Re: MaxMind GeoIP support in 3.0.8.2
"David Edelman" <[email protected]> Sun, 30 Sep 2018 10:42:27 -0400
| Newsgroups | gmane.network.argus |
|---|---|
| Message-ID | <[email protected]> |
This is a multipart message in MIME format. ------=_NextPart_000_0001_01D458AA.49138E50 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable -----BEGIN PGP SIGNED MESSAGE-----=20 Hash: SHA1=20 Use the ra command line flag -M = label=3D=E2=80=99scity=3DFL.*dcity=3DFL=E2=80=99 I seem to remember = that regular expressions work for this filter. Use the single quote to = escape the *=20 =20 If the regular expression doesn=E2=80=99t work let me know. You = can=E2=80=99t use ragrep since that looks at theuser data portion of = the flow, not the label metadata. =20 - --Dave=20 =20 From: Kevin Branch <[email protected]>=20 Sent: Saturday, September 29, 2018 11:14 PM=20 To: David Edelman <[email protected]>=20 Cc: Carter Bullard <[email protected]>; Argus = <[email protected]>=20 Subject: Re: [ARGUS] MaxMind GeoIP support in 3.0.8.2=20 =20 David, thanks! That was the missing piece.=20 =20 I switched to=20 =20 RALABEL_GEOIP_CITY=3D"saddr,daddr:region,cco"=20 =20 and I saw what I wanted:=20 =20 # ra -r /argus/today/unt-01.arg -N1 -w - | ralabel -f /etc/ralabel.conf = -r - -s label:30 -N20=20 Label=20 scity=3DFL,US:dcity=3DMO,US=20 =20 All along I have been trying to label source and destination IPs with = state,country like above. It took a fair bit of experimenting to get = the state part figured out due to that field being referred to as "reg" = in the ralabel.conf comment documentation while actually it has to be = referenced as "region" to work. =20 Now for my hopefully last question: How can I have ra use that label = content as search criteria? I am trying to use ra to count up total = traffic volume seen where the source and destination IP are both in = Florida. I suspect ra will not let me use label, scity or dcity values = as filter criteria. Can ragrep help here? Or will I have to go the = rasqlinsert route to accomplish this? =20 Thanks,=20 Kevin=20 =20 =20 On Sat, Sep 29, 2018 at 3:47 PM David Edelman <[email protected] = <mailto:[email protected]> > wrote:=20 -----BEGIN PGP SIGNED MESSAGE-----=20 Hash: SHA1=20 It looks like we are almost there, you need to indicate which = addresses need to have the labels associated=20 Please change this in your configuration file=20 =20 =20 RALABEL_GEOIP_CITY=3D"saddr,daddr:city "=20 =20 This information might help Looking at the code, the netmask is = not functional=20 =20 #=20 # Data for city relevant data is enabled through enabling and = configuring=20 # the city database support. The types of data available = are:=20 # country_code, country_code3, country_name, region, city, = postal_code,=20 # latitude, longitude, metro_code, area_code and = continent_code.=20 # time_offset is also available.=20 #=20 # The concept is that you should be able to add semantics for = any=20 # IP address that is in the argus record. Support addresses = are:=20 #=20 # saddr, daddr, inode=20 #=20 # The labels provided will be tagged as:=20 # scity, dcity, icity=20 #=20 # To configure what you want to have placed in the label, use = the list of=20 # objects, in whatever order you like, as the = RALABEL_GEOPIP_CITY string=20 # using these keywords:=20 # cco - country_code=20 # cco3 - country_code3=20 # cname - country_name=20 # reg - region=20 # city - city=20 # pcode - postal_code=20 # lat - latitude=20 # long - longitude=20 # metro - metro_code=20 # area - area_code=20 # cont - continent_code=20 # netmask - netmask value=20 #=20 # Working examples could be:=20 # RALABEL_GEOIP_CITY=3D"saddr,daddr:lat/lon"=20 # RALABEL_GEOIP_CITY=3D"*:city,region,cname,lat,lon"=20 #=20 #RALABEL_GEOIP_CITY=3D"saddr,daddr,inode:off,cont,lat,lon"=20 #RALABEL_GEOIP_CITY_FILE=3D"/usr/local/share/GeoIP/GeoIP.dat"=20 =20 =20 =20 - --Dave=20 =20 =20 =20 From: Kevin Branch <[email protected] = <mailto:[email protected]> >=20 Sent: Saturday, September 29, 2018 11:57 AM=20 To: Carter Bullard <[email protected] = <mailto:[email protected]> >=20 Cc: David Edelman <[email protected] = <mailto:[email protected]> >; Argus <[email protected] = <mailto:[email protected]> >=20 Subject: Re: [ARGUS] MaxMind GeoIP support in 3.0.8.2=20 =20 Hi Carter and David,=20 =20 I just tried the following with the same ralabel.conf as before: = ra -r /argus/today/unt-01.arg -w - | ralabel -f = /etc/ralabel.conf -r - -s label:200 -N20=20 and saw this. Looks like I was using the wrong syntax which I = am glad to know better now, but the GeoIP lookups are still not = happening: "scity=3D:dcity=3D"=20 "scity=3D:dcity=3D"=20 "scity=3D:dcity=3D"=20 "scity=3D:dcity=3D"=20 "scity=3D:dcity=3D"=20 "scity=3D:dcity=3D"=20 "scity=3D:dcity=3D"=20 "scity=3D:dcity=3D"=20 "scity=3D:dcity=3D"=20 "scity=3D:dcity=3D"=20 "scity=3D:dcity=3D"=20 "scity=3D:dcity=3D"=20 =20 I know the data file is good because it works with this:=20 # geoiplookup -f /usr/local/share/GeoIP/GeoIPCity.dat = 207.48.48.19=20 GeoIP City Edition, Rev 1: US, MO, Missouri, = Chesterfield, 63017, 38.650002, -90.533401, 609, 314=20 =20 In case it helps, I rebuilt argus-clients with the .debug flag = file present and then ran this command limited to only a single argus = record that I independently confirmed has a srcip value known to = geoiplookup # ra -r /argus/today/unt-01.arg -N1 -w - | ralabel -f = /etc/ralabel.conf -r - -s label:50 -N200 -D3=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.950161 = ArgusNewLabeler (0x7f8eff3f7010, 0) returning 0x1b057c0=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.959656 = RaLabelParseResourceFile (/etc/ralabel.conf) returning 0=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.959730 = ArgusReadConnection() read 16 bytes=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.959748 = ArgusReadConnection() read 112 bytes=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.961133 = ArgusInitAddrtoname (0x7f8eff3f7010, 0xa9fe6700, 0xffffff00)=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.961145 = ArgusParseInit(0x7f8eff3f7010 0x7f8eff386010=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.961155 = ArgusReadConnection(0xff386010, 1) returning 1=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.961329 = ArgusAddToRecordLabel (0x7f8eff3f7010, 0x1b188c0, scity=3D:dcity=3D) = returning 0 Label=20 scity=3D:dcity=3D=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.961385 = ArgusCloseInput(0xff386010) closing=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.961408 = ArgusCloseInput(0xff386010) done=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.961415 main: = ArgusReadFileStream (-) done=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.961426 main: = reading files completed=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.961432 = ArgusShutDown (0)=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.961439 = RaParseComplete (0) returning=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.961444 = RaParseComplete(caught signal 0)=20 [email protected]:~/argus-clients-3.0.8# = <mailto:[email protected]:~/argus-clients-3.0.8#> = <mailto:[email protected]:~/argus-clients-3.0.8#> ra -r = /argus/today/unt-01.arg -N1 -w - | ralabel -f /etc/ralabel.conf -r - -s = label:50 -N200 -D8 ralabel[4462.40472429a37f0000]: 15:53:24.374433 = ArgusFree (0x26b2250)=20 ralabel[4462.40472429a37f0000]: 15:53:24.374461 = ArgusFree (0x26b22b0)=20 ralabel[4462.40472429a37f0000]: 15:53:24.374469 = ArgusFree (0x26b2310)=20 ralabel[4462.40472429a37f0000]: 15:53:24.374474 = ArgusFree (0x26b2370)=20 ralabel[4462.40472429a37f0000]: 15:53:24.374479 = ArgusFree (0x26b23d0)=20 ralabel[4462.40472429a37f0000]: 15:53:24.374484 = ArgusFree (0x26b2430)=20 ralabel[4462.40472429a37f0000]: 15:53:24.374489 = ArgusFree (0x26b2490)=20 ralabel[4462.40472429a37f0000]: 15:53:24.374494 = ArgusFree (0x26b24f0)=20 ralabel[4462.40472429a37f0000]: 15:53:24.374499 = ArgusFree (0x26b2550)=20 ralabel[4462.40472429a37f0000]: 15:53:24.374504 = ArgusFree (0x26b25b0)=20 ralabel[4462.40472429a37f0000]: 15:53:24.374509 = ArgusFree (0x26b2610)=20 ralabel[4462.40472429a37f0000]: 15:53:24.374533 = ArgusCalloc (1, 80) returning 0x26b2610=20 ralabel[4462.40472429a37f0000]: 15:53:24.374544 = ArgusCalloc (1, 296) returning 0x26b27c0=20 ralabel[4462.40472429a37f0000]: 15:53:24.374566 = ArgusCalloc (1, 112) returning 0x26b2950=20 ralabel[4462.40472429a37f0000]: 15:53:24.374577 = ArgusCalloc (1, 80) returning 0x26b25b0=20 ralabel[4462.40472429a37f0000]: 15:53:24.374595 = ArgusNewQueue () returning 0x26b25b0=20 ralabel[4462.40472429a37f0000]: 15:53:24.374613 = ArgusCalloc (65536, 8) returning 0x2849a010=20 ralabel[4462.40472429a37f0000]: 15:53:24.374619 = ArgusNewLabeler (0x7fa329100010, 0) returning 0x26b27c0=20 ralabel[4462.40472429a37f0000]: 15:53:24.384352 = RaLabelParseResourceFile (/etc/ralabel.conf) returning 0=20 ralabel[4462.40472429a37f0000]: 15:53:24.384387 = ArgusCalloc (1, 560) returning 0x26b2250=20 ralabel[4462.40472429a37f0000]: 15:53:24.384411 = ArgusCalloc (1, 112) returning 0x26b2e80=20 ralabel[4462.40472429a37f0000]: 15:53:24.384418 = ArgusCalloc (1, 80) returning 0x26b2f00=20 ralabel[4462.40472429a37f0000]: 15:53:24.384424 = ArgusNewQueue () returning 0x26b2f00=20 ralabel[4462.40472429a37f0000]: 15:53:24.384430 = ArgusCalloc (1, 56) returning 0x26b2f60=20 ralabel[4462.40472429a37f0000]: 15:53:24.384454 = ArgusCalloc (65536, 8) returning 0x27358010=20 ralabel[4462.40472429a37f0000]: 15:53:24.384461 = ArgusNewHashTable (65536) returning 0x26b2f60=20 ralabel[4462.40472429a37f0000]: 15:53:24.384483 = ArgusReadConnection() read 16 bytes=20 ralabel[4462.40472429a37f0000]: 15:53:24.384498 = ArgusReadConnection() read 112 bytes=20 ralabel[4462.40472429a37f0000]: 15:53:24.384514 = ArgusCalloc (1, 4194304) returning 0x26f57010=20 ralabel[4462.40472429a37f0000]: 15:53:24.384523 = ArgusCalloc (1, 262144) returning 0x26f16010=20 ralabel[4462.40472429a37f0000]: 15:53:24.385934 = ArgusInitAddrtoname (0x7fa329100010, 0xa9fe6700, 0xffffff00)=20 ralabel[4462.40472429a37f0000]: 15:53:24.385947 = ArgusParseInit(0x7fa329100010 0x7fa32908f010=20 ralabel[4462.40472429a37f0000]: 15:53:24.385956 = ArgusReadConnection(0x2908f010, 1) returning 1=20 ralabel[4462.40472429a37f0000]: 15:53:24.385969 = ArgusReadFileStream() starting=20 ralabel[4462.40472429a37f0000]: 15:53:24.385981 = ArgusReadStreamSocket (0x7fa32908f010) read 380 bytes=20 ralabel[4462.40472429a37f0000]: 15:53:24.386015 = ArgusCalloc (1, 384) returning 0x26c58c0=20 ralabel[4462.40472429a37f0000]: 15:53:24.386025 = ArgusCalloc (1, 12) returning 0x26c5a50=20 ralabel[4462.40472429a37f0000]: 15:53:24.386031 = ArgusCalloc (1, 80) returning 0x26c5a70=20 ralabel[4462.40472429a37f0000]: 15:53:24.386037 = ArgusCalloc (1, 36) returning 0x26c5ad0=20 ralabel[4462.40472429a37f0000]: 15:53:24.386042 = ArgusCalloc (1, 52) returning 0x26c5b00=20 ralabel[4462.40472429a37f0000]: 15:53:24.386047 = ArgusCalloc (1, 80) returning 0x26c5b40=20 ralabel[4462.40472429a37f0000]: 15:53:24.386053 = ArgusCalloc (1, 120) returning 0x26c5ba0=20 ralabel[4462.40472429a37f0000]: 15:53:24.386058 = ArgusCalloc (1, 8) returning 0x26c5c20=20 ralabel[4462.40472429a37f0000]: 15:53:24.386063 = ArgusCalloc (1, 164) returning 0x26c5c40=20 ralabel[4462.40472429a37f0000]: 15:53:24.386070 = ArgusCalloc (1, 20) returning 0x26c5cf0=20 ralabel[4462.40472429a37f0000]: 15:53:24.386075 = ArgusCalloc (1, 20) returning 0x26c5d10=20 ralabel[4462.40472429a37f0000]: 15:53:24.386080 = ArgusCalloc (1, 12) returning 0x26c5d30=20 ralabel[4462.40472429a37f0000]: 15:53:24.386092 = ArgusCalloc (1, 16) returning 0x26c5d50=20 ralabel[4462.40472429a37f0000]: 15:53:24.386131 = ArgusCalloc (1, 12) returning 0x26c5e80=20 ralabel[4462.40472429a37f0000]: 15:53:24.386234 = ArgusAddToRecordLabel (0x7fa329100010, 0x26c58c0, scity=3D:dcity=3D) = returning 0 Label=20 scity=3D:dcity=3D=20 ralabel[4462.40472429a37f0000]: 15:53:24.386280 = ArgusFree (0x26c5a50)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386287 = ArgusFree (0x26c5a70)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386292 = ArgusFree (0x26c5ad0)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386297 = ArgusFree (0x26c5b00)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386301 = ArgusFree (0x26c5b40)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386304 = ArgusFree (0x26c5ba0)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386308 = ArgusFree (0x26c5c20)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386312 = ArgusFree (0x26c5c40)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386316 = ArgusFree (0x26c5cf0)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386322 = ArgusFree (0x26c5d10)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386359 = ArgusFree (0x26c5d30)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386369 = ArgusFree (0x26c5e80)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386377 = ArgusFree (0x26c5d50)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386384 = ArgusFree (0x26c58c0)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386392 = RaProcessRecord (0x2908f630) returning=20 ralabel[4462.40472429a37f0000]: 15:53:24.386400 = RaScheduleRecord (0x7fa329100010, 0x7fa32908f630) scheduled=20 ralabel[4462.40472429a37f0000]: 15:53:24.386408 = ArgusHandleRecord (0x7fa326f57010, 0x7fa329221800) returning 380 ralabel[4462.40472429a37f0000]: 15:53:24.386417 = ArgusReadStreamSocket (0x7fa32908f010) returning 0=20 ralabel[4462.40472429a37f0000]: 15:53:24.386432 = ArgusReadStreamSocket (0x7fa32908f010) read 0 bytes=20 ralabel[4462.40472429a37f0000]: 15:53:24.386439 = ArgusReadStreamSocket (0x7fa32908f010) returning 1=20 ralabel[4462.40472429a37f0000]: 15:53:24.386447 = ArgusCloseInput(0x2908f010) closing=20 ralabel[4462.40472429a37f0000]: 15:53:24.386463 = ArgusFree (0x7fa326f57010)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386473 = ArgusFree (0x7fa326f16010)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386492 = ArgusCloseInput(0x2908f010) done=20 ralabel[4462.40472429a37f0000]: 15:53:24.386500 = ArgusReadFileStream() returning=20 ralabel[4462.40472429a37f0000]: 15:53:24.386508 main: = ArgusReadFileStream (-) done=20 ralabel[4462.40472429a37f0000]: 15:53:24.386522 = ArgusFree (0x7fa32908f010)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386529 main: = reading files completed=20 ralabel[4462.40472429a37f0000]: 15:53:24.386536 = ArgusShutDown (0)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386546 = ArgusFree (0x26b2190)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386553 = ArgusDeleteQueue (0x26b2190) returning=20 ralabel[4462.40472429a37f0000]: 15:53:24.386561 = ArgusFree (0x26b21f0)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386569 = ArgusDeleteQueue (0x26b21f0) returning=20 ralabel[4462.40472429a37f0000]: 15:53:24.386599 = RaParseComplete (0) returning=20 ralabel[4462.40472429a37f0000]: 15:53:24.386608 = RaParseComplete(caught signal 0)=20 =20 Thanks for looking at this,=20 Kevin=20 =20 =20 On Sat, Sep 29, 2018 at 11:18 AM Carter Bullard = <[email protected] <mailto:[email protected]> = <mailto:[email protected]> > wrote:=20 Hey Kevin,=20 Any success ???=20 Carter=20 <http://qosient.com/>=20 <http://qosient.com/>=20 Carter Bullard =E2=80=A2 CTO <http://qosient.com/>=20 150 E 57th Street Suite 12D <http://qosient.com/>=20 New York, New York 10022-2795 <http://qosient.com/>=20 Phone +1.212.588.9133 =E2=80=A2 Mobile +1.917.497.9494 = <http://qosient.com/>=20 =20 On Sep 28, 2018, at 9:40 PM, David Edelman = <[email protected] <mailto:[email protected]> > wrote: = <http://qosient.com/>=20 -----BEGIN PGP SIGNED MESSAGE-----=20 Hash: SHA1 <http://qosient.com/>=20 Please try this: <http://qosient.com/>=20 # ra -r /argus/today/unt-01.arg -w - | ralabel = -f /etc/ralabel.conf -r - -s label:200 -N20 <http://qosient.com/>=20 <http://qosient.com/>=20 From: Argus-info = <[email protected] = <mailto:[email protected]> > On Behalf Of Kevin Branch=20 Sent: Friday, September 28, 2018 5:25 PM=20 To: Carter Bullard <[email protected] = <mailto:[email protected]> >=20 Cc: Argus <[email protected] = <mailto:[email protected]> >=20 Subject: Re: [ARGUS] MaxMind GeoIP support in = 3.0.8.2 <http://qosient.com/>=20 <http://qosient.com/>=20 Looks like GeoIP is linked in already: = <http://qosient.com/>=20 <http://qosient.com/>=20 # ldd `which ralabel`=20 linux-vdso.so.1 =3D> = (0x00007ffddaf8a000)=20 libm.so.6 =3D> = /lib/x86_64-linux-gnu/libm.so.6 (0x00007f5fe67c9000)=20 libpthread.so.0 =3D> = /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f5fe65ab000)=20 libGeoIP.so.1 =3D> = /usr/lib/x86_64-linux-gnu/libGeoIP.so.1 (0x00007f5fe637c000)=20 libc.so.6 =3D> = /lib/x86_64-linux-gnu/libc.so.6 (0x00007f5fe5fb3000)=20 /lib64/ld-linux-x86-64.so.2 = (0x00007f5fe6acf000) <http://qosient.com/>=20 <http://qosient.com/>=20 I switched to just "lat,lon" like you suggested = in ralabel.conf: <http://qosient.com/>=20 <http://qosient.com/>=20 # cat /etc/ralabel.conf <http://qosient.com/>=20 RALABEL_ARIN_COUNTRY_CODES=3Dno = <http://qosient.com/>=20 <http://qosient.com/>=20 RALABEL_GEOIP_ASN=3Dyes = <http://qosient.com/>=20 = RALABEL_GEOIP_ASN_FILE=3D"/usr/local/share/GeoIP/GeoIPASNum.dat" = <http://qosient.com/>=20 <http://qosient.com/>=20 RALABEL_GEOIP_CITY=3D"lat,lon" = <http://qosient.com/>=20 = RALABEL_GEOIP_CITY_FILE=3D"/usr/local/share/GeoIP/GeoIPCity.dat" = <http://qosient.com/>=20 <http://qosient.com/>=20 But I don't see anything but ASNs getting added = in: <http://qosient.com/>=20 <http://qosient.com/>=20 # ra -r /argus/today/unt-01.arg -w - | ralabel = -f /etc/ralabel.conf -r - -s sas,das,scity,dcity,icity | head -n20 = <http://qosient.com/>=20 sAS dAS <http://qosient.com/>=20 4323 <http://qosient.com/>=20 4323 <http://qosient.com/>=20 4323 <http://qosient.com/>=20 22927 4323 <http://qosient.com/>=20 6582 4323 <http://qosient.com/>=20 7018 4323 <http://qosient.com/>=20 4323 3 <http://qosient.com/>=20 4323 <http://qosient.com/>=20 4323 15169 <http://qosient.com/>=20 4323 <http://qosient.com/>=20 4323 <http://qosient.com/>=20 4323 15169 <http://qosient.com/>=20 4323 21928 <http://qosient.com/>=20 2828 4323 <http://qosient.com/>=20 <http://qosient.com/>=20 Thoughts? <http://qosient.com/>=20 Kevin <http://qosient.com/>=20 <http://qosient.com/>=20 On Fri, Sep 28, 2018 at 2:36 PM Carter Bullard = <[email protected] <mailto:[email protected]> = <mailto:[email protected]> > wrote: <http://qosient.com/>=20 Hey Kevin, <http://qosient.com/>=20 If you do a ./configure =E2=80=94help = you=E2=80=99ll see all the options that ./configure supports. If you = specify =E2=80=94with-GeoIP it wants the directory where the GeoIP = library is. <http://qosient.com/>=20 =E2=80=94with-GeoIP=3DDIR. compile = with GeoIP in <dir> <http://qosient.com/>=20 <http://qosient.com/>=20 You can check if the library is bound to = the client binaries with ldd =E2=80=A6 <http://qosient.com/>=20 ldd `which ralabel` = <http://qosient.com/>=20 <http://qosient.com/>=20 If you=E2=80=99re already bound, the = city stuff should work =E2=80=A6. I=E2=80=99m not familiar with = =E2=80=9Creg,cco=E2=80=9D as GeoIP City objects off the top of my head. = I=E2=80=99m familiar with = =E2=80=9Coff,cont,lat,lon,region,city,cname=E2=80=9D. Maybe try lat,lon = as a test, as I use that all the time .. <http://qosient.com/>=20 <http://qosient.com/>=20 Carter <http://qosient.com/>=20 =20 <http://qosient.com/>=20 =20 =20 <http://qosient.com/>=20 On Sep 28, 2018, at 1:59 PM, = Kevin Branch <[email protected] = <mailto:[email protected]> = <mailto:[email protected]> > wrote: <http://qosient.com/>=20 <http://qosient.com/>=20 Hi Carter, <http://qosient.com/> = <http://qosient.com/>=20 I was just trying today to make = ralabel on argus 3.0.8.2 do GeoIP labeling with GeoIPCity.dat, but even = though the file referred to in ralabel.conf for that purpose exists, no = GeoIP labeling takes place. ASN lookups work great, but ralabel never = adds any scity or dcity fields. <http://qosient.com/>=20 <http://qosient.com/>=20 My ralabel.conf: = <http://qosient.com/>=20 <http://qosient.com/>=20 = RALABEL_ARIN_COUNTRY_CODES=3Dno <http://qosient.com/>=20 <http://qosient.com/>=20 RALABEL_GEOIP_ASN=3Dyes = <http://qosient.com/>=20 = RALABEL_GEOIP_ASN_FILE=3D"/usr/local/share/GeoIP/GeoIPASNum.dat" = <http://qosient.com/>=20 <http://qosient.com/>=20 = RALABEL_GEOIP_CITY=3D"reg,cco" <http://qosient.com/>=20 = RALABEL_GEOIP_CITY_FILE=3D"/usr/local/share/GeoIP/GeoIPCity.dat" = <http://qosient.com/>=20 <http://qosient.com/>=20 No errors are thrown by ralabel. = I thought maybe I needed to specially compile in GeoIP support like I = read about here: https://qosient.com/argus/geolocation.shtml = <http://qosient.com/>=20 but when I run "./configure = --with-GeoIP=3Dyes" it throws this error: <http://qosient.com/>=20 configure: WARNING: = unrecognized options: --with-GeoIP <http://qosient.com/>=20 However, I presume the fact that = ASN lookups work means that MaxMind GeoIP support libraries are already = installed, and presumably installed by default in the latest argus now. = <http://qosient.com/>=20 <http://qosient.com/>=20 # ra -r /argus/today/unt-01.arg = -w - | ralabel -f /etc/ralabel.conf -r - -s sas,das,scity,dcity,icity | = head -n20 <http://qosient.com/>=20 sAS dAS = <http://qosient.com/>=20 4323 <http://qosient.com/>=20 4323 <http://qosient.com/>=20 4323 <http://qosient.com/>=20 22927 4323 = <http://qosient.com/>=20 6582 4323 = <http://qosient.com/>=20 7018 4323 = <http://qosient.com/>=20 4323 3 = <http://qosient.com/>=20 4323 <http://qosient.com/>=20 4323 15169 = <http://qosient.com/>=20 4323 <http://qosient.com/>=20 4323 <http://qosient.com/>=20 4323 15169 = <http://qosient.com/>=20 4323 21928 = <http://qosient.com/>=20 2828 4323 = <http://qosient.com/>=20 <http://qosient.com/>=20 Any thoughts on what I am = missing or how I might further debug this issue? <http://qosient.com/>=20 <http://qosient.com/>=20 Thanks! <http://qosient.com/>=20 Kevin <http://qosient.com/>=20 =20 -----BEGIN PGP SIGNATURE----- = <http://qosient.com/>=20 = iF0EARECAB0WIQQP+UHquEepll566aqXCCyZOY1FIQUCW67X6gAKCRCXCCyZOY1F=20 = IdLwAKDv6tPpe7OwLBEEfM1YTnAD8MxZCgCeOlGEEuEIUvqlyIMh8CPBWctmBd0=3D=20 =3Dp/tg=20 -----END PGP SIGNATURE----- = <http://qosient.com/>=20 -----BEGIN PGP SIGNATURE-----=20 iF0EARECAB0WIQQP+UHquEepll566aqXCCyZOY1FIQUCW6/WuAAKCRCXCCyZOY1F = = IYGaAKDk/9QFqcgbEWN6bN9eMNitGAXU7ACfduIQKuGR7lsDTCkdRogye0u8TxM=3D=20 =3DeoBH=20 -----END PGP SIGNATURE-----=20 -----BEGIN PGP SIGNATURE-----=20 iF0EARECAB0WIQQP+UHquEepll566aqXCCyZOY1FIQUCW7DgxQAKCRCXCCyZOY1F=20 IW8GAJ9tlHBAzoC4LAVWCw09qF4MfwuhOQCg7MxVBI5MKea4aax2551/gQ28mlE=3D=20 =3DCZnI=20 -----END PGP SIGNATURE-----=20 ------=_NextPart_000_0001_01D458AA.49138E50 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable <html xmlns:v=3D"urn:schemas-microsoft-com:vml" = xmlns:o=3D"urn:schemas-microsoft-com:office:office" = xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" = xmlns=3D"http://www.w3.org/TR/REC-html40"><head><meta = http-equiv=3DContent-Type content=3D"text/html; charset=3Dutf-8"><meta = name=3DGenerator content=3D"Microsoft Word 15 (filtered = medium)"><style><!-- /* Font Definitions */ @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;} @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0in; margin-bottom:.0001pt; font-size:11.0pt; font-family:"Calibri",sans-serif;} a:link, span.MsoHyperlink {mso-style-priority:99; color:blue; text-decoration:underline;} a:visited, span.MsoHyperlinkFollowed {mso-style-priority:99; color:purple; text-decoration:underline;} p.msonormal0, li.msonormal0, div.msonormal0 {mso-style-name:msonormal; mso-margin-top-alt:auto; margin-right:0in; mso-margin-bottom-alt:auto; margin-left:0in; font-size:11.0pt; font-family:"Calibri",sans-serif;} span.EmailStyle19 {mso-style-type:personal-compose;} .MsoChpDefault {mso-style-type:export-only; font-size:10.0pt;} @page WordSection1 {size:8.5in 11.0in; margin:1.0in 1.0in 1.0in 1.0in;} div.WordSection1 {page:WordSection1;} --></style><!--[if gte mso 9]><xml> <o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" /> </xml><![endif]--><!--[if gte mso 9]><xml> <o:shapelayout v:ext=3D"edit"> <o:idmap v:ext=3D"edit" data=3D"1" /> </o:shapelayout></xml><![endif]--></head><body lang=3DEN-US link=3Dblue = vlink=3Dpurple><div class=3DWordSection1><p>-----BEGIN PGP SIGNED = MESSAGE----- <br>Hash: SHA1 <o:p></o:p></p><p>Use the ra command line = flag -M label=3D=E2=80=99scity=3DFL.*dcity=3DFL=E2=80=99 I = seem to remember that regular expressions work for this filter. Use the = single quote to escape the * <o:p></o:p></p><p> = <o:p></o:p></p><p>If the regular expression doesn=E2=80=99t work let me = know. You can=E2=80=99t use ragrep since that looks at theuser = data portion of the flow, not the label = metadata.<o:p></o:p></p><p> <o:p></o:p></p><p>- --Dave = <o:p></o:p></p><p> <o:p></o:p></p><p>From: Kevin Branch = <[email protected]> <br>Sent: Saturday, September 29, = 2018 11:14 PM <br>To: David Edelman <[email protected]> <br>Cc: = Carter Bullard <[email protected]>; Argus = <[email protected]> <br>Subject: Re: [ARGUS] MaxMind = GeoIP support in 3.0.8.2 <o:p></o:p></p><p> = <o:p></o:p></p><p>David, thanks! That was the missing piece. = <o:p></o:p></p><p> <o:p></o:p></p><p>I switched to = <o:p></o:p></p><p> = <o:p></o:p></p><p>RALABEL_GEOIP_CITY=3D"saddr,daddr:region,cco"= <o:p></o:p></p><p> <o:p></o:p></p><p>and I saw what I wanted: = <o:p></o:p></p><p> <o:p></o:p></p><p># ra -r = /argus/today/unt-01.arg -N1 -w - | ralabel -f /etc/ralabel.conf -r - -s = label:30 -N20 = <o:p></o:p></p><p> &= nbsp; &n= bsp; Label = <o:p></o:p></p><p> = scity=3DFL,US:dcity=3DMO,US <o:p></o:p></p><p> = <o:p></o:p></p><p>All along I have been trying to label source and = destination IPs with state,country like above. It took a fair bit = of experimenting to get the state part figured out due to that field = being referred to as "reg" in the ralabel.conf comment = documentation while actually it has to be referenced as = "region" to work.<o:p></o:p></p><p> = <o:p></o:p></p><p>Now for my hopefully last question: How can I = have ra use that label content as search criteria? I am trying to = use ra to count up total traffic volume seen where the source and = destination IP are both in Florida. I suspect ra will not let me = use label, scity or dcity values as filter criteria. Can ragrep = help here? Or will I have to go the rasqlinsert route to = accomplish this?<o:p></o:p></p><p> <o:p></o:p></p><p>Thanks, = <o:p></o:p></p><p>Kevin <o:p></o:p></p><p> = <o:p></o:p></p><p> <o:p></o:p></p><p>On Sat, Sep 29, 2018 at 3:47 = PM David Edelman <[email protected] <<a = href=3D"mailto:[email protected]">mailto:[email protected]</a>> = > wrote: <o:p></o:p></p><p> = -----BEGIN PGP SIGNED MESSAGE----- = <br> Hash: SHA1 = <o:p></o:p></p><p> It looks = like we are almost there, you need to indicate which addresses need to = have the labels associated = <o:p></o:p></p><p> Please = change this in your configuration file = <o:p></o:p></p><p> = <o:p></o:p></p><p> = <o:p></o:p></p><p> = RALABEL_GEOIP_CITY=3D"saddr,daddr:city " = <o:p></o:p></p><p> = <o:p></o:p></p><p> This = information might help Looking at the code, the netmask is not = functional <o:p></o:p></p><p> = <o:p></o:p></p><p> # = <o:p></o:p></p><p> = # Data for city relevant data is enabled through = enabling and configuring = <o:p></o:p></p><p> = # the city database support. The types of data = available are: = <o:p></o:p></p><p> = # country_code, country_code3, = country_name, region, city, postal_code, = <o:p></o:p></p><p> = # latitude, longitude, metro_code, = area_code and continent_code. = <o:p></o:p></p><p> = # time_offset is also available. = <o:p></o:p></p><p> # = <o:p></o:p></p><p> = # The concept is that you should be able to add = semantics for any = <o:p></o:p></p><p> = # IP address that is in the argus record. = Support addresses are: = <o:p></o:p></p><p> # = <o:p></o:p></p><p> = # saddr, daddr, inode = <o:p></o:p></p><p> # = <o:p></o:p></p><p> = # The labels provided will be tagged as: = <o:p></o:p></p><p> = # scity, dcity, icity = <o:p></o:p></p><p> # = <o:p></o:p></p><p> = # To configure what you want to have placed in the = label, use the list of = <o:p></o:p></p><p> = # objects, in whatever order you like, as the = RALABEL_GEOPIP_CITY string = <o:p></o:p></p><p> = # using these keywords: = <o:p></o:p></p><p> = # cco - country_code = <o:p></o:p></p><p> = # cco3 - country_code3 = <o:p></o:p></p><p> = # cname - country_name = <o:p></o:p></p><p> = # reg - region = <o:p></o:p></p><p> = # city - city = <o:p></o:p></p><p> = # pcode - postal_code = <o:p></o:p></p><p> = # lat - latitude = <o:p></o:p></p><p> = # long - longitude = <o:p></o:p></p><p> = # metro - metro_code = <o:p></o:p></p><p> = # area - area_code = <o:p></o:p></p><p> = # cont - continent_code = <o:p></o:p></p><p> = # netmask - netmask value = <o:p></o:p></p><p> # = <o:p></o:p></p><p> = # Working examples could be: = <o:p></o:p></p><p> = # = RALABEL_GEOIP_CITY=3D"saddr,daddr:lat/lon" = <o:p></o:p></p><p> = # = RALABEL_GEOIP_CITY=3D"*:city,region,cname,lat,lon" = <o:p></o:p></p><p> # = <o:p></o:p></p><p> = #RALABEL_GEOIP_CITY=3D"saddr,daddr,inode:off,cont,lat,lon" = <o:p></o:p></p><p> = #RALABEL_GEOIP_CITY_FILE=3D"/usr/local/share/GeoIP/GeoIP.dat" = <o:p></o:p></p><p> = <o:p></o:p></p><p> = <o:p></o:p></p><p> = <o:p></o:p></p><p> - --Dave = <o:p></o:p></p><p> = <o:p></o:p></p><p> = <o:p></o:p></p><p> = <o:p></o:p></p><p> From: Kevin = Branch <[email protected] <<a = href=3D"mailto:[email protected]">mailto:kevin@branchnetconsu= lting.com</a>> > <br> = Sent: Saturday, September 29, 2018 11:57 AM = <br> To: Carter Bullard = <[email protected] <<a = href=3D"mailto:[email protected]">mailto:[email protected]</a>> = > <br> Cc: David Edelman = <[email protected] <<a = href=3D"mailto:[email protected]">mailto:[email protected]</a>> = >; Argus <[email protected] <<a = href=3D"mailto:[email protected]">mailto:[email protected]= ndrew.cmu.edu</a>> > = <o:p></o:p></p><p> Subject: = Re: [ARGUS] MaxMind GeoIP support in 3.0.8.2 = <o:p></o:p></p><p> = <o:p></o:p></p><p> Hi Carter = and David, <o:p></o:p></p><p> = <o:p></o:p></p><p> I = just tried the following with the same ralabel.conf as before: = <o:p></o:p></p><p> = ra -r /argus/today/unt-01.arg = -w - | ralabel -f /etc/ralabel.conf -r - -s label:200 -N20 = <o:p></o:p></p><p> and saw = this. Looks like I was using the wrong syntax which I am glad to = know better now, but the GeoIP lookups are still not = happening:<o:p></o:p></p><p> = "scity=3D:dcity=3D" = <o:p></o:p></p><p> = "scity=3D:dcity=3D" = <o:p></o:p></p><p> = "scity=3D:dcity=3D" = <o:p></o:p></p><p> = "scity=3D:dcity=3D" = <o:p></o:p></p><p> = "scity=3D:dcity=3D" = <o:p></o:p></p><p> = "scity=3D:dcity=3D" = <o:p></o:p></p><p> = "scity=3D:dcity=3D" = <o:p></o:p></p><p> = "scity=3D:dcity=3D" = <o:p></o:p></p><p> = "scity=3D:dcity=3D" = <o:p></o:p></p><p> = "scity=3D:dcity=3D" = <o:p></o:p></p><p> = "scity=3D:dcity=3D" = <o:p></o:p></p><p> = "scity=3D:dcity=3D" = <o:p></o:p></p><p> = <o:p></o:p></p><p> I know the = data file is good because it works with this: = <o:p></o:p></p><p> = # geoiplookup -f = /usr/local/share/GeoIP/GeoIPCity.dat 207.48.48.19 = <o:p></o:p></p><p> = GeoIP City Edition, Rev 1: = US, MO, Missouri, Chesterfield, 63017, 38.650002, -90.533401, 609, 314 = <o:p></o:p></p><p> = = <o:p></o:p></p><p> In case it = helps, I rebuilt argus-clients with the .debug flag file present and = then ran this command limited to only a single argus record that I = independently confirmed has a srcip value known to = geoiplookup<o:p></o:p></p><p> = # ra -r = /argus/today/unt-01.arg -N1 -w - | ralabel -f /etc/ralabel.conf -r - -s = label:50 -N200 -D3 = <o:p></o:p></p><p> = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.950161 ArgusNewLabeler = (0x7f8eff3f7010, 0) returning 0x1b057c0 = <o:p></o:p></p><p> = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.959656 = RaLabelParseResourceFile (/etc/ralabel.conf) returning 0 = <o:p></o:p></p><p> = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.959730 ArgusReadConnection() = read 16 bytes = <o:p></o:p></p><p> = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.959748 ArgusReadConnection() = read 112 bytes = <o:p></o:p></p><p> = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961133 ArgusInitAddrtoname = (0x7f8eff3f7010, 0xa9fe6700, 0xffffff00) = <o:p></o:p></p><p> = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961145 = ArgusParseInit(0x7f8eff3f7010 0x7f8eff386010 = <o:p></o:p></p><p> = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961155 = ArgusReadConnection(0xff386010, 1) returning 1 = <o:p></o:p></p><p> = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961329 ArgusAddToRecordLabel = (0x7f8eff3f7010, 0x1b188c0, scity=3D:dcity=3D) returning = 0<o:p></o:p></p><p> = &= nbsp; &n= bsp; &nb= sp; &nbs= p; Label = <o:p></o:p></p><p> = &= nbsp; &n= bsp; &nb= sp; scity=3D:dcity=3D = <o:p></o:p></p><p> = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961385 = ArgusCloseInput(0xff386010) closing = <o:p></o:p></p><p> = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961408 = ArgusCloseInput(0xff386010) done = <o:p></o:p></p><p> = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961415 main: = ArgusReadFileStream (-) done = <o:p></o:p></p><p> = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961426 main: reading files = completed <o:p></o:p></p><p> = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961432 ArgusShutDown (0) = <o:p></o:p></p><p> = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961439 RaParseComplete (0) = returning <o:p></o:p></p><p> = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961444 RaParseComplete(caught = signal 0) <o:p></o:p></p><p> = = [email protected]:~/argus-clients-3.0.8# <<a = href=3D"mailto:[email protected]:~/argus-clients-3.0.8">mailto:root@n= sm.wycliffe.org:~/argus-clients-3.0.8</a>#> <<a = href=3D"mailto:[email protected]:~/argus-clients-3.0.8">mailto:root@n= sm.wycliffe.org:~/argus-clients-3.0.8</a>#> ra -r = /argus/today/unt-01.arg -N1 -w - | ralabel -f /etc/ralabel.conf -r - -s = label:50 -N200 = -D8<o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.374433 ArgusFree (0x26b2250) = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.374461 ArgusFree (0x26b22b0) = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.374469 ArgusFree (0x26b2310) = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.374474 ArgusFree (0x26b2370) = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.374479 ArgusFree (0x26b23d0) = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.374484 ArgusFree (0x26b2430) = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.374489 ArgusFree (0x26b2490) = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.374494 ArgusFree (0x26b24f0) = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.374499 ArgusFree (0x26b2550) = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.374504 ArgusFree (0x26b25b0) = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.374509 ArgusFree (0x26b2610) = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.374533 ArgusCalloc (1, 80) = returning 0x26b2610 = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.374544 ArgusCalloc (1, 296) = returning 0x26b27c0 = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.374566 ArgusCalloc (1, 112) = returning 0x26b2950 = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.374577 ArgusCalloc (1, 80) = returning 0x26b25b0 = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.374595 ArgusNewQueue () = returning 0x26b25b0 = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.374613 ArgusCalloc (65536, 8) = returning 0x2849a010 = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.374619 ArgusNewLabeler = (0x7fa329100010, 0) returning 0x26b27c0 = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.384352 RaLabelParseResourceFile = (/etc/ralabel.conf) returning 0 = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.384387 ArgusCalloc (1, 560) = returning 0x26b2250 = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.384411 ArgusCalloc (1, 112) = returning 0x26b2e80 = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.384418 ArgusCalloc (1, 80) = returning 0x26b2f00 = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.384424 ArgusNewQueue () = returning 0x26b2f00 = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.384430 ArgusCalloc (1, 56) = returning 0x26b2f60 = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.384454 ArgusCalloc (65536, 8) = returning 0x27358010 = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.384461 ArgusNewHashTable = (65536) returning 0x26b2f60 = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.384483 ArgusReadConnection() = read 16 bytes = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.384498 ArgusReadConnection() = read 112 bytes = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.384514 ArgusCalloc (1, 4194304) = returning 0x26f57010 = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.384523 ArgusCalloc (1, 262144) = returning 0x26f16010 = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.385934 ArgusInitAddrtoname = (0x7fa329100010, 0xa9fe6700, 0xffffff00) = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.385947 = ArgusParseInit(0x7fa329100010 0x7fa32908f010 = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.385956 = ArgusReadConnection(0x2908f010, 1) returning 1 = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.385969 ArgusReadFileStream() = starting <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.385981 ArgusReadStreamSocket = (0x7fa32908f010) read 380 bytes = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386015 ArgusCalloc (1, 384) = returning 0x26c58c0 = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386025 ArgusCalloc (1, 12) = returning 0x26c5a50 = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386031 ArgusCalloc (1, 80) = returning 0x26c5a70 = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386037 ArgusCalloc (1, 36) = returning 0x26c5ad0 = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386042 ArgusCalloc (1, 52) = returning 0x26c5b00 = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386047 ArgusCalloc (1, 80) = returning 0x26c5b40 = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386053 ArgusCalloc (1, 120) = returning 0x26c5ba0 = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386058 ArgusCalloc (1, 8) = returning 0x26c5c20 = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386063 ArgusCalloc (1, 164) = returning 0x26c5c40 = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386070 ArgusCalloc (1, 20) = returning 0x26c5cf0 = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386075 ArgusCalloc (1, 20) = returning 0x26c5d10 = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386080 ArgusCalloc (1, 12) = returning 0x26c5d30 = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386092 ArgusCalloc (1, 16) = returning 0x26c5d50 = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386131 ArgusCalloc (1, 12) = returning 0x26c5e80 = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386234 ArgusAddToRecordLabel = (0x7fa329100010, 0x26c58c0, scity=3D:dcity=3D) returning = 0<o:p></o:p></p><p> = &= nbsp; &n= bsp; &nb= sp; &nbs= p; Label = <o:p></o:p></p><p> = &= nbsp; &n= bsp; &nb= sp; scity=3D:dcity=3D = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386280 ArgusFree (0x26c5a50) = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386287 ArgusFree (0x26c5a70) = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386292 ArgusFree (0x26c5ad0) = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386297 ArgusFree (0x26c5b00) = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386301 ArgusFree (0x26c5b40) = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386304 ArgusFree (0x26c5ba0) = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386308 ArgusFree (0x26c5c20) = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386312 ArgusFree (0x26c5c40) = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386316 ArgusFree (0x26c5cf0) = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386322 ArgusFree (0x26c5d10) = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386359 ArgusFree (0x26c5d30) = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386369 ArgusFree (0x26c5e80) = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386377 ArgusFree (0x26c5d50) = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386384 ArgusFree (0x26c58c0) = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386392 RaProcessRecord = (0x2908f630) returning = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386400 RaScheduleRecord = (0x7fa329100010, 0x7fa32908f630) scheduled = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386408 ArgusHandleRecord = (0x7fa326f57010, 0x7fa329221800) returning = 380<o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386417 ArgusReadStreamSocket = (0x7fa32908f010) returning 0 = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386432 ArgusReadStreamSocket = (0x7fa32908f010) read 0 bytes = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386439 ArgusReadStreamSocket = (0x7fa32908f010) returning 1 = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386447 = ArgusCloseInput(0x2908f010) closing = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386463 ArgusFree = (0x7fa326f57010) = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386473 ArgusFree = (0x7fa326f16010) = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386492 = ArgusCloseInput(0x2908f010) done = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386500 ArgusReadFileStream() = returning <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386508 main: = ArgusReadFileStream (-) done = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386522 ArgusFree = (0x7fa32908f010) = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386529 main: reading files = completed <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386536 ArgusShutDown (0) = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386546 ArgusFree (0x26b2190) = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386553 ArgusDeleteQueue = (0x26b2190) returning = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386561 ArgusFree (0x26b21f0) = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386569 ArgusDeleteQueue = (0x26b21f0) returning = <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386599 RaParseComplete (0) = returning <o:p></o:p></p><p> = = ralabel[4462.40472429a37f0000]: 15:53:24.386608 RaParseComplete(caught = signal 0) <o:p></o:p></p><p> = = <o:p></o:p></p><p> Thanks for = looking at this, = <o:p></o:p></p><p> Kevin = <o:p></o:p></p><p> = <o:p></o:p></p><p> = <o:p></o:p></p><p> On Sat, Sep = 29, 2018 at 11:18 AM Carter Bullard <[email protected] <<a = href=3D"mailto:[email protected]">mailto:[email protected]</a>> = ; <<a = href=3D"mailto:[email protected]">mailto:[email protected]</a>> = > wrote: <o:p></o:p></p><p> = Hey Kevin, = <o:p></o:p></p><p> = Any success ??? = <o:p></o:p></p><p> = Carter = <o:p></o:p></p><p> <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> Carter = Bullard =E2=80=A2 CTO <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> 150 E 57th = Street Suite 12D <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> New York, = New York 10022-2795 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> Phone = +1.212.588.9133 =E2=80=A2 Mobile +1.917.497.9494 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = <br> = On Sep 28, 2018, at 9:40 PM, = David Edelman <[email protected] <<a = href=3D"mailto:[email protected]">mailto:[email protected]</a>> = > wrote: <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; -----BEGIN PGP SIGNED MESSAGE----- = <br> = &= nbsp; Hash: SHA1 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; Please try this: <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; # ra -r /argus/today/unt-01.arg -w - | ralabel -f = /etc/ralabel.conf -r - -s label:200 -N20 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; From: Argus-info = <[email protected] <<a = href=3D"mailto:[email protected]">mailto:[email protected]= rew.cmu.edu</a>> > On Behalf Of Kevin Branch = <o:p></o:p></p><p> = &= nbsp; Sent: Friday, September 28, 2018 5:25 PM = <br> = &= nbsp; To: Carter Bullard <[email protected] <<a = href=3D"mailto:[email protected]">mailto:[email protected]</a>> = > <br> = &= nbsp; Cc: Argus <[email protected] <<a = href=3D"mailto:[email protected]">mailto:[email protected]= ndrew.cmu.edu</a>> > = <br> = &= nbsp; Subject: Re: [ARGUS] MaxMind GeoIP support in 3.0.8.2 = <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; Looks like GeoIP is linked in already: <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; # ldd `which ralabel` = <br> = &= nbsp; = linux-vdso.so.1 =3D> (0x00007ffddaf8a000) = <br> = &= nbsp; = libm.so.6 =3D> /lib/x86_64-linux-gnu/libm.so.6 (0x00007f5fe67c9000) = <br> = &= nbsp; = libpthread.so.0 =3D> /lib/x86_64-linux-gnu/libpthread.so.0 = (0x00007f5fe65ab000) <br> = &= nbsp; = libGeoIP.so.1 =3D> /usr/lib/x86_64-linux-gnu/libGeoIP.so.1 = (0x00007f5fe637c000) <br> = &= nbsp; = libc.so.6 =3D> /lib/x86_64-linux-gnu/libc.so.6 (0x00007f5fe5fb3000) = <br> = &= nbsp; = /lib64/ld-linux-x86-64.so.2 (0x00007f5fe6acf000) <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; I switched to just "lat,lon" like you = suggested in ralabel.conf: <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; # cat /etc/ralabel.conf <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; = RALABEL_ARIN_COUNTRY_CODES=3Dno <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; = <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; = RALABEL_GEOIP_ASN=3Dyes <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; = RALABEL_GEOIP_ASN_FILE=3D"/usr/local/share/GeoIP/GeoIPASNum.dat"= ; <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; = <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; = RALABEL_GEOIP_CITY=3D"lat,lon" <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; = RALABEL_GEOIP_CITY_FILE=3D"/usr/local/share/GeoIP/GeoIPCity.dat"= ; <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; But I don't see anything but ASNs getting added in: = <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; # ra -r /argus/today/unt-01.arg -w - | ralabel -f = /etc/ralabel.conf -r - -s sas,das,scity,dcity,icity | head -n20 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; sAS dAS <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; 4323 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; 4323 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; 4323 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; 22927 4323 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; 6582 4323 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; 7018 4323 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; 4323 3 = <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; 4323 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; 4323 15169 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; 4323 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; 4323 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; 4323 15169 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; 4323 21928 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; 2828 4323 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; Thoughts? <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; Kevin <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; On Fri, Sep 28, 2018 at 2:36 PM Carter Bullard = <[email protected] <<a = href=3D"mailto:[email protected]">mailto:[email protected]</a>> = ; <<a = href=3D"mailto:[email protected]">mailto:[email protected]</a>> = > wrote: <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; Hey = Kevin, <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; If you = do a ./configure =E2=80=94help you=E2=80=99ll see all the options that = ./configure supports. If you specify =E2=80=94with-GeoIP it wants = the directory where the GeoIP library is. <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; =E2=80=94with-GeoIP=3DDIR. compile with GeoIP in <dir> <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; = <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; You = can check if the library is bound to the client binaries with ldd = =E2=80=A6 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; ldd `which ralabel` <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; = <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; If = you=E2=80=99re already bound, the city stuff should work = =E2=80=A6. I=E2=80=99m not familiar with =E2=80=9Creg,cco=E2=80=9D = as GeoIP City objects off the top of my head. I=E2=80=99m familiar = with =E2=80=9Coff,cont,lat,lon,region,city,cname=E2=80=9D. Maybe = try lat,lon as a test, as I use that all the time .. <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; = <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; Carter = <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; = <br> = &= nbsp; &n= bsp; <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; = <br> = &= nbsp; = <br> = &= nbsp; <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; On Sep 28, 2018, at 1:59 PM, = Kevin Branch <[email protected] <<a = href=3D"mailto:[email protected]">mailto:kevin@branchnetconsu= lting.com</a>> <<a = href=3D"mailto:[email protected]">mailto:kevin@branchnetconsu= lting.com</a>> > wrote: <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; Hi Carter, <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; I was just trying today to make = ralabel on argus 3.0.8.2 do GeoIP labeling with GeoIPCity.dat, but even = though the file referred to in ralabel.conf for that purpose exists, no = GeoIP labeling takes place. ASN lookups work great, = but ralabel never adds any scity or dcity fields. <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; My ralabel.conf: <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; &nb= sp; RALABEL_ARIN_COUNTRY_CODES=3Dno <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; &nb= sp; <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; &nb= sp; RALABEL_GEOIP_ASN=3Dyes <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; &nb= sp; = RALABEL_GEOIP_ASN_FILE=3D"/usr/local/share/GeoIP/GeoIPASNum.dat"= ; <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; &nb= sp; <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; &nb= sp; RALABEL_GEOIP_CITY=3D"reg,cco" <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; &nb= sp; = RALABEL_GEOIP_CITY_FILE=3D"/usr/local/share/GeoIP/GeoIPCity.dat"= ; <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; No errors are thrown by = ralabel. I thought maybe I needed to specially compile in GeoIP = support like I read about here: <a = href=3D"https://qosient.com/argus/geolocation.shtml">https://qosient.com/= argus/geolocation.shtml</a> <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; but when I run = "./configure --with-GeoIP=3Dyes" it throws this error: <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; &nb= sp; configure: WARNING: unrecognized options: --with-GeoIP = <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; However, I presume the fact = that ASN lookups work means that MaxMind GeoIP support libraries are = already installed, and presumably installed by default in the latest = argus now. <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; # ra -r /argus/today/unt-01.arg = -w - | ralabel -f /etc/ralabel.conf -r - -s sas,das,scity,dcity,icity | = head -n20 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; = sAS dAS <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; 4323 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; 4323 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; 4323 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; 22927 4323 = <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; 6582 = 4323 <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; 7018 = 4323 <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; = 4323 3 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; 4323 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; 4323 15169 = <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; 4323 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; 4323 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; 4323 15169 = <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; 4323 21928 = <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; 2828 = 4323 <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; Any thoughts on what I am = missing or how I might further debug this issue? <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; Thanks! <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; &n= bsp; Kevin <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; = <br> = &= nbsp; -----BEGIN PGP SIGNATURE----- <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = &= nbsp; = iF0EARECAB0WIQQP+UHquEepll566aqXCCyZOY1FIQUCW67X6gAKCRCXCCyZOY1F = <br> = &= nbsp; = IdLwAKDv6tPpe7OwLBEEfM1YTnAD8MxZCgCeOlGEEuEIUvqlyIMh8CPBWctmBd0=3D = <br> = &= nbsp; =3Dp/tg <br> = &= nbsp; -----END PGP SIGNATURE----- <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <br> -----BEGIN PGP = SIGNATURE----- = <o:p></o:p></p><p> = iF0EARECAB0WIQQP+UHquEepll566aqXCCyZOY1FIQUCW6/WuAAKCRCXCCyZOY1F = <br> = IYGaAKDk/9QFqcgbEWN6bN9eMNitGAXU7ACfduIQKuGR7lsDTCkdRogye0u8TxM=3D = <br> =3DeoBH = <br> -----END PGP = SIGNATURE----- <br>-----BEGIN PGP SIGNATURE----- = <o:p></o:p></p><p>iF0EARECAB0WIQQP+UHquEepll566aqXCCyZOY1FIQUCW7DgxQAKCRC= XCCyZOY1F = <br>IW8GAJ9tlHBAzoC4LAVWCw09qF4MfwuhOQCg7MxVBI5MKea4aax2551/gQ28mlE=3D = <br>=3DCZnI <br>-----END PGP SIGNATURE----- = <o:p></o:p></p></div></body></html> ------=_NextPart_000_0001_01D458AA.49138E50--