color support

Thu Oct 25 22:46:33 EDT 2012

Hey Dave,
We populate most everything ? in netflowV5 into argus records.
Not sure what data elements are missing, except interfaces, but
I was under the assumption that that data historically was unreliable.

I will take about 30 minutes to generate a new DSR.

Carter

On Oct 25, 2012, at 9:33 PM, "Dave Edelman" <dedelman at iname.com> wrote:

> Thinking about ways that I would use the feature, I think that your sample of ISO two letter codes and an associated color makes good sense. I’m not sure if there isn’t a need to define a transparent color for those instances where you want to suppress the display regardless of the background.
>  
> I like the idea of aggregation but I think that there are cases where politics trumps geography. EMEA for Europe, Middle East, and Africa is commonly used, CEEMEA for Central and Eastern Europe, Middle East, and Africa has had its 15 minutes of fame. The only place that you are going to find Mexico in North America is in Wikipedia.
>  
> Is it easier to build the aggregation or to deaggregate the exceptions?
>  
> On a separate note, I do quite a bit of work with NetFlow V5 and there are data elements that are in the flow records that don’t really fit neatly in the DSRs that you populate. I’d like to try populating some of them in a Label DSR. Is this a very bad idea? The input and output  interface information and the next hop information is sometimes very useful.
>  
> --Dave
>  
> From: Carter Bullard [mailto:carter at qosient.com] 
> Sent: Thursday, October 25, 2012 6:11 PM
> To: Dave Edelman
> Cc: elof2 at sentor.se; 'Argus'
> Subject: Re: [ARGUS] color support
>  
> * PGP - S/MIME Signed by an unverified key: 10/25/2012 at 6:11:03 PM
> Hey Dave,
> Yes country code coloring is a good thing.
>  
> So how should we configure it ?   We use InterNIC files for country codes.
> But I don't recommend that we add color to those entries, and since most
> are getting country codes from GeoIP, we should add color as a separate
> configuration?
>  
> CN,TW,RU         RED
> US,EU,CA          BLUE
>  
> I have continent / country code listings now, so we can also support continent
> coloring, with specific country coloring as exceptions?
>  
> Carter
>  
>  
> On Oct 25, 2012, at 5:52 PM, "Dave Edelman" <dedelman at iname.com> wrote:
> 
> 
>  
> ArgusColorGeoLocation() would be very nice. The ability to quickly identify flows where source|destination|both have addresses allocated to countries that have strict limits on where their traffic may go or with whom I may not communicate has more practical application than I would have thought three days ago.
>  
> --Dave
>  
> From: argus-info-bounces+dedelman=iname.com at lists.andrew.cmu.edu [mailto:argus-info-bounces+dedelman=iname.com at lists.andrew.cmu.edu] On Behalf Of Carter Bullard
> Sent: Thursday, October 25, 2012 12:32 PM
> To: elof2 at sentor.se
> Cc: Argus
> Subject: Re: [ARGUS] color support
>  
> > Old - S/MIME Signed by an unverified key: 10/25/2012 at 12:31:31 PM
> Hey Elof,
> More on the topic of color.
> So I've got some of the framework for color configuration going, here is what I'm doing in a racolor.conf file.
> Need some suggestions / criticisms before I finalize an implementation.
>  
> Currently I have an array of 256 color methods to apply to each line before we draw.
> We run each method that is configured, then we draw the line.  Haven't figured out, yet, what
> a decent configuration method is for specifying what methods should be the array.  I suspect
> that once we have a bunch of methods, we'll configure a "list the method" style of configuration.
>  
> Right now, I have two methods, ArgusColorAvailability(), and ArgusColorAddresses()
> that I'm using to test.  These are hardcoded as method 1, and 2 in the array, respectively.
>  
> If you use " - A " on the command line, the availability testing kicks in and we do a good
> test on the argus record to determine if a flow has failed.  If so we'll color it ORANGE (hard coded right now).
>  
> Next we do the ArgusColorAddresses() method, and its what I mentioned in earlier email, also hard coded.
>  
> This is working very well.  Need more methods, and I need method specific configurations, so still a lot of
> work to do.
>  
> The next method will be the ArgusColorFlowField() routine that I described below.  Here is the sample
> configuration I've worked out:
>  
>  
> # Ra client flow based color configuration support
> #
> # Carter Bullard
> # QoSient, LLC
> #
> #   This configuration is a racolor(1) flow model configuration file.
> #
> #   The concept is to bind a traditional ra* filter with an
> #   color map for fields in the argus record.  Records are tested
> #   against the filter specifications in "fall down" order, when they match,
> #   the color model is applied to output.
> #
> #   The use of the ' cont ' keyword will allow you to specify a
> #   painters algorithm for coloring individual flow records, using
> #   display programs like ratop().
> #
> #   Available colors
> #
> #   The color models available are extensible, but at a minimum,
> #   assume you have 16 basic colors plus white and black, to choose
> #   from.  These colors are referred as:
> #           WHITE, BLACK, RED, GREEN, YELLOW, BLUE, MAGENTA, CYAN, ORANGE, VIOLET,
> #           BASE03, BASE02, BASE01, BASE00, BASE0, BASE1, BASE2, BASE3 
> #
> #   Traditional graphics color terms usch as BACKGROUND and FOREGROUND are also
> #   available. 
>  
> #   Available Attributes
> #   
> #   These tools also support assigning terminal attributes as well, these include:
> #
> #    STANDOUT              Best highlighting mode of the terminal
> #    UNDERLINE             Underlining
> #    REVERSE               Reverse video
> #    BLINK                 Blinking
> #    DIM                   Half bright
> #    BOLD                  Extra bright or bold
> #
> #   How these colors and attributes interact to generate display effects
> #   is implementation specific, so you'll have to play to get exactly what
> #   you want.
> #
> #   Because the color map is extensible, anything is really possible.
> #   If the underlying display devices can handle more graphics support,
> #   you should be able to pass Hexidecimal color values, using the #XXXXXX
> #   format.
> #
> #   The color map assignement syntax is:
> #      field specification
> #         field[,field,...]=color[:attribute][;field specifciation[;....]]
> #      
> #   All printable fields can be used.  The Keyword 'all' is used to specify
> #   the complete output line.
> #
> #      srcid=BLUE
> #      saddr,daddr=BLUE;smac,dmac=CYAN
> #      all=RED:BLINK
> #
> #   Here is a sample configuration file
> #   
> #
> filter="src co CN'           saddr=RED             cont
> label="ALERT"                all-RED
> filter="load gt 1M"          sload,dload=VIOLET   
> filter="load gt 10M"         sload,dload=RED      
>  
> Hopefully this gets the ideas going.
>  
> So if I put ArgusColorFlowField() as #3 in the array, it gets the colormap from the other
> two methods, and then paints based these rules.  With the " cont " keyword, regardless
> of a hit, we'll keep going down the list.
>  
> Can we use this?
> Hope all is most excellent,
>  
> Carter
>  
> On Oct 23, 2012, at 6:27 AM, elof2 at sentor.se wrote:
> 
> 
> 
> 
> On Tue, 23 Oct 2012, Carter Bullard wrote:
> 
> 
> Hey Elof,
> There are many reasons to color a record or a part of a record, and I'm thinking of having a list of methods that result in a painters algorithm, to generate the final result.
> Somewhere in that list of color methods is address coloring.  So if you want the whole record RED, because of some fault condition, but you want the addresses colored because of locality, you would specify the fault method first, the address method second.
> 
> Rules applied in order sounds very logical and sound.
> 
> 
> 
> In the implementation so far, we know what each column is, and the coloring can be targeted at any field, group of fields or the whole record.  So if you have a minimum byte count condition, as an example, you should have a way of specifying that conditional against the field and then indicate what fileds get what color.
> 
> Nice.
> 
> 
> 
> I'm working with our standard filters, like we use for aggregation, with a field=color directive.  Does that sound useful ?
> 
> Yes, very!
> 
> /Elof
> 
> 
> 
>  
> * Carter Bullard <carter at qosient.com>
> * Issuer: "VeriSign - Unverified
>  
>  
> * Carter Bullard <carter at qosient.com>
> * Issuer: "VeriSign - Unverified
>  

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20121025/a96fb11f/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4367 bytes
Desc: not available
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20121025/a96fb11f/attachment.bin>