com presentations: MongoDB Advocacy Day talk: slides/mongodb/bson-types.xml slides/mongodb/bson-why.xml slides/mongodb/bson.xml slides/mongodb/data.xml slides/mongodb/unrecognized-unwind-cat.png slides/mongodb/unrecognized-unwind.png slides/mongodb/wire-header.xml slides/mongodb/wire-op-msg.xml slides/mongodb/wire-op-query.xml slides/mongodb/wire-op-reply.xml slides/mongodb/wireshark-4.0.xml slides/mongodb/wireshark-4.2.xml slides/mongodb/wiresha

diff --git a/slides/mongodb/bson-types.xml b/slides/mongodb/bson-types.xml
new file mode 100644
index 0000000..5a35e3c
--- /dev/null
+++ b/slides/mongodb/bson-types.xml
@@ -0,0 +1,36 @@
+<slide>
+<title>BSON Specification</title>
+
+<example inline="2">
+*document* ::= int32 e_list "\x00"  size, elements and trailing \0
+
+*e_list*   ::= *element* e_list     
+           |     ""     
+
+*element*  ::= "\x01" e_name double           64-bit binary floating point
+           | "\x02" e_name string           UTF-8 string
+           | "\x03" e_name *document*         Embedded document
+           | "\x04" e_name *document*         Array
+           | "\x05" e_name binary           Binary data
+           | "\x07" e_name (byte*12)        ObjectId
+           | "\x08" e_name "\x00"           Boolean "false"
+           | "\x08" e_name "\x01"           Boolean "true"
+           | "\x09" e_name int64            UTC datetime
+           | "\x0A" e_name                  Null value
+           | "\x0B" e_name cstring cstring  Regular expression: pattern, options
+           | "\x0D" e_name string           JavaScript code
+           | "\x0F" e_name code_w_s         JavaScript code w/ scope
+           | "\x10" e_name int32            32-bit integer
+           | "\x11" e_name uint64           Timestamp
+           | "\x12" e_name int64            64-bit integer
+           | "\x13" e_name decimal128       128-bit decimal floating point
+           | "\xFF" e_name                  Min key
+           | "\x7F" e_name                  Max key
+
+*e_name*   ::= cstring                  Key name
+*string*   ::= int32 (byte\*) "\x00"     String
+*cstring*  ::= (byte\*) "\x00"           UTF-8 encoded characters followed by '\x00'.
+binary   ::= int32 subtype (byte\*)    Binary - size, subtype(byte), and data.
+code_w_s ::= int32 string *document*    Code w/ scope
+</example>
+</slide>
diff --git a/slides/mongodb/bson-why.xml b/slides/mongodb/bson-why.xml
new file mode 100644
index 0000000..1dad7cd
--- /dev/null
+++ b/slides/mongodb/bson-why.xml
@@ -0,0 +1,16 @@
+<slide>
+<title>Why BSON?</title>
+
+<list>
+	<bullet>"JSON"'s range of data types is restricted</bullet>
+	<bullet>BSON is optimised for parsing</bullet>
+	<bullet>Or as the marketing spiel on the web site says:
+		<list>
+			<bullet>*Lightweight*: Keeping spatial overhead to a minimum is important for any data representation format, especially when used over the network.</bullet>
+			<bullet>*Traversable*: BSON is designed to be traversed easily. This is a vital property in its role as the primary data representation for MongoDB.</bullet>
+			<bullet>*Efficient*: Encoding data to BSON and decoding from BSON can be performed very quickly in most languages due to the use of C data types.</bullet>
+		</list>
+	</bullet>
+</list>
+</slide>
+
diff --git a/slides/mongodb/bson.xml b/slides/mongodb/bson.xml
new file mode 100644
index 0000000..be3482f
--- /dev/null
+++ b/slides/mongodb/bson.xml
@@ -0,0 +1,7 @@
+<slide>
+<break lines="2"/>
+<blurb class="big-centre">*BSON*</blurb>>
+<blurb class="big-centre">~[bee · sahn]~</blurb>
+<break lines="3"/>
+<blurb class="centre">short for Binary JSON</blurb>
+</slide>
diff --git a/slides/mongodb/data.xml b/slides/mongodb/data.xml
new file mode 100644
index 0000000..cae1000
--- /dev/null
+++ b/slides/mongodb/data.xml
@@ -0,0 +1,11 @@
+<slide>
+<title>Wire Protocol</title>
+
+<list>
+	<bullet>MongoDB's binary protocol</bullet>
+	<bullet>Header + Payload:<list>
+		<bullet>Header is binary structure</bullet>
+		<bullet>Payload is BSON</bullet>
+	</list></bullet>
+</list>
+</slide>
diff --git a/slides/mongodb/unrecognized-unwind-cat.png b/slides/mongodb/unrecognized-unwind-cat.png
new file mode 100644
index 0000000..856a71e
Binary files /dev/null and b/slides/mongodb/unrecognized-unwind-cat.png differ
diff --git a/slides/mongodb/unrecognized-unwind.png b/slides/mongodb/unrecognized-unwind.png
new file mode 100644
index 0000000..ab97a0b
Binary files /dev/null and b/slides/mongodb/unrecognized-unwind.png differ
diff --git a/slides/mongodb/wire-header.xml b/slides/mongodb/wire-header.xml
new file mode 100644
index 0000000..368bc9b
--- /dev/null
+++ b/slides/mongodb/wire-header.xml
@@ -0,0 +1,48 @@
+<slide>
+<title>Header</title>
+
+<blurb>Common Preamble:</blurb>
+<example inline="2"><![CDATA[struct MsgHeader {
+    int32   *messageLength*; // total message size, including this
+    int32   requestID;     // identifier for this message
+    int32   responseTo;    // requestID from the original request
+    int32   *opCode*;        // request type - see table below for details
+}]]>?</example>
+
+<blurb>The following ~Opcodes~ have been defined:</blurb>
+<div effect="fade-out">
+<example inline="2">~Opcode Name     Value     Comment~
+
+OP_REPLY            1     Reply to a client request. responseTo is set.
+OP_UPDATE        2001     Update document.
+OP_INSERT        2002     Insert new document.
+RESERVED         2003     Formerly used for OP_GET_BY_OID.
+OP_QUERY         2004     Query a collection.
+OP_GET_MORE      2005     Get more data from a query. See Cursors.
+OP_DELETE        2006     Delete documents.
+OP_KILL_CURSORS  2007     Notify database that the client has finished with the cursor.
+OP_COMMAND       2010     Cluster internal protocol representing a command request.
+OP_COMMANDREPLY  2011     Cluster internal protocol representing a reply to an OP_COMMAND.
+OP_MSG           2013     Send a message using the format introduced in MongoDB 3.6.
+</example>
+</div>
+
+<div effect="fade-in">
+<example inline="2">~Opcode Name     Value     Comment~
+
+*OP_REPLY            1     Reply to a client request. responseTo is set.*
+|999999|OP_UPDATE        2001     Update document.|
+|999999|OP_INSERT        2002     Insert new document.|
+|999999|RESERVED         2003     Formerly used for OP_GET_BY_OID.|
+*OP_QUERY         2004     Query a collection.*
+|999999|OP_GET_MORE      2005     Get more data from a query. See Cursors.|
+|999999|OP_DELETE        2006     Delete documents.|
+|999999|OP_KILL_CURSORS  2007     Notify database that the client has finished with the cursor.|
+|999999|OP_COMMAND       2010     Cluster internal protocol representing a command request.|
+|999999|OP_COMMANDREPLY  2011     Cluster internal protocol representing a reply to an OP_COMMAND.|
+*OP_MSG           2013     Send a message using the format introduced in MongoDB 3.6.*
+</example>
+<blurb>Only a few are used in MongoDB 4.0</blurb>
+</div>
+
+</slide>
diff --git a/slides/mongodb/wire-op-msg.xml b/slides/mongodb/wire-op-msg.xml
new file mode 100644
index 0000000..9e96944
--- /dev/null
+++ b/slides/mongodb/wire-op-msg.xml
@@ -0,0 +1,34 @@
+<slide>
+<title>OP_MSG</title>
+
+<example inline="2">
+struct OP_MSG {
+    MsgHeader header;          // standard message header
+    uint32 flagBits;           // message flags
+    Sections[] sections;       // data sections
+    optional&amp;lt;uint32> checksum; // optional CRC-32C checksum
+}</example>
+
+<break/>
+
+<blurb>Flags</blurb>
+<example>
+Bit  Name              Description
+ 0   checksumPresent   The message ends with 4 bytes containing a CRC-32C.
+ 1   moreToCome
+16   exhaustAllowed
+</example>
+
+<break/>
+
+<blurb>Sections</blurb>
+<blurb class="small">
+Kind byte indicating its type, followed by:
+
+<list>
+	<bullet>Kind 0: Body — single BSON doc</bullet>
+	<bullet>Kind 1: Document Sequence</bullet>
+</list>
+</blurb>
+
+</slide>
diff --git a/slides/mongodb/wire-op-query.xml b/slides/mongodb/wire-op-query.xml
new file mode 100644
index 0000000..2a1e00a
--- /dev/null
+++ b/slides/mongodb/wire-op-query.xml
@@ -0,0 +1,15 @@
+<slide>
+<title>OP_QUERY</title>
+
+<example inline="2">
+struct OP_QUERY {
+    MsgHeader header;                 // standard message header
+    int32     flags;                  // bit vector of query options
+    cstring   fullCollectionName ;    // "dbname.collectionname"
+    int32     numberToSkip;           // number of documents to skip
+    int32     numberToReturn;         // number of documents to return in the first batch
+    document  query;                  // query object.
+  [ document  returnFieldsSelector; ] // Selector indicating the fields to return
+}
+</example>
+</slide>
diff --git a/slides/mongodb/wire-op-reply.xml b/slides/mongodb/wire-op-reply.xml
new file mode 100644
index 0000000..aef8bb2
--- /dev/null
+++ b/slides/mongodb/wire-op-reply.xml
@@ -0,0 +1,23 @@
+<slide>
+<title>OP_REPLY</title>
+
+<example inline="2">struct OP_REPLY {
+    MsgHeader header;         // standard message header
+    int32     responseFlags;  // bit vector - see details below
+    int64     cursorID;       // cursor id if client needs to do get more's
+    int32     startingFrom;   // where in the cursor this reply is starting
+    int32     numberReturned; // number of documents in the reply
+    document* documents;      // documents
+}</example>
+
+<blurb>Response Flags:</blurb>
+
+<list>
+	<bullet>%0%: *CursorNotFound*: getMore: ~Cursor ID~ not valid</bullet>
+	<bullet>%1%: *QueryFailure*: Is set when query failed.</bullet>
+	<bullet>%2%: *ShardConfigStale*: mongos only: is set, it needs to update config from the server.</bullet>
+	<bullet>%3%: *AwaitCapable*: Always set.</bullet>
+	<bullet>%4-31%: *Reserved*</bullet>
+</list>
+
+</slide>
diff --git a/slides/mongodb/wireshark-4.0.xml b/slides/mongodb/wireshark-4.0.xml
new file mode 100644
index 0000000..1d42fe4
--- /dev/null
+++ b/slides/mongodb/wireshark-4.0.xml
@@ -0,0 +1,16 @@
+<slide background="wireshark-light.jpg">
+<title>MongoDB 4.0 and Wireshark</title>
+
+<div effect="fade-in">
+	<blurb class="big-centre">Always SSL?</blurb>
+	<blurb class="centre">When working on the dissectors last, I inadvertently made port %27017% always expect SSL. ~Oops!~</blurb>
+</div>
+
+<break/>
+
+<div effect="fade-in">
+	<blurb class="big-centre">TLS 1.3</blurb>
+	<blurb class="centre">Changes pre-master key exchange.</blurb>
+	<blurb class="centre">Has a new API for intercepting keys.</blurb>
+</div>
+</slide>
diff --git a/slides/mongodb/wireshark-4.2.xml b/slides/mongodb/wireshark-4.2.xml
new file mode 100644
index 0000000..8daf6df
--- /dev/null
+++ b/slides/mongodb/wireshark-4.2.xml
@@ -0,0 +1,16 @@
+<slide background="wireshark-light.jpg">
+<title>MongoDB 4.2 and Wireshark?</title>
+
+<break lines="2"/>
+<list>
+	<bullet>*OP_MSG*: Multiple sections</bullet>
+	<bullet>*OP_MSG*: Checksum</bullet>
+</list>
+
+<div effect="fade-in">
+<blurb class="big-centre">No Wireshark support</blurb>
+</div>
+<div effect="fade-in">
+<blurb class="big-centre">yet…</blurb>
+</div>
+</slide>
diff --git a/slides/mongodb/wireshark-is-master-reply.png b/slides/mongodb/wireshark-is-master-reply.png
index f753314..aecf469 100644
Binary files a/slides/mongodb/wireshark-is-master-reply.png and b/slides/mongodb/wireshark-is-master-reply.png differ
diff --git a/slides/mongodb/wireshark-is-master.png b/slides/mongodb/wireshark-is-master.png
index 4f3ed95..e959b1b 100644
Binary files a/slides/mongodb/wireshark-is-master.png and b/slides/mongodb/wireshark-is-master.png differ
diff --git a/slides/mongodb/wireshark-query-reply-compressed1.png b/slides/mongodb/wireshark-query-reply-compressed1.png
index 52016b3..7ec9731 100644
Binary files a/slides/mongodb/wireshark-query-reply-compressed1.png and b/slides/mongodb/wireshark-query-reply-compressed1.png differ
diff --git a/slides/mongodb/wireshark-query-reply-compressed2.png b/slides/mongodb/wireshark-query-reply-compressed2.png
index 3fdedf5..fed650f 100644
Binary files a/slides/mongodb/wireshark-query-reply-compressed2.png and b/slides/mongodb/wireshark-query-reply-compressed2.png differ
diff --git a/slides/mongodb/wireshark-query-reply.png b/slides/mongodb/wireshark-query-reply.png
index 0d5ff2d..230c84a 100644
Binary files a/slides/mongodb/wireshark-query-reply.png and b/slides/mongodb/wireshark-query-reply.png differ
diff --git a/slides/mongodb/wireshark-query.png b/slides/mongodb/wireshark-query.png
index b20a3ea..5716f77 100644
Binary files a/slides/mongodb/wireshark-query.png and b/slides/mongodb/wireshark-query.png differ
diff --git a/slides/mongodb/wireshark-ssl-MONGO.png b/slides/mongodb/wireshark-ssl-MONGO.png
index 3f41857..d16020b 100644
Binary files a/slides/mongodb/wireshark-ssl-MONGO.png and b/slides/mongodb/wireshark-ssl-MONGO.png differ
diff --git a/slides/mongodb/wireshark-ssl-OP_COMPRESSED.png b/slides/mongodb/wireshark-ssl-OP_COMPRESSED.png
index fa7a4a7..a98cb61 100644
Binary files a/slides/mongodb/wireshark-ssl-OP_COMPRESSED.png and b/slides/mongodb/wireshark-ssl-OP_COMPRESSED.png differ
diff --git a/slides/mongodb/wireshark-ssl-SSL.png b/slides/mongodb/wireshark-ssl-SSL.png
index 7346837..66948db 100644
Binary files a/slides/mongodb/wireshark-ssl-SSL.png and b/slides/mongodb/wireshark-ssl-SSL.png differ
diff --git a/slides/mongodb/wireshark-ssl-wireshark-config.xml b/slides/mongodb/wireshark-ssl-wireshark-config.xml
index 5cb5007..0af30b2 100644
--- a/slides/mongodb/wireshark-ssl-wireshark-config.xml
+++ b/slides/mongodb/wireshark-ssl-wireshark-config.xml
@@ -4,7 +4,6 @@
 <image filename="wireshark-preferences.png"/>
 
 <div effect="fade-in">
-<break/>
 <blurb>%/tmp/ssl-debug.txt%</blurb>
 
 <example>
diff --git a/slides/mongodb/wireshark-start.png b/slides/mongodb/wireshark-start.png
index e53948b..7044353 100644
Binary files a/slides/mongodb/wireshark-start.png and b/slides/mongodb/wireshark-start.png differ
diff --git a/slides/mongodb/wireshark-unwind-bug.xml b/slides/mongodb/wireshark-unwind-bug.xml
new file mode 100644
index 0000000..5ea27f2
--- /dev/null
+++ b/slides/mongodb/wireshark-unwind-bug.xml
@@ -0,0 +1,12 @@
+<slide>
+<title>Debugging with Wireshark</title>
+
+<div effect="fade-out">
+<image filename="unrecognized-unwind.png"/>
+</div>
+
+<div effect="fade-in">
+<image filename="unrecognized-unwind-cat.png"/>
+</div>
+
+</slide>
diff --git a/wire-mongo18.xml b/wire-mongo18.xml
new file mode 100644
index 0000000..f5d6d98
--- /dev/null
+++ b/wire-mongo18.xml
@@ -0,0 +1,52 @@
+<?xml version="1.0" encoding="utf-8"?>
+<presentation css="10gen-strict.css">
+<topic>MongoDB</topic>
+<title>Sharks on the Wire</title>
+<event>Developer Advocacy Day</event>
+<location>Online</location>
+<date>January 18th, 2018</date>
+<speaker>Derick Rethans</speaker>
+<email>[email protected]</email>
+<twitter>derickr</twitter>
+<url>https://derickrethans.nl/talks.html</url>
+<joindin>https://derickrethans.nl/talks/wireshark-mongo</joindin>
+<slide>slides/mongodb/title.xml</slide>
+
+<slide>slides/mongodb/data.xml</slide>
+
+<slide>slides/mongodb/wire-header.xml</slide>
+<slide>slides/mongodb/wire-op-query.xml</slide>
+<slide>slides/mongodb/wire-op-reply.xml</slide>
+<slide>slides/mongodb/wire-op-msg.xml</slide>
+
+<slide>slides/mongodb/bson.xml</slide>
+<slide>slides/mongodb/bson-why.xml</slide>
+<slide>slides/mongodb/bson-types.xml</slide>
+
+<slide>slides/mongodb/wireshark-title.xml</slide>
+<slide>slides/mongodb/wireshark-what.xml</slide>
+
+<slide>slides/mongodb/wireshark-example-start.xml</slide>
+<slide>slides/mongodb/wireshark-example-is-master.xml</slide>
+
+<slide>slides/mongodb/wireshark-3.6.xml</slide>
+
+<slide>slides/mongodb/wireshark-dissectors.xml</slide>
+<slide>slides/mongodb/wireshark-example-op-msg.xml</slide>
+
+<slide>slides/mongodb/wireshark-dissectors-op-compressed.xml</slide>
+<slide>slides/mongodb/wireshark-example-op-compressed.xml</slide>
+
+<slide>slides/mongodb/wireshark-unwind-bug.xml</slide>
+
+<slide>slides/mongodb/wireshark-ssl-keys.xml</slide>
+<slide>slides/mongodb/wireshark-ssl-wireshark-config.xml</slide>
+<slide>slides/mongodb/wireshark-example-ssl.xml</slide>
+
+<slide>slides/mongodb/wireshark-4.0.xml</slide>
+<slide>slides/mongodb/wireshark-4.2.xml</slide>
+
+<slide>slides/mongodb/questions.xml</slide>
+<slide>slides/mongodb/resources.xml</slide>
+
+</presentation>