color support

Thu Oct 25 17:52:56 EDT 2012

ArgusColorGeoLocation() would be very nice. The ability to quickly identify
flows where source|destination|both have addresses allocated to countries
that have strict limits on where their traffic may go or with whom I may not
communicate has more practical application than I would have thought three
days ago.

--Dave

From: argus-info-bounces+dedelman=iname.com at lists.andrew.cmu.edu
[mailto:argus-info-bounces+dedelman=iname.com at lists.andrew.cmu.edu] On
Behalf Of Carter Bullard
Sent: Thursday, October 25, 2012 12:32 PM
To: elof2 at sentor.se
Cc: Argus
Subject: Re: [ARGUS] color support

* PGP - S/MIME Signed by an unverified key: 10/25/2012 at 12:31:31 PM

Hey Elof,

More on the topic of color.

So I've got some of the framework for color configuration going, here is
what I'm doing in a racolor.conf file.

Need some suggestions / criticisms before I finalize an implementation.

Currently I have an array of 256 color methods to apply to each line before
we draw.

We run each method that is configured, then we draw the line.  Haven't
figured out, yet, what

a decent configuration method is for specifying what methods should be the
array.  I suspect

that once we have a bunch of methods, we'll configure a "list the method"
style of configuration.

Right now, I have two methods, ArgusColorAvailability(), and
ArgusColorAddresses()

that I'm using to test.  These are hardcoded as method 1, and 2 in the
array, respectively.

If you use " - A " on the command line, the availability testing kicks in
and we do a good

test on the argus record to determine if a flow has failed.  If so we'll
color it ORANGE (hard coded right now).

Next we do the ArgusColorAddresses() method, and its what I mentioned in
earlier email, also hard coded.

This is working very well.  Need more methods, and I need method specific
configurations, so still a lot of

work to do.

The next method will be the ArgusColorFlowField() routine that I described
below.  Here is the sample

configuration I've worked out:

# Ra client flow based color configuration support

#

# Carter Bullard

# QoSient, LLC

#

#   This configuration is a racolor(1) flow model configuration file.

#

#   The concept is to bind a traditional ra* filter with an

#   color map for fields in the argus record.  Records are tested

#   against the filter specifications in "fall down" order, when they match,

#   the color model is applied to output.

#

#   The use of the ' cont ' keyword will allow you to specify a

#   painters algorithm for coloring individual flow records, using

#   display programs like ratop().

#

#   Available colors

#

#   The color models available are extensible, but at a minimum,

#   assume you have 16 basic colors plus white and black, to choose

#   from.  These colors are referred as:

#           WHITE, BLACK, RED, GREEN, YELLOW, BLUE, MAGENTA, CYAN, ORANGE,
VIOLET,

#           BASE03, BASE02, BASE01, BASE00, BASE0, BASE1, BASE2, BASE3 

#

#   Traditional graphics color terms usch as BACKGROUND and FOREGROUND are
also

#   available. 

#   Available Attributes

#   

#   These tools also support assigning terminal attributes as well, these
include:

#

#    STANDOUT              Best highlighting mode of the terminal

#    UNDERLINE             Underlining

#    REVERSE               Reverse video

#    BLINK                 Blinking

#    DIM                   Half bright

#    BOLD                  Extra bright or bold

#

#   How these colors and attributes interact to generate display effects

#   is implementation specific, so you'll have to play to get exactly what

#   you want.

#

#   Because the color map is extensible, anything is really possible.

#   If the underlying display devices can handle more graphics support,

#   you should be able to pass Hexidecimal color values, using the #XXXXXX

#   format.

#

#   The color map assignement syntax is:

#      field specification

#         field[,field,...]=color[:attribute][;field specifciation[;....]]

#      

#   All printable fields can be used.  The Keyword 'all' is used to specify

#   the complete output line.

#

#      srcid=BLUE

#      saddr,daddr=BLUE;smac,dmac=CYAN

#      all=RED:BLINK

#

#   Here is a sample configuration file

#   

#

filter="src co CN'           saddr=RED             cont

label="ALERT"                all-RED

filter="load gt 1M"          sload,dload=VIOLET   

filter="load gt 10M"         sload,dload=RED      

Hopefully this gets the ideas going.

So if I put ArgusColorFlowField() as #3 in the array, it gets the colormap
from the other

two methods, and then paints based these rules.  With the " cont " keyword,
regardless

of a hit, we'll keep going down the list.

Can we use this?

Hope all is most excellent,

Carter

On Oct 23, 2012, at 6:27 AM, elof2 at sentor.se wrote:

On Tue, 23 Oct 2012, Carter Bullard wrote:

Hey Elof,
There are many reasons to color a record or a part of a record, and I'm
thinking of having a list of methods that result in a painters algorithm, to
generate the final result.
Somewhere in that list of color methods is address coloring.  So if you want
the whole record RED, because of some fault condition, but you want the
addresses colored because of locality, you would specify the fault method
first, the address method second.

Rules applied in order sounds very logical and sound.

In the implementation so far, we know what each column is, and the coloring
can be targeted at any field, group of fields or the whole record.  So if
you have a minimum byte count condition, as an example, you should have a
way of specifying that conditional against the field and then indicate what
fileds get what color.

Nice.

I'm working with our standard filters, like we use for aggregation, with a
field=color directive.  Does that sound useful ?

Yes, very!

/Elof

* Carter Bullard <carter at qosient.com>
* Issuer: "VeriSign - Unverified

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20121025/61ddd407/attachment.html>