification Attack . . . . . . . . . . . . . . . . . . . . . . . . 341
16.5.4.1 Attack Performance . . . . . . . . . . . . . . . . . . . . . . 342
16.6 Elastic CDN Assignment . . . . . . . . . . . . . . . . . . . . . . . . . . . . 342
16.6.1 Reverse Cache Proxy . . . . . . . . . . . . . . . . . . . . . . . . . . . 343
16.6.2 DNS Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 345
16.6.3 Scale Up . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 346

Bibliography 347

Index 391
Random documents with unrelated
content Scribd suggests to you:
 MuoNKvl MYTH OF THE MILKY WAY 1053 This is one of tlie
favorite sougs of the Paiute Ghost dance. The tune has a plaintive
but rather pleasing effect, although inferior to the tunes of most of
the ghost songs of the prairie tribes. The words as they stand are
very simple, but convey a good deal of meaning to the Indian. It
must be remembered that the dance is held in the open air at night,
with the stars shining down on the wide-extending plain walled in by
the giant sierras, fringed at the base with dark pines, and with their
peaks white with eternal snows. Under such circumstances this song
of the snow lying white upon the mountains, and the Milky Way
stretching across the clear sky, brings up to the Paiute the same
patriotic home love that comes from lyrics of singing birds and leafy
trees and still waters to the people of more favored regions. In the
mythology of the Paiute, as of many other tribes, the Milky Way is
the road of the dead to the spirit world. Bo'rdni' serves merely to fill
in the meter. 2. DP.na' gayo'n iDSna' gayo'n, D6'na ga'yoni', Dena'
gayo'n, Dfi'na ga'yoni', Bawil' doro'u, Ha'wil do'roni', * Bawa' doro'n,
Ba'wft do'roni'. Trannlation A slender antelope, a blender antelope, A
slender antelope, a slender antelope, He is wallowing npon the
ground, He is wallowing upon the ground, * He is wallowing upon
the ground, He is wallowing upon the grounii. This song evidently
refers to a trance vision in which the sleejjer saw an antelope rolling
in the dust, after the manner of horses, buffalo, and other animals.
3. Do' Ti'MBI Do' ti'mhi. Do' tl'mbi-nii'n, Do' ti'mbi, Do' tl'iubi-nii'n,
TI'mbi bai'-yo, Ti'mbi ba'i-yo-a'n, Ti'mbi bai'-yo, TI'mbi ba'i-yo-a'n.
Translation The black rock, the black rock, The black rock, the black
rock, The rock is broken, the rock is broken, The rock is broken, the
rock is broken. This song may refer to something in Paiute
mythology. Nd'n and a'n are unmeaning syllables added to fill out
the measure. 4. PXsr' Wl'XOGHAN PiisU' wl'noghiin, Piisii' wl'noghiin,
PJisii' wl'noghiin,
 1054 THE GHOST-DANCE RELIGION fuTH. anx. 14 Wai'-va
wi'uoghiin, Wai'-va wrnogliiin, Wai'-va wl'noghiin. Translation The
wind stirs tlie willows, The wind stirs the willows, The wind stirs the
willows, The wind stirs the grasses, The wind stirs the grasses, The
wind stirs the grasses. Wai'-va (or wai in compositioii ) is tbe saud
grass or wild millet of 'Nevada, {Oryzopsis membranacea), the seeds
of which are ground by the Paiute and boiled into mush for food. 5.
Pagu'nava' Pagil'niiva' ! PiigU'niiva' ! Tftngwii'kwiji' ! Tflngwii'kwiji'!
Wftmbe'doma' ! Wtimbe'doma' ! Translation • Fog! Fog! Lightning!
Lightning! Whirlwind! Whirlwind! This song is an invocation of the
elemental forces. It was composed by an old woman, who left the
circle of dancers and stood in the center of the ring while singing it.
6. WOmbI'ndoma'n Wftmht'ndoma'n, Wftmbl'ndomii'n,
Wflmbi'ndomii'n, Wflmbl'ndoma'n. Nuvii'ri'p noyo'wana', Nuva'rI'p
noyo'wanfi', Nuvii'rI'p noyo'wana', Nuva'rI'p noyo'wana'. Translation
The whirlwind! The whirlwind! The whirlwind ! The whirlwind ! The
snowy earth comes gliding, the snowy earth comes gliding; The
snowy earth comes gliding, the snowy earth comes gliding. This
song may possibly refer to the doctrine of the new earth, here
represented as white with snow, advancing swiftly, driven by a
whirlwind. Such an idea occurs several times in the Arapaho songs.
7. Kosi' wOmbi'ndoma' Kosi' wftmbi'ndoma', Kosi' wftmbi'udomii',
Kosi' wambi'ndomii'.
 MOONSYl SONGS OF THE PAIUTE 1055 Kai'-va
wumbi'iidoiuii', Kai'-va Avftmbi'iidomil', Kai'-va wftmbi'iidoraii'.
Translation There is dust from the whirlwind, There is dust from the
whirlwind, There is dust from the whirlwind. The whirlwind on the
mountain. The whirlwind on the mountain, The whirlwind on the
mountain. 8. Dombi'na so'wina' Dombi'na so'wina', Dombi'na
so'wina', Dombi'na so'wina'. Kai'-va so'wina', Kai'-va so'wina', Kal'-va
so'wina' lyanslation The rocks are ringing, The rocks are ringing. The
rocks are ringing. They are ringing in the mountains, They are
ringing in the mountains. They are ringing in the mountains. This
song was explained to refer to the roaring of a storm among the
rocks in the mountains. 9. SO'NG-.\ RO'YONJI' Sft'ng-ii ro'yonji',
Sfl'ng-a ro'yon, Sft'ng-a ro'yonji', Stt'ng-a ro'yon, Sft'ng-ii ro'yonji',
Sfl'ng-a ro'yon. Pu'i do'yonji', Pu'i do'yon, Pu'i do'yonji', Pu'i do'yon,
Pu'i do'yonji', Pu'i do'yon. Translation The cotton woods are growing
tall, The cottonwoods are growing tall, The cottonwoods are growing
tall. They are growing tall and verdant. They are growing tall and
verdant. They are growing tall and verdant. This song seems to refer
to the return to spring. Throughout the arid region of the west the
cottonwood skirting the borders of the streams is one of the most
conspicuous features of the landscape. See Arapaho song 13. 14
ETH — PT 2 27
 1056 THE GHOST-DANCE RELIGION [ETII. ANN. 14 PAIUTE
GLOSSARY Jgai'h-tika'ra — "fish eaters;" the distinctive name of the
Paiute of Walker lake, Nevada. Bai'-yo — it is bioken. Sa'wd — going
around in a circle Dina — for Ti'na. Do — black. Dombi'na — for
Ti'mhi or TUbi. Do'roni — rolling on the ground, wallowing. Do'yon
or Do'yonji — it is growing tall. Ga'yon or Ga'yoni — slender, tall and
slender. Gosi'pa — the Milky Way, the road of the dead. See Paiute
song 1 Hdvi'ginu — it lies there, it lies there asleep; havi'kwA, sleep.
Sogdpa'goni — " rush-arrow people ; " the Shoshoni name for the
Paiute; from hogap, a small water reed; pagd, arrow, and nt, the
tribal suffix. Hutsi — the sage-hen {Centroeercus urophasianus) .
Ibidsi'i — "our mother;" the mythic maternal ancestor of the Paiute.
Jack Wilson — see Wovoka. Ka — the root of the verb tit ;
yd'nakatU' , I am sitting down. Eai-va — mountain. KoH — for
Kosi'ba. Kosi'ba — dust. Kotso'-ltka'ra — "buffalo eaters;" the Paiute
name for the Bannock. Compare Ko'tao-Wka, a Comanche division.
Kura'ngwa — " very high peak ; " applied to Mount Grant, the sacred
mountain of the Paiute, west of Hawthorne and near the
southwestern end of Walker lake, Nevada. Ktvohi'tsauq or K'wijau'h
— "big rumbling belly," one of the names assumed by Wovoka the
messiah. It was originally the name of his paternal grandfather.
Ndnigii'kua — the Paiute name of the Ghost dance. The word
signifies the " dance in a circle; " niika, a dance. Noyo'd — to come
gliding or creeping; the verb is applied to the movement of a snake
or of an object which progresses without the aid of feet. i»oyi''vmna
— for Noyo'd. Niimd — "people," or "Indians," the name used to
designate themselves by the Paiute, Shoshoni, and Comanche.
Niimi'-nad' — "our father;" the mythic ancestor of the Paiute. Niivd
— for XUvd'bi. NUvd'bi — snow. NUvd'-ri'pd—Biiowy earth, snow-
covered earth (compound word); (roni niird'bi, snow, and ri'pd or
ti'pd, earth. Pdgii'nard — -fog. Paiute or Piu'te — (Pai-yu't) the name
by which the Niima of Nevada and the adjacent region are popularly
and officially known. It has been rendered as "true {pai) Ute" or "
water {pa) Ute." They themselves pronounce the word in three
syllables, Pai-u'-H. Pai-yu'chimC — the Hopi name for the Paiute. Pai-
yu'tsI — the Navaho n^me for the Paiute. PalC — the Washo name
for the Paiute. PdsW — for Pdaii'bi. PdsU'bi — willow. Pavio'tso —
the proper tribal name of the Indians of Walker River and Pyramid
Lake reservations in Nevada, according to Powell, who considers
them distinct from the Paiute. Pu'i — for Pu'igai'-yii. Pu'igai'-yu —
verdant, green (applied to growing plants). Bo'rani — an unmeaning
word used to fill out the measure of the songs. Eo'yon or Bo'yonji —
other forms of Do'yon. Snake Indians — a name loosely applied to
various northern bands or tribes of Shoshonean stock, including
Paiute, Bannock, Shoshoni, andsometimeseven , the Comanche.
Sowi'na — ringing like a bell, roaring. Su'ng-d — for Su'ng-dbi.
Su'ng-dbi — Cottonwood. Taivo— the Paiute, Shoshoni, and
Comanche name for a white man. See I'd'ribo. TdktotV ktoij —
lightning. Td'vibo — "white man," the father of Wovoka tlie messiah.
The word has a connection with tdhi or Uivi, the sun ; idvd'ndgwdt,
the east or sunrise place,
The text on this page is estimated to be only 27.48%
accurate

MooNEY] PAIUTE GLOSSARY 1057 and (ai'-fo, tbeSlioshoiii

and Comanche of poles. The word is of uncertain name for a white
man. origin. Ti'mbi
 1058 THE GHOST-DANCE RELIGION [eth. ann.U SKETCH
OF THE TRIBE Tbe Sioux constitute the largest tribe in tlie United
States, and are too well known to need an extended description
here. Although now thought of chiefly as a prairie tribe, their
emergence upon tlie plains is comparatively recent, and within tiie
historic period their range extended as far eastward as central
Wisconsin, from which, and most of Minnesota, they have been
driven out by the westward advance of the Ojibwa. There is ground
for believing that the true home of the whole Siouan stock is not in
the west, or even in the central region, but along the south Atlantic
slope. (See the author's Siouan Tribes of the East.) The Sioux
language has three well-marked dialects — the eastern or Santee,
the middle or Yankton (including the Asiniboin in the north), and the
western or Teton. The tribe consists of seven great divisions, each of
which again has or had subdivisions. Dorsey enumerates over one
hundred in all. Each grand division had its own camping circle, and
when two or more such divisions camped together they usually
camped in concentric circles. {Dorset/.) The seven great divisions
are: 1. Mdewakantomran (Medewacanfon), "village of the Spirit
lake;" 2. Waqpekute (Wahpacoota), "leaf shooters;" 3.
Waqpetoiiioan (Wahpeton), "leaf village ;" 4. Sisitonwail (Sisseton),
variously rendered "slimy village" or "swamp village ;" 5.
Ihanktoflwaii (Yankton), "end village;" 6. Ihanlitonicanna
(Yanktonais), "upper end village;" 7. Titoiiwan (Teton), "prairie
village." The first four divisions collectively are known as Isaiiati or
Santee Sioux. The name is supposed to be derived from isail, the
dialectic word for "knife." They formerly held Mississippi, Minnesota,
and upper Eed rivers in Minnesota and were afterward gathered on
reservations at Devils lake, North Dakota; Lake Traverse (Sisseton
agency) and Flandreau, South Dakota; and Santee agency,
Nebraska. Those at Lake Traverse and Flandreau have now taken
allotments as citizens. The Yankton and Yanktonais, together
speaking the middle dialect, occupied chiefly the country of James
river, east of the Missouri, in North Dakota and South Dakota and
extending into Iowa. They are now on Yankton and Crow Greek
reservations in South Dakota, and Fort Peck reservation, Montana.
The Teton constitute more than two-thirds of the whole Sioux tribe,
and held nearly the whole country southwest of the Missouri from
Cannonball river to the South Platte, extending westward beyond the
Black hills. They are all now on reservations in South and North
Dakota. They are again subdivided into seven principal divisions: 1.
Sichaiigu, "burnt thighs" (Brules), now on Rosebud reservation; 2.
Ogalala, referring to "scattering" of dust in the face (Clark), now on
Pine liidge reservation, under the celebrated chief Red Cloud
{MaqpeLuta); 3. Hunkpapa, "those who camp at the end (or
opening)
 M(K>sEv] SKETCH OF THE SIOUX 1059 of the caiiii)iiig
circle" (Chirk), on StiUKliiiK Kock reservation; 4, Minikanzu, " those
wlio ])hiiit by the water," on Cheyenne River reservation; 5. Itaziph),
" without bows" (Sans Arcs), on Cheyenne River reservation; 6.
Siliasapa, "bhick feet" (not to be confounded with the Blackfoot
tribe), on Cheyenne River and Standing Rock reservations; 7.
Ohenofqja, " two kettles," on Cheyenne River and Rosebud
reservations. According to the official report for 18J)3, the Sioux
within the United States number about 23,410, which, with GOO
permanently settled in Manitoba, make the whole population about
24,000 souls. The Sioux, under the name of Nadouessi, are
mentioned by the Jesuit missionaries as early as 1632. They made
their first treaties with our government in 1815. The most prominent
events in their history since that date have been the treaty of Prairie
du Chien in 1825, which defined their eastern boundary and stopped
the westward advance of the Ojibwa; the Minnesota massacre of
1862, which resulted in the expulsion of the Sioux from Minnesota;
the Sioux war of 1876-77, largely consequent on the unauthorized
invasion of the Black hills by miners, and the chief incident of which
was the defeat and massacre of an entire detachment under General
Custer; the treaty by which the great reservation was broken up in
1889, and the outbreak of 1890, with the massacre of Wounded
Knee. By reason of their sui)erior numbers the Sioux have always
assumed, if not exercised, the loidship over all the neighboring tribes
with the exception of the Ojibwa, who, having acquired firearms
before the Sioirx, were enabled to drive the latter from the
headwaters of the Mississippi, and were steadily pressing them
westward when stopped by the intervention of the TTnited States
government. The Sioux in turn drove the Cheyenne, Crow, Kiowa,
and others before them and forced them into the mountains or down
into the southern prairies. The eastern bands were sedentary and
largely agricultural, but the Teton were solely and preeminently
wandering buffalo hunters. All dwelt in tipis — the word is from the
Sioux language — which were of bark in the timber country and of
buflfalo skins on the plains. In warlike character they are probably
second only to the Cheyenne, and have an air of proud superiority
rather unusual with Indians. Clark says of them, "In mental, moral,
and physical qualities I consider the Sioux a little lower but still
nearly equal to the Cheyenne, and the Teton are the sui>eiior
branch of the family." {Indian Sign Language, 345.) The eastern
Sioux are now far advanced toward civilization through the eflbrts of
teachers and missionaries for over a generation, and the same is
true in a less degree of the Yankton, while the majority of the Teton
are still nearly in their original condition. I found the Sioux very
difficult to ajiproach on the subject of the Ghost dance. This was
natural, in view of the trouble that had resulted to them in
consequence of it. When I was first at Pine Ridge, the trooi)s still
camped there served as a reminder of the conflict, while in.
 1060 THE GHOST-DAXCE RELIGION [eth. axx. 14 the little
cemetery at the agency were the fresh graves of the slain soldiers,
and only a few miles away was the Wounded Knee battlefield and
the trench where the bodies of nearly three hundred of their people
had been thrown. To my questions the answer almost Invariably
was, "The dance was our religion, but the government sent soldiers
to kill us on account of it. We will not talk any more about it."
Another reason for their unwillingness was the fact that most of the
interpreters were from the eastern or Santee i)ortion of the tribe,
and looked with contempt on the beliefs and customs of their more
primitive western brethren, between whom and themselves there
was in consequence but little friendly feeling. On one occasion, while
endeavoring to break Fig. 102 — Native drawings of G liost dance —
A, Comanche j B, Sioux the ice with one of the initiates of the dance,
I told him how willingly the Arapaho had given me information and
even invited me to join in the dance. "Then," said he, " don't you
find that the religion of the Ghost dance is better than the religion of
the churches?" I could not well say yes, and hesitated a moment to
frame an answer. He noticed it at once and said very deliberately,
"Well, then, if you have not learned that you have not learned
anything about it," and refused to continue the conversation. The
Sioux ghost songs are all in the dialect of the Teton, who took the
most active interest in the dance, which was hardly known among
the bands east of the Missouri. The vocalic character of the
language,
 MooNEY] SONGS OF THE SIOUX 1061 and the frequent
liquid I of this dialect, renders these songs peculiarly musical, while
for beauty of idea and expression they are second only to those of
the Arapalio. SONGS OF THE SIOUX 1. A'TK IIK'YK K'YAYO f Opening
song A'te Im'ye e'yayo ! A'te be'ye e'yayo! A'te he'ye lo, A'te he'ye
lo. NitnTikanshi'la wa'fiyegala'ke — kta' e'yayo'! Nitu'nkaushi'la
wa'nyegala'ke — kta' e'yayo' I A'te he'ye lo, A'te he'ye lo. Ni'takuye
wanye'gftla'ke — kta e'yayo'! Ni'takuye wauye'gilla'ke — kta e'yayo'!
A'te he'ye lo, A'te he'ye lo. Trantlation The father says so — E'l/ayo!
The father says so — E'yayo! • The father says so, The father says
so. You shall see your grandfather — E'yayo'! *• You shall see your
grandfather — E'yayo'! The father says so, The father says so. You
shall see your kindred — E'yayo'! You shall see your kindred —
E'yayo'! The father says so, The father says so. This is the opening
song of the dance. While singing it, all the dancers stand motionless
with hands stretched out toward the west, the country of the
messiah and the quarter whence the new spirit world is to come.
When it is ended, all cry together, after which they join hands and
begin to circle around to the left. " Grandfather," as well as " father,"
is a reverential term applied to the messiah. 2. Mi'chI'nkshi naSpe
Michl'nkshi nanpe ma'yuzaye, Michl'nkshi nanpo ma'yuzaye, A'te
he'ye lo, A'te he'ye lo. Ini'cha}{he-kte, Ini'chaghe-kte, A'te he'ye lo,
A'te he'ye lo. Ch.^noTipa wa'u chi'cha-u'pi,
 1062 THE GHOST-DANCE RELIGION [kth. ann.U »
ChSnoTipa waTi chi'cha-u'pi, Ate Le'ye lo', A'te he'he lo'. Cha' -
yani'pi-kta', Cha'-yani'pi-kta', A'te he'ye lo', A'te he'ye lo'. • '
Translation My son, let me grasp your hand, My son, let me grasp
your band, Says the father, Says the father. You shall live. You shall
live. Says the father, Says the father. I bring you a pipe, I bring you
a pipe, Says the father. Says the father. By means of it you shall live,
By means of it yon shall live. Says the father. Says the father. This
song refers to the sacred pipe which, according to the Sioux
tradition, was brought to them by a mysterious young woman from
the spirit world. The story, as outlined by Captain J. M. Lee, is as
follows: In the old times the Sioux were always at war, not only with
other tribes, but also among themselves. On one occasion two
young men were out hunting when they saw a young woman
approaching them with folded arms. Seeing that she was not of their
own tribe, one proposed to the other that they kill her, but he
refused and urged that they wait until they learned what she
wanted. The first speaker, however, was about to kill her as she
drew near, when she suddenly stooped down and took from around
her ankle something resembling an anklet, which she waved about
her head. The motion was so rapid that it seemed as though a cloud
encircled her for a few moments, when she ceased, and the snake
which she had taken from off her ankle glided away through the
grass. But the young warrior who had thought to kill her had
disappeared, swept from the face of the earth. Turning now to his
companion, she said, "To you I come as a friend and helper. Your
people have been killing each other. I bring you a pipe, which is a
token of peace," and she held out a pipe as she spoke. "When you
smoke it your thoughts will be of peace, and no murderer (i. e., no
one who kills a member of his own tribe) must be allowed to smoke
it." She returned with him to his village, where the women prepared
for her reception a large tipi, to which the chiefs of the tribe came to
listen to her instructions. She taught them to be at peace with
 ■ooNEYi SACRED PIPE OF THE SIOUX 1063 one another, if
they would be happy, and when tliey listened to her words and
acce])ted her teachings, she gave them the sacred medicine pipe to
smoke thenceforth in their councils as a perpetuiil reminder of the
peace covenant of the Lakota. Her mission now ended, she said she
must leave them, and although they begged her earnestly to stay
with them, she could not tarry longer, but disappeared as suddenly
and mysteriously as she had come. A variant of this legend is given
by Colonel Mallery in his paper in the Tenth Annual Report of the
Bureau of Ethnology, where it is illustrated by a colored plate from a
picture by the Indian story teller. According to this version, the pipe
maiden was the mysterious white Bufialo Cow, and brought, with the
pipe, a package of four grains of maize of different colors. This corn
sprang from the milk which dropped from her udder, and was thus,
with the flesh of the buffalo itself, appointed from the beginning to
be the food of all the red tribes. The seeming snakes about her waist
and ankles were really blades of grass (corn?). She taught the
people to call her "grandmother," a reverential title among Indians,
and after leading them to her relatives, the buffalo, she faded from
their sight as they stood gazing at her. The pipe holds an important
part in the mythology and ritual of almost all our tribes, east and
west, and no great ceremony is complete and no treaty was ever
ratified without it. It is generally symbolic of peace and truth. As a
peace emblem, it was formerly carried by every bearer of a friendly
message from one tribe to another and was smoked in solemn
ratification of treaties, the act of smoking being itself in the nature of
an oath. Among the prairie tribes an individual accused of crime is
offered the sacred pipe, and if he accepts it and smokes he is
declared innocent, as no Indian would dare to smoke it if guilty. The
ordinary ceremonial pipe of the prairie tribes is made of the red
stone, known as catlinite, from the famous pipestone quarry in
Minnesota in the old country of the Sioux. The peace pipe of the
Cherokee was made of a white stone, somewhat resembling talc,
from a quarry near Knoxville, Tennessee. It is said to have had seven
stem holes, emblematic of the seven clans of the Cherokee, and was
smoked bv seven counselors at the same time. In every case the
tribe has a legend to account for the origin of the pipe. A flat pipe is
the tribal "medicine" of the Arapaho, and is still preserved with the
northern band in Wyoming. (See Arapaho songs 1 and 2.) Besides
the stone pipe, there are also in use pipes of clay or bone, as well as
cigarettes, but as a rule no ceremonial character attaches to these.
In ceremonial smoking the pipe is jjassed around the circle of
councilors, each of whom takes only a few whifls and then hands it
to his neighbor. Each one as he receives the pipe offers it first to the
sun, holding the bowl up toward the sky and saying, "Grandfather,
smoke;" then to the earth, the fire, and perhaps also to each of the
four cardinal points and to one or another of their mythologic
heroes. Among the Kiowa
 1064 THE GHOST-DANCE RELIGION [bth. a-jn.U I have
seen a man hold up the pipe to the sky, saying, " Smoke, Sinti" (Sinti
being their great mythologic trickster), and then in the same way, "
Smoke, Jesus." In the Ghost dance at Eosebud and Pine Eidge, as
usually performed, a young woman stood in the center of the circle
holding out a pipe toward the messiah in the west, and remained
thus throughout the dance. Another young woman usually stood
beside her holding out a hdqati wheel (see Arapaho song 49) in the
same way. This feature of the dance is said to have been introduced
by Short Bull. 3. He tuwe'cha he He tuwe'cha he u echa'ni hwo? He
tuwe'cha he u echa'ni hwo? Huuku oki'le chaya he u hwo? Hufiku
oki'le chaya he u hwo? A't«-ye he'ye lo, A'te-ye he'ye lo. Translation
Who think you comes there? Who think you comes there? Is it
someone looking for his mother? Is it someone looking for his
mother? Says the father, Says the father. In this the singer tells how
he was greeted by his former friend upon entering the spirit world,
to which he had gone in search of his mother. 4. Wana'yaS ma'niye
Wana'yan ma'niye, Wana'yafi ma'niye. Tata'nka wan ma'niye,
Tata'fika wan ma'niye, , A'te he'ye lo, A'te he'ye lo. Translation Now
he is walking, Now he is walking. There is a buffalo hull walking,
There is a buffalo bull walking. Says the father, Says the father. The
maker of this song. In her vision of the spirit world, evidently saw a
herd of buflFalo, with a bull walking about near them. The form of
the verb shows that a woman is supposed to be talking.
The text on this page is estimated to be only 27.73%
accurate

«<>oNBY] SONGS OF THE SIOUX 1065 5. Lkciiki. miy()'

 1066 THE GHOST-DANCE RELIGION [ETH. ANN. U
Translation Give me my knife, Give me my knife, I shall hang up the
meat to dry— Te't/e' ! I shall hang up the meat to dry — Ye'i/e' !
Says grandmother — Yo'yo' ! Says grandmother — Yo'yo' ! When it is
dry I shall make pemmican, When it is dry I shall make pemmican,
Says grandmother — Yo'yo! Says grandmother — Yo'yo! This song
brings up a vivid picture of the old Indian life. In her trance vision
the old grandmother whose experience it relates came upon her
friends in the spirit world just as all the women of the camp were
engaged in cutting up the meat for drying after a successful buffalo
hunt. In her joy she calls for her knife to assist in the work, and says
that as soon as the meat is dry she Avill make some pemmican. riQ.
103— Jerking beef. In the old days an Indian camp during the
cutting up of the meat after a buffalo hunt was a scene of the most
joyous activity, some faint recollection of which still lingers about
ration day at the agency. Thirty years ago, when a grand hunt was
contemplated, pre[7arations were made for days and weeks ahead.
Couriers weri- sent out to collect the neighboring bands at a
common rendezvous, medicine-men began their prayers and
ceremonies to attract the herd, the buffalo songs were sung, and
finally when all was ready the confederated bands or sometimes the
whole tribe — men, women, children, horses, dogs, and travois —
moved out into the buffalo grounds. Here the immense camp of
hundreds of tipis was set up, more ceremonies were i)erformed.
 MooNEY] JERKED MEAT ANIJ PEMMICAN 1067 and the
mounted warriors rode out in a body to surround and slaughter the
licrd. The women followed close after them to strip the hides from
the fresh carcasses and cut out the choice portion of the meat and
tallow and l)ring it into camp. Here the meat was cut into thin strips
and hung upon frames of liorizontal i)ole8 to dry, while the tallow
was stripped otf in flakes. In the dry prairie atmosphere one day is
usually suHicient to cure the meat, without the aid of salt or smoke.
When thus dried it is known as "jerked beef." While the meat is
fresh, for the first day or two the camp is a scene of constant
feasting, the juicy steaks or the sweet ribs being kept broiling over
the coals in one tipi or another until far into the night. It is the
harvest home of the prairie tribes. As soon as the meat is dry, the
tipis are taken down and packed into the wagons along with the
meat, and one family after another starts for home until in a short
time the great camp is a thing of the past. The jerked beef or
venison is commonly prepared for eating by being boiled until
reasonably tender. In eating, the Indian takes a strip thus cooked,
dips one end into a soup made by dissolving some salt in warm
water, takes the portion thus salted between his teeth, and saws off
enough for a mouthful with a knife held in his other hand. Between
moutlifuls he takes bites from a strip of dried tallow placed in the
dish with the meat. For pemmican the jerked beef or other meat is
toasted over a fire until crisp and is then pounded into a hash with a
stone hammer. In the old times a hole was dug in the ground and a
buffalo hide was staked over so as to form a skin dish, into which
the meat was thrown to be pounded. The hide was that from the
neck of the buffalo, the toughest part of the skin, the same used for
shields, and the only part which would stand the wear and tear of
the hammers. In tfte meantime the marrow bones are split up and
boiled in water until all the grease and oil come to the top, when it is
skimmed off and poured over the pounded beef. As soon as the
mixture cools, it is sewed up into skin bags (not the ordinary painted
parfleche cases) and laid away until needed. It was sometimes
buried or otherwise cached. Pemmican thus prepared will keep
indefinitely. When prepared for immediate use, it is usually
sweetened with sugar, mesquite pods, or some wild fruit mixed and
beaten up with it in the pounding. It is extremely nourishing, and
has a very agreeable taste to one accustomed to it. On the march it
was to the prairie Indian what parched corn was to the hunter of the
timber tribes, and has been found so valuable as a condensed
nutriment that it is extensively used by arctic travelers and explorers.
A similar preparation is in use upon the pampas of South America
and in the desert region of South Africa, while the canned beef of
commerce is an adaptation from the Indian idea. The name comes
from the Cree language, and indicates something mixed with grease
or fat. {Lacombc.)
 1068 THK GHOST-DANCE RELIGION [eth.ann.u 8. Lk
he'yahb' Le he'yahe' — Ye'ye! Le he'yahe' — Ye'ye! Kaughi-ye oya'te-
ye cha-ya waon we lo, Kafighl-ye oya'te-ye cha-ya waou we lo.
JYanalation This one says — Ye'ye! This one says — Ye'ye! I belong
indeed to the nation of Crows, I belong indeed to the nation of
Crows. This song may better be rendered, " I am a Crow nation," i.
e., I represent the nation of Crows, the Crow nation probably
typifying the spirits of the dead in the other world, as explained in
Arapaho song 30. In several of the ghost songs there occur sucli
expressions as "I am a Crow," "the Crow woman is going home,"
etc. Compare Sioux song 18. 9. Niya'te-ye' hk'uw'e Niya'te-ye'
he'uw'e, niya'te-ye' he'uw'e, WaTibali gaiC'shka waTi-yau nihi'youwe,
Wa'abali gaie'shka wa'n-yau nihi'youwe. Translation It is your father
coming, it is your father coming, A spotted eagle is coming for you,
A spotted eagle is coming for you. This song probably refers to a
transformation trance vision, such as is frequently referred to in the
ghost songs, where the spirit friend suddenly assumes the form of a
bird, a moose, or some other animal. 10. Miyo'qaS kin waSla'ki
Miyo'qaii kin waula'ki^Ye'yeye'! Miyo'qaii kin waula'ki — Ye'yeye'!
Hena waTilake, Hena waTilake, Ha'eye'ya he'yeye', Ha'eye'ya
he'yeye'. Translation You see what I can do — Ye'yeye'! You see
what I can do — Ye'yeye'! You see tliem, you see them, Ha'eye'ya
he'yeye' ! Ha'eye'ya he'yeye'! In this song the Father is probably
represented as calling his children to witness that he has shown
them visions of the spirit world and their departed friends.
The text on this page is estimated to be only 29.08%
accurate

MouNEv] SONGS OF THE SIOUX 1069 ■ 11. MichI'nkshi

mita'wayb E'yaye'ye'! E'yayo'ye'! MicliI'iikHhi iiiita'waye, Mickl'iikshi
mita'waye. Traiielation E'yaye'ye'! E'yaye'ye'! It is my own child. It is
my own child. The form of the verb indicates that this song was
composed by a woman, who had evidently met her dead child in the
spirit world. 12, A'te he' u-wk A'te he' u-we, A'te he' u-we, A'te
eya'ya he' u-we' lo, A'te eya'ya he' n we' lo, Ya'nipi-kta' e'ya u'-we lo,
Ya'nipi-kta' e'ya n'-we lo. Translation There is the father coming,
There is the father coming. The father says this as he comes. The
father says this as he comes, " You shall live," he says as he comes,
" You shall live," he says as he comes. This is a reiteration of the
messiah's promise of eternal life in the new spirit world. 13. Wa'sna
wa'tiR-kta' Wa'sna -wa'tin-kta' — E'yeye'yeye' ! » Wa'sna wa'tin-kta
— E'yeye'yeye'! Le'chiya'-ya cya'pi lo — E'yeye'yeye'! Le'chiya'-ya
eya'pi-lo — E'yeye'yeye' ! E'ya he'-ye lo, E'ya he'-ye lo, A'te-ye he'ye
lo, A'te-ye he'ye lo. Tranalation I shall eat pemmican — E'yeye'yeye'!
I shall eat pemmican — E'yeye'yeye'! They say so, they say so, The
father says so, the father says so. For the explanation of this song
reference, see song number 7. 14. A'TE LENA MA'qU-WE Ate lena
ma'qu-we — Ye'ye'ye'! • Ate lena ma'qu-we — Yeye'ye'! Peta wan —
yafiyau ma'qu-we — Ye'ye'ye'! Peta wan — yanyau ma'qu-we —
Ye'ye'ye'! Ate ma'qu-we — Ye'ye'ye'! A'te ma'qu-we — Ye'ye'ye'!
 1070 THE GHOST-DANCE RELIGION [eth. ann.u TraiisJatioii
It was the father who gave us these things — Te'ye'ye'! It was the
father who gave us these things — Ye' ye' ye'! It was the father who
gave us tire — Te'ye'ye'! It was the father who gave us fire—
Te'ye'ye'! The father gave it to us — Te'ye'ye'! The father gave it to
us — Te'ye'ye'! This was frequently used as the opening song of the
Sioux Ghost dance. Fire is held in reverence among all Indian tribes
as one of the greatest gifts of the Author of Life, and every tribe has
a myth telling how it originated and how it was obtained by the
i>eople. In most of these myths the Are is represented as being at
first in the possession of some giant or malevolent monster, from
whom it is finally stolen by a hero, after a series of trials and
difficulties worthy of the heroes of the Golden Fleece. 15. Ina'
he'kuwo' Ina' he'liuwo'; ina' lie'kuwo'. Misu'nkala che'yaya oina'ni-ye,
Misu'nkala che'yaya oma'ni-ye. I'na he'kuwo'; i'na he'kuwo'.
Translalion Mother, come home ; mother, come home. My little
brother goes about always crying, My little brother goes about
always crying. Mother, come home ; mother, come home. This
touching song was a favorite among the Sioux. It was composed by
a young woman who saw her dead mother in the other world, and
on waking out of her trance vision implores the mother to come back
to them again, as her little brother is forever crying after her. 16.
Wa'na wanasa'pi-kta Wa'na wanasa'pi-kta, Wa'na wanasa'pi-kta.
Ufichi' ita'zipa michu'-ye, Uuchi' ita'zipa michu'-ye, A'te he'ye lo, a'te
he'ye lo. Translation ' Now they are about ttf chase the buft'alo, Now
they are about to chase the buft'alo. Grandmother, give me back my
bow, Grandmother, give me back my bow. The father says so, the
father says so. The author of this song, in his trance vision of the
spirit world, sees his old-time friends about to start on a buffalo
hunt, and calls to his grandmother to give him back his bow, so that
he may join them. The
Welcome to our website – a haven for those who love books
and value knowledge. We believe that reading opens endless
doors — to learn, to imagine, and to become better each day.
With that belief, we’ve created a vast and dynamic
collection of books, ranging from classic literature and
scholarly works to self-growth guides and charming
children’s tales.Our website is not only a marketplace, but
a bridge connecting readers to the lasting essence of
culture and wisdom. Designed with care, it offers a graceful
interface, smart navigation, and a seamless experience to
help you find what truly matters. Combined with our special
promotions and home delivery, reading becomes easier and
more enjoyable than ever.Join us on this journey of
learning, inspiration, and self-discovery — where every book
marks a new beginning.

https://textbookfull.com/