I found this to be a rather good encapsulation of what's happening although it is becoming a little dated......... <A HREF="http://www.giac.org/practical/GSEC/Chris_Hageman_GSEC.pdf" target="_new">http://www.giac.org/practical/GSEC/Chris_Hageman_GSEC.pdf</A>