Re: MaxMind GeoIP support in 3.0.8.2
Carter Bullard <[email protected]> Mon, 1 Oct 2018 09:50:07 -0400
| Newsgroups | gmane.network.argus |
|---|---|
| Message-ID | <[email protected]> |
--Apple-Mail=_7E1EAD92-021A-43FC-84D1-37DF64973ED2
Content-Type: multipart/alternative;
boundary="Apple-Mail=_73326516-5DFB-4399-9A3E-9FDD46760874"
--Apple-Mail=_73326516-5DFB-4399-9A3E-9FDD46760874
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
charset=utf-8
Hey Kevin,
Dave is right on the money, and great to see that you guys got it =
working !! =20
You can search the label using regular expressions (pcre style regex if =
you compiled that library in) just as Dave indicates. You can use a =
simple regex like =E2=80=9CFL=E2=80=9D to get the flows that have =
anything to do with =E2=80=98FL=E2=80=99 and then do your own parsing to =
get exactly what you want, something like:
ra -S localhost -M label=3D=E2=80=9CFL=E2=80=9D -s stime saddr daddr =
proto spkts dpkts label -c,
And then process the label string to get your values, or you can regex =
and match the FL as a part of both the =E2=80=98scity=E2=80=99 and =
=E2=80=98dcity=E2=80=99 fields. Something like:
-M label=3D=E2=80=9Cscity=3D.*FL.*dcity=3D.*FL=E2=80=9D
In general, the labeler will put the scity, then the dcity values into =
the label in that order, and should put the values you specify on the =
line into the label, in the order given. But, because a previous =
labeler could have put scity and/or dcity values in the label before you =
put your values, you don=E2=80=99t know what the order of values maybe =
for scity or dcity. When there are multiple values, ralabel and radium =
have the ability to reorder values, so that it can deal with duplicate =
values. Daves regex will match if FL is just after the =E2=80=98=3D=E2=80=
=98 which will cover 95% of the scenarios. I have multiple labelers, =
radium is always putting lat,lon bounding boxes for IP addresses, so if =
I have something later putting in city codes, it may end up at the end =
of a list of other objects that apply to =E2=80=99scity=E2=80=99 or =
=E2=80=98dcity=E2=80=99. And of course, the =E2=80=99scity=E2=80=99 and =
=E2=80=98dcity=E2=80=99 may not be in that order =E2=80=A6 In this case =
the best regex may be:
-M label=3D"(?=3D.*scity=3D.*FL)(?=3D.*dcity=3D.*FL)=E2=80=9D
This matches scity=E2=80=A6FL and dcity=E2=80=A6FL regardless of the =
order in the label. May still need some tweaking, but hopefully you get =
the idea ...
Carter
> On Sep 30, 2018, at 10:42 AM, David Edelman <[email protected]> =
wrote:
>=20
> -----BEGIN PGP SIGNED MESSAGE-----=20
> Hash: SHA1=20
> Use the ra command line flag -M label=3D=E2=80=99scity=3DFL.*dcity=3DFL=E2=
=80=99 I seem to remember that regular expressions work for this =
filter. Use the single quote to escape the *=20
> =20
> If the regular expression doesn=E2=80=99t work let me know. You =
can=E2=80=99t use ragrep since that looks at theuser data portion of =
the flow, not the label metadata.
> =20
> - --Dave=20
> =20
> From: Kevin Branch <[email protected] =
<mailto:[email protected]>>=20
> Sent: Saturday, September 29, 2018 11:14 PM=20
> To: David Edelman <[email protected] <mailto:[email protected]>>=20
> Cc: Carter Bullard <[email protected] <mailto:[email protected]>>; =
Argus <[email protected] =
<mailto:[email protected]>>=20
> Subject: Re: [ARGUS] MaxMind GeoIP support in 3.0.8.2=20
> =20
> David, thanks! That was the missing piece.=20
> =20
> I switched to=20
> =20
> RALABEL_GEOIP_CITY=3D"saddr,daddr:region,cco"=20
> =20
> and I saw what I wanted:=20
> =20
> # ra -r /argus/today/unt-01.arg -N1 -w - | ralabel -f =
/etc/ralabel.conf -r - -s label:30 -N20=20
> Label=20
> scity=3DFL,US:dcity=3DMO,US=20
> =20
> All along I have been trying to label source and destination IPs with =
state,country like above. It took a fair bit of experimenting to get =
the state part figured out due to that field being referred to as "reg" =
in the ralabel.conf comment documentation while actually it has to be =
referenced as "region" to work.
> =20
> Now for my hopefully last question: How can I have ra use that label =
content as search criteria? I am trying to use ra to count up total =
traffic volume seen where the source and destination IP are both in =
Florida. I suspect ra will not let me use label, scity or dcity values =
as filter criteria. Can ragrep help here? Or will I have to go the =
rasqlinsert route to accomplish this?
> =20
> Thanks,=20
> Kevin=20
> =20
> =20
> On Sat, Sep 29, 2018 at 3:47 PM David Edelman <[email protected] =
<mailto:[email protected]> <mailto:[email protected] =
<mailto:[email protected]>> > wrote:=20
> -----BEGIN PGP SIGNED MESSAGE-----=20
> Hash: SHA1=20
> It looks like we are almost there, you need to indicate which =
addresses need to have the labels associated=20
> Please change this in your configuration file=20
> =20
> =20
> RALABEL_GEOIP_CITY=3D"saddr,daddr:city "=20
> =20
> This information might help Looking at the code, the netmask =
is not functional=20
> =20
> #=20
> # Data for city relevant data is enabled through enabling =
and configuring=20
> # the city database support. The types of data available =
are:=20
> # country_code, country_code3, country_name, region, =
city, postal_code,=20
> # latitude, longitude, metro_code, area_code and =
continent_code.=20
> # time_offset is also available.=20
> #=20
> # The concept is that you should be able to add semantics =
for any=20
> # IP address that is in the argus record. Support =
addresses are:=20
> #=20
> # saddr, daddr, inode=20
> #=20
> # The labels provided will be tagged as:=20
> # scity, dcity, icity=20
> #=20
> # To configure what you want to have placed in the label, =
use the list of=20
> # objects, in whatever order you like, as the =
RALABEL_GEOPIP_CITY string=20
> # using these keywords:=20
> # cco - country_code=20
> # cco3 - country_code3=20
> # cname - country_name=20
> # reg - region=20
> # city - city=20
> # pcode - postal_code=20
> # lat - latitude=20
> # long - longitude=20
> # metro - metro_code=20
> # area - area_code=20
> # cont - continent_code=20
> # netmask - netmask value=20
> #=20
> # Working examples could be:=20
> # RALABEL_GEOIP_CITY=3D"saddr,daddr:lat/lon"=20
> # RALABEL_GEOIP_CITY=3D"*:city,region,cname,lat,lon"=20
> #=20
> #RALABEL_GEOIP_CITY=3D"saddr,daddr,inode:off,cont,lat,lon"=20
> #RALABEL_GEOIP_CITY_FILE=3D"/usr/local/share/GeoIP/GeoIP.dat"=20=
> =20
> =20
> =20
> - --Dave=20
> =20
> =20
> =20
> From: Kevin Branch <[email protected] =
<mailto:[email protected]> =
<mailto:[email protected] =
<mailto:[email protected]>> >=20
> Sent: Saturday, September 29, 2018 11:57 AM=20
> To: Carter Bullard <[email protected] =
<mailto:[email protected]> <mailto:[email protected] =
<mailto:[email protected]>> >=20
> Cc: David Edelman <[email protected] =
<mailto:[email protected]> <mailto:[email protected] =
<mailto:[email protected]>> >; Argus <[email protected] =
<mailto:[email protected]> =
<mailto:[email protected] =
<mailto:[email protected]>> >=20
> Subject: Re: [ARGUS] MaxMind GeoIP support in 3.0.8.2=20
> =20
> Hi Carter and David,=20
> =20
> I just tried the following with the same ralabel.conf as =
before:=20
> ra -r /argus/today/unt-01.arg -w - | ralabel -f =
/etc/ralabel.conf -r - -s label:200 -N20=20
> and saw this. Looks like I was using the wrong syntax which I =
am glad to know better now, but the GeoIP lookups are still not =
happening:
> "scity=3D:dcity=3D"=20
> "scity=3D:dcity=3D"=20
> "scity=3D:dcity=3D"=20
> "scity=3D:dcity=3D"=20
> "scity=3D:dcity=3D"=20
> "scity=3D:dcity=3D"=20
> "scity=3D:dcity=3D"=20
> "scity=3D:dcity=3D"=20
> "scity=3D:dcity=3D"=20
> "scity=3D:dcity=3D"=20
> "scity=3D:dcity=3D"=20
> "scity=3D:dcity=3D"=20
> =20
> I know the data file is good because it works with this:=20
> # geoiplookup -f /usr/local/share/GeoIP/GeoIPCity.dat =
207.48.48.19=20
> GeoIP City Edition, Rev 1: US, MO, Missouri, =
Chesterfield, 63017, 38.650002, -90.533401, 609, 314=20
> =20
> In case it helps, I rebuilt argus-clients with the .debug flag =
file present and then ran this command limited to only a single argus =
record that I independently confirmed has a srcip value known to =
geoiplookup
> # ra -r /argus/today/unt-01.arg -N1 -w - | ralabel -f =
/etc/ralabel.conf -r - -s label:50 -N200 -D3=20
> ralabel[44570.40b753ff8e7f0000]: 15:52:57.950161 =
ArgusNewLabeler (0x7f8eff3f7010, 0) returning 0x1b057c0=20
> ralabel[44570.40b753ff8e7f0000]: 15:52:57.959656 =
RaLabelParseResourceFile (/etc/ralabel.conf) returning 0=20
> ralabel[44570.40b753ff8e7f0000]: 15:52:57.959730 =
ArgusReadConnection() read 16 bytes=20
> ralabel[44570.40b753ff8e7f0000]: 15:52:57.959748 =
ArgusReadConnection() read 112 bytes=20
> ralabel[44570.40b753ff8e7f0000]: 15:52:57.961133 =
ArgusInitAddrtoname (0x7f8eff3f7010, 0xa9fe6700, 0xffffff00)=20
> ralabel[44570.40b753ff8e7f0000]: 15:52:57.961145 =
ArgusParseInit(0x7f8eff3f7010 0x7f8eff386010=20
> ralabel[44570.40b753ff8e7f0000]: 15:52:57.961155 =
ArgusReadConnection(0xff386010, 1) returning 1=20
> ralabel[44570.40b753ff8e7f0000]: 15:52:57.961329 =
ArgusAddToRecordLabel (0x7f8eff3f7010, 0x1b188c0, scity=3D:dcity=3D) =
returning 0
> Label=20
> scity=3D:dcity=3D=20=
> ralabel[44570.40b753ff8e7f0000]: 15:52:57.961385 =
ArgusCloseInput(0xff386010) closing=20
> ralabel[44570.40b753ff8e7f0000]: 15:52:57.961408 =
ArgusCloseInput(0xff386010) done=20
> ralabel[44570.40b753ff8e7f0000]: 15:52:57.961415 main: =
ArgusReadFileStream (-) done=20
> ralabel[44570.40b753ff8e7f0000]: 15:52:57.961426 main: =
reading files completed=20
> ralabel[44570.40b753ff8e7f0000]: 15:52:57.961432 =
ArgusShutDown (0)=20
> ralabel[44570.40b753ff8e7f0000]: 15:52:57.961439 =
RaParseComplete (0) returning=20
> ralabel[44570.40b753ff8e7f0000]: 15:52:57.961444 =
RaParseComplete(caught signal 0)=20
> [email protected] =
<mailto:[email protected]>:~/argus-clients-3.0.8# =
<mailto:[email protected]:~/argus-clients-3.0.8 =
<mailto:[email protected]:~/argus-clients-3.0.8>#> =
<mailto:[email protected]:~/argus-clients-3.0.8 =
<mailto:[email protected]:~/argus-clients-3.0.8>#> ra -r =
/argus/today/unt-01.arg -N1 -w - | ralabel -f /etc/ralabel.conf -r - -s =
label:50 -N200 -D8
> ralabel[4462.40472429a37f0000]: 15:53:24.374433 =
ArgusFree (0x26b2250)=20
> ralabel[4462.40472429a37f0000]: 15:53:24.374461 =
ArgusFree (0x26b22b0)=20
> ralabel[4462.40472429a37f0000]: 15:53:24.374469 =
ArgusFree (0x26b2310)=20
> ralabel[4462.40472429a37f0000]: 15:53:24.374474 =
ArgusFree (0x26b2370)=20
> ralabel[4462.40472429a37f0000]: 15:53:24.374479 =
ArgusFree (0x26b23d0)=20
> ralabel[4462.40472429a37f0000]: 15:53:24.374484 =
ArgusFree (0x26b2430)=20
> ralabel[4462.40472429a37f0000]: 15:53:24.374489 =
ArgusFree (0x26b2490)=20
> ralabel[4462.40472429a37f0000]: 15:53:24.374494 =
ArgusFree (0x26b24f0)=20
> ralabel[4462.40472429a37f0000]: 15:53:24.374499 =
ArgusFree (0x26b2550)=20
> ralabel[4462.40472429a37f0000]: 15:53:24.374504 =
ArgusFree (0x26b25b0)=20
> ralabel[4462.40472429a37f0000]: 15:53:24.374509 =
ArgusFree (0x26b2610)=20
> ralabel[4462.40472429a37f0000]: 15:53:24.374533 =
ArgusCalloc (1, 80) returning 0x26b2610=20
> ralabel[4462.40472429a37f0000]: 15:53:24.374544 =
ArgusCalloc (1, 296) returning 0x26b27c0=20
> ralabel[4462.40472429a37f0000]: 15:53:24.374566 =
ArgusCalloc (1, 112) returning 0x26b2950=20
> ralabel[4462.40472429a37f0000]: 15:53:24.374577 =
ArgusCalloc (1, 80) returning 0x26b25b0=20
> ralabel[4462.40472429a37f0000]: 15:53:24.374595 =
ArgusNewQueue () returning 0x26b25b0=20
> ralabel[4462.40472429a37f0000]: 15:53:24.374613 =
ArgusCalloc (65536, 8) returning 0x2849a010=20
> ralabel[4462.40472429a37f0000]: 15:53:24.374619 =
ArgusNewLabeler (0x7fa329100010, 0) returning 0x26b27c0=20
> ralabel[4462.40472429a37f0000]: 15:53:24.384352 =
RaLabelParseResourceFile (/etc/ralabel.conf) returning 0=20
> ralabel[4462.40472429a37f0000]: 15:53:24.384387 =
ArgusCalloc (1, 560) returning 0x26b2250=20
> ralabel[4462.40472429a37f0000]: 15:53:24.384411 =
ArgusCalloc (1, 112) returning 0x26b2e80=20
> ralabel[4462.40472429a37f0000]: 15:53:24.384418 =
ArgusCalloc (1, 80) returning 0x26b2f00=20
> ralabel[4462.40472429a37f0000]: 15:53:24.384424 =
ArgusNewQueue () returning 0x26b2f00=20
> ralabel[4462.40472429a37f0000]: 15:53:24.384430 =
ArgusCalloc (1, 56) returning 0x26b2f60=20
> ralabel[4462.40472429a37f0000]: 15:53:24.384454 =
ArgusCalloc (65536, 8) returning 0x27358010=20
> ralabel[4462.40472429a37f0000]: 15:53:24.384461 =
ArgusNewHashTable (65536) returning 0x26b2f60=20
> ralabel[4462.40472429a37f0000]: 15:53:24.384483 =
ArgusReadConnection() read 16 bytes=20
> ralabel[4462.40472429a37f0000]: 15:53:24.384498 =
ArgusReadConnection() read 112 bytes=20
> ralabel[4462.40472429a37f0000]: 15:53:24.384514 =
ArgusCalloc (1, 4194304) returning 0x26f57010=20
> ralabel[4462.40472429a37f0000]: 15:53:24.384523 =
ArgusCalloc (1, 262144) returning 0x26f16010=20
> ralabel[4462.40472429a37f0000]: 15:53:24.385934 =
ArgusInitAddrtoname (0x7fa329100010, 0xa9fe6700, 0xffffff00)=20
> ralabel[4462.40472429a37f0000]: 15:53:24.385947 =
ArgusParseInit(0x7fa329100010 0x7fa32908f010=20
> ralabel[4462.40472429a37f0000]: 15:53:24.385956 =
ArgusReadConnection(0x2908f010, 1) returning 1=20
> ralabel[4462.40472429a37f0000]: 15:53:24.385969 =
ArgusReadFileStream() starting=20
> ralabel[4462.40472429a37f0000]: 15:53:24.385981 =
ArgusReadStreamSocket (0x7fa32908f010) read 380 bytes=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386015 =
ArgusCalloc (1, 384) returning 0x26c58c0=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386025 =
ArgusCalloc (1, 12) returning 0x26c5a50=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386031 =
ArgusCalloc (1, 80) returning 0x26c5a70=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386037 =
ArgusCalloc (1, 36) returning 0x26c5ad0=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386042 =
ArgusCalloc (1, 52) returning 0x26c5b00=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386047 =
ArgusCalloc (1, 80) returning 0x26c5b40=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386053 =
ArgusCalloc (1, 120) returning 0x26c5ba0=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386058 =
ArgusCalloc (1, 8) returning 0x26c5c20=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386063 =
ArgusCalloc (1, 164) returning 0x26c5c40=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386070 =
ArgusCalloc (1, 20) returning 0x26c5cf0=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386075 =
ArgusCalloc (1, 20) returning 0x26c5d10=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386080 =
ArgusCalloc (1, 12) returning 0x26c5d30=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386092 =
ArgusCalloc (1, 16) returning 0x26c5d50=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386131 =
ArgusCalloc (1, 12) returning 0x26c5e80=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386234 =
ArgusAddToRecordLabel (0x7fa329100010, 0x26c58c0, scity=3D:dcity=3D) =
returning 0
> Label=20
> scity=3D:dcity=3D=20=
> ralabel[4462.40472429a37f0000]: 15:53:24.386280 =
ArgusFree (0x26c5a50)=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386287 =
ArgusFree (0x26c5a70)=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386292 =
ArgusFree (0x26c5ad0)=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386297 =
ArgusFree (0x26c5b00)=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386301 =
ArgusFree (0x26c5b40)=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386304 =
ArgusFree (0x26c5ba0)=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386308 =
ArgusFree (0x26c5c20)=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386312 =
ArgusFree (0x26c5c40)=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386316 =
ArgusFree (0x26c5cf0)=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386322 =
ArgusFree (0x26c5d10)=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386359 =
ArgusFree (0x26c5d30)=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386369 =
ArgusFree (0x26c5e80)=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386377 =
ArgusFree (0x26c5d50)=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386384 =
ArgusFree (0x26c58c0)=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386392 =
RaProcessRecord (0x2908f630) returning=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386400 =
RaScheduleRecord (0x7fa329100010, 0x7fa32908f630) scheduled=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386408 =
ArgusHandleRecord (0x7fa326f57010, 0x7fa329221800) returning 380
> ralabel[4462.40472429a37f0000]: 15:53:24.386417 =
ArgusReadStreamSocket (0x7fa32908f010) returning 0=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386432 =
ArgusReadStreamSocket (0x7fa32908f010) read 0 bytes=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386439 =
ArgusReadStreamSocket (0x7fa32908f010) returning 1=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386447 =
ArgusCloseInput(0x2908f010) closing=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386463 =
ArgusFree (0x7fa326f57010)=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386473 =
ArgusFree (0x7fa326f16010)=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386492 =
ArgusCloseInput(0x2908f010) done=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386500 =
ArgusReadFileStream() returning=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386508 main: =
ArgusReadFileStream (-) done=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386522 =
ArgusFree (0x7fa32908f010)=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386529 main: =
reading files completed=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386536 =
ArgusShutDown (0)=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386546 =
ArgusFree (0x26b2190)=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386553 =
ArgusDeleteQueue (0x26b2190) returning=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386561 =
ArgusFree (0x26b21f0)=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386569 =
ArgusDeleteQueue (0x26b21f0) returning=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386599 =
RaParseComplete (0) returning=20
> ralabel[4462.40472429a37f0000]: 15:53:24.386608 =
RaParseComplete(caught signal 0)=20
> =20
> Thanks for looking at this,=20
> Kevin=20
> =20
> =20
> On Sat, Sep 29, 2018 at 11:18 AM Carter Bullard =
<[email protected] <mailto:[email protected]> =
<mailto:[email protected] <mailto:[email protected]>> =
<mailto:[email protected] <mailto:[email protected]>> > wrote:=20
> Hey Kevin,=20
> Any success ???=20
> Carter=20
> <http://qosient.com/ <http://qosient.com/>>=20
> <http://qosient.com/ <http://qosient.com/>>=20
> Carter Bullard =E2=80=A2 CTO <http://qosient.com/ =
<http://qosient.com/>>=20
> 150 E 57th Street Suite 12D <http://qosient.com/ =
<http://qosient.com/>>=20
> New York, New York 10022-2795 <http://qosient.com/ =
<http://qosient.com/>>=20
> Phone +1.212.588.9133 =E2=80=A2 Mobile +1.917.497.9494 =
<http://qosient.com/ <http://qosient.com/>>=20
> =20
> On Sep 28, 2018, at 9:40 PM, David Edelman =
<[email protected] <mailto:[email protected]> =
<mailto:[email protected] <mailto:[email protected]>> > wrote: =
<http://qosient.com/ <http://qosient.com/>>=20
> -----BEGIN PGP SIGNED MESSAGE-----=20
> Hash: SHA1 <http://qosient.com/ =
<http://qosient.com/>>=20
> Please try this: <http://qosient.com/ =
<http://qosient.com/>>=20
> # ra -r /argus/today/unt-01.arg -w - | ralabel =
-f /etc/ralabel.conf -r - -s label:200 -N20 <http://qosient.com/ =
<http://qosient.com/>>=20
> <http://qosient.com/ <http://qosient.com/>>=20=
> From: Argus-info =
<[email protected] =
<mailto:[email protected]><mail=
to:[email protected] =
<mailto:[email protected]>> > On Behalf Of Kevin Branch=20
> Sent: Friday, September 28, 2018 5:25 PM=20
> To: Carter Bullard <[email protected] =
<mailto:[email protected]> <mailto:[email protected] =
<mailto:[email protected]>> >=20
> Cc: Argus <[email protected] =
<mailto:[email protected]> =
<mailto:[email protected] =
<mailto:[email protected]>> >=20
> Subject: Re: [ARGUS] MaxMind GeoIP support in =
3.0.8.2 <http://qosient.com/ <http://qosient.com/>>=20
> <http://qosient.com/ <http://qosient.com/>>=20=
> Looks like GeoIP is linked in already: =
<http://qosient.com/ <http://qosient.com/>>=20
> <http://qosient.com/ <http://qosient.com/>>=20=
> # ldd `which ralabel`=20
> linux-vdso.so.1 =3D> =
(0x00007ffddaf8a000)=20
> libm.so.6 =3D> =
/lib/x86_64-linux-gnu/libm.so.6 (0x00007f5fe67c9000)=20
> libpthread.so.0 =3D> =
/lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f5fe65ab000)=20
> libGeoIP.so.1 =3D> =
/usr/lib/x86_64-linux-gnu/libGeoIP.so.1 (0x00007f5fe637c000)=20
> libc.so.6 =3D> =
/lib/x86_64-linux-gnu/libc.so.6 (0x00007f5fe5fb3000)=20
> /lib64/ld-linux-x86-64.so.2 =
(0x00007f5fe6acf000) <http://qosient.com/ <http://qosient.com/>>=20
> <http://qosient.com/ <http://qosient.com/>>=20=
> I switched to just "lat,lon" like you =
suggested in ralabel.conf: <http://qosient.com/ <http://qosient.com/>>=20=
> <http://qosient.com/ <http://qosient.com/>>=20=
> # cat /etc/ralabel.conf <http://qosient.com/ =
<http://qosient.com/>>=20
> RALABEL_ARIN_COUNTRY_CODES=3Dno =
<http://qosient.com/ <http://qosient.com/>>=20
> <http://qosient.com/ =
<http://qosient.com/>>=20
> RALABEL_GEOIP_ASN=3Dyes =
<http://qosient.com/ <http://qosient.com/>>=20
> =
RALABEL_GEOIP_ASN_FILE=3D"/usr/local/share/GeoIP/GeoIPASNum.dat" =
<http://qosient.com/ <http://qosient.com/>>=20
> <http://qosient.com/ =
<http://qosient.com/>>=20
> RALABEL_GEOIP_CITY=3D"lat,lon" =
<http://qosient.com/ <http://qosient.com/>>=20
> =
RALABEL_GEOIP_CITY_FILE=3D"/usr/local/share/GeoIP/GeoIPCity.dat" =
<http://qosient.com/ <http://qosient.com/>>=20
> <http://qosient.com/ <http://qosient.com/>>=20=
> But I don't see anything but ASNs getting =
added in: <http://qosient.com/ <http://qosient.com/>>=20
> <http://qosient.com/ <http://qosient.com/>>=20=
> # ra -r /argus/today/unt-01.arg -w - | ralabel =
-f /etc/ralabel.conf -r - -s sas,das,scity,dcity,icity | head -n20 =
<http://qosient.com/ <http://qosient.com/>>=20
> sAS dAS <http://qosient.com/ =
<http://qosient.com/>>=20
> 4323 <http://qosient.com/ =
<http://qosient.com/>>=20
> 4323 <http://qosient.com/ =
<http://qosient.com/>>=20
> 4323 <http://qosient.com/ =
<http://qosient.com/>>=20
> 22927 4323 <http://qosient.com/ =
<http://qosient.com/>>=20
> 6582 4323 <http://qosient.com/ =
<http://qosient.com/>>=20
> 7018 4323 <http://qosient.com/ =
<http://qosient.com/>>=20
> 4323 3 <http://qosient.com/ =
<http://qosient.com/>>=20
> 4323 <http://qosient.com/ =
<http://qosient.com/>>=20
> 4323 15169 <http://qosient.com/ =
<http://qosient.com/>>=20
> 4323 <http://qosient.com/ =
<http://qosient.com/>>=20
> 4323 <http://qosient.com/ =
<http://qosient.com/>>=20
> 4323 15169 <http://qosient.com/ =
<http://qosient.com/>>=20
> 4323 21928 <http://qosient.com/ =
<http://qosient.com/>>=20
> 2828 4323 <http://qosient.com/ =
<http://qosient.com/>>=20
> <http://qosient.com/ <http://qosient.com/>>=20=
> Thoughts? <http://qosient.com/ =
<http://qosient.com/>>=20
> Kevin <http://qosient.com/ =
<http://qosient.com/>>=20
> <http://qosient.com/ <http://qosient.com/>>=20=
> On Fri, Sep 28, 2018 at 2:36 PM Carter Bullard =
<[email protected] <mailto:[email protected]> =
<mailto:[email protected] <mailto:[email protected]>> =
<mailto:[email protected] <mailto:[email protected]>> > wrote: =
<http://qosient.com/ <http://qosient.com/>>=20
> Hey Kevin, <http://qosient.com/ =
<http://qosient.com/>>=20
> If you do a ./configure =E2=80=94help =
you=E2=80=99ll see all the options that ./configure supports. If you =
specify =E2=80=94with-GeoIP it wants the directory where the GeoIP =
library is. <http://qosient.com/ <http://qosient.com/>>=20
> =E2=80=94with-GeoIP=3DDIR. compile =
with GeoIP in <dir> <http://qosient.com/ <http://qosient.com/>>=20
> <http://qosient.com/ =
<http://qosient.com/>>=20
> You can check if the library is bound =
to the client binaries with ldd =E2=80=A6 <http://qosient.com/ =
<http://qosient.com/>>=20
> ldd `which ralabel` =
<http://qosient.com/ <http://qosient.com/>>=20
> <http://qosient.com/ =
<http://qosient.com/>>=20
> If you=E2=80=99re already bound, the =
city stuff should work =E2=80=A6. I=E2=80=99m not familiar with =
=E2=80=9Creg,cco=E2=80=9D as GeoIP City objects off the top of my head. =
I=E2=80=99m familiar with =E2=80=9Coff,cont,lat,lon,region,city,cname=E2=80=
=9D. Maybe try lat,lon as a test, as I use that all the time .. =
<http://qosient.com/ <http://qosient.com/>>=20
> <http://qosient.com/ =
<http://qosient.com/>>=20
> Carter <http://qosient.com/ =
<http://qosient.com/>>=20
> =20
> <http://qosient.com/ =
<http://qosient.com/>>=20
> =20
> =20
> <http://qosient.com/ =
<http://qosient.com/>>=20
> On Sep 28, 2018, at 1:59 PM, =
Kevin Branch <[email protected] =
<mailto:[email protected]><mailto:[email protected]=
m <mailto:[email protected]>> =
<mailto:[email protected] =
<mailto:[email protected]>> > wrote: <http://qosient.com/ =
<http://qosient.com/>>=20
> <http://qosient.com/ =
<http://qosient.com/>>=20
> Hi Carter, =
<http://qosient.com/ <http://qosient.com/>>=20
> <http://qosient.com/ =
<http://qosient.com/>>=20
> I was just trying today to =
make ralabel on argus 3.0.8.2 do GeoIP labeling with GeoIPCity.dat, but =
even though the file referred to in ralabel.conf for that purpose =
exists, no GeoIP labeling takes place. ASN lookups work great, but =
ralabel never adds any scity or dcity fields. <http://qosient.com/ =
<http://qosient.com/>>=20
> <http://qosient.com/ =
<http://qosient.com/>>=20
> My ralabel.conf: =
<http://qosient.com/ <http://qosient.com/>>=20
> <http://qosient.com/ =
<http://qosient.com/>>=20
> =
RALABEL_ARIN_COUNTRY_CODES=3Dno <http://qosient.com/ =
<http://qosient.com/>>=20
> <http://qosient.com/ =
<http://qosient.com/>>=20
> RALABEL_GEOIP_ASN=3Dyes =
<http://qosient.com/ <http://qosient.com/>>=20
> =
RALABEL_GEOIP_ASN_FILE=3D"/usr/local/share/GeoIP/GeoIPASNum.dat" =
<http://qosient.com/ <http://qosient.com/>>=20
> <http://qosient.com/ =
<http://qosient.com/>>=20
> =
RALABEL_GEOIP_CITY=3D"reg,cco" <http://qosient.com/ =
<http://qosient.com/>>=20
> =
RALABEL_GEOIP_CITY_FILE=3D"/usr/local/share/GeoIP/GeoIPCity.dat" =
<http://qosient.com/ <http://qosient.com/>>=20
> <http://qosient.com/ =
<http://qosient.com/>>=20
> No errors are thrown by =
ralabel. I thought maybe I needed to specially compile in GeoIP support =
like I read about here: https://qosient.com/argus/geolocation.shtml =
<https://qosient.com/argus/geolocation.shtml> <http://qosient.com/ =
<http://qosient.com/>>=20
> but when I run "./configure =
--with-GeoIP=3Dyes" it throws this error: <http://qosient.com/ =
<http://qosient.com/>>=20
> configure: WARNING: =
unrecognized options: --with-GeoIP <http://qosient.com/ =
<http://qosient.com/>>=20
> However, I presume the fact =
that ASN lookups work means that MaxMind GeoIP support libraries are =
already installed, and presumably installed by default in the latest =
argus now. <http://qosient.com/ <http://qosient.com/>>=20
> <http://qosient.com/ =
<http://qosient.com/>>=20
> # ra -r =
/argus/today/unt-01.arg -w - | ralabel -f /etc/ralabel.conf -r - -s =
sas,das,scity,dcity,icity | head -n20 <http://qosient.com/ =
<http://qosient.com/>>=20
> sAS dAS =
<http://qosient.com/ <http://qosient.com/>>=20
> 4323 <http://qosient.com/ =
<http://qosient.com/>>=20
> 4323 <http://qosient.com/ =
<http://qosient.com/>>=20
> 4323 <http://qosient.com/ =
<http://qosient.com/>>=20
> 22927 4323 =
<http://qosient.com/ <http://qosient.com/>>=20
> 6582 4323 =
<http://qosient.com/ <http://qosient.com/>>=20
> 7018 4323 =
<http://qosient.com/ <http://qosient.com/>>=20
> 4323 3 =
<http://qosient.com/ <http://qosient.com/>>=20
> 4323 <http://qosient.com/ =
<http://qosient.com/>>=20
> 4323 15169 =
<http://qosient.com/ <http://qosient.com/>>=20
> 4323 <http://qosient.com/ =
<http://qosient.com/>>=20
> 4323 <http://qosient.com/ =
<http://qosient.com/>>=20
> 4323 15169 =
<http://qosient.com/ <http://qosient.com/>>=20
> 4323 21928 =
<http://qosient.com/ <http://qosient.com/>>=20
> 2828 4323 =
<http://qosient.com/ <http://qosient.com/>>=20
> <http://qosient.com/ =
<http://qosient.com/>>=20
> Any thoughts on what I am =
missing or how I might further debug this issue? <http://qosient.com/ =
<http://qosient.com/>>=20
> <http://qosient.com/ =
<http://qosient.com/>>=20
> Thanks! <http://qosient.com/ =
<http://qosient.com/>>=20
> Kevin <http://qosient.com/ =
<http://qosient.com/>>=20
> =20
> -----BEGIN PGP SIGNATURE----- =
<http://qosient.com/ <http://qosient.com/>>=20
> =
iF0EARECAB0WIQQP+UHquEepll566aqXCCyZOY1FIQUCW67X6gAKCRCXCCyZOY1F=20
> =
IdLwAKDv6tPpe7OwLBEEfM1YTnAD8MxZCgCeOlGEEuEIUvqlyIMh8CPBWctmBd0=3D=20
> =3Dp/tg=20
> -----END PGP SIGNATURE----- =
<http://qosient.com/ <http://qosient.com/>>=20
> -----BEGIN PGP SIGNATURE-----=20
> =
iF0EARECAB0WIQQP+UHquEepll566aqXCCyZOY1FIQUCW6/WuAAKCRCXCCyZOY1F=20
> =
IYGaAKDk/9QFqcgbEWN6bN9eMNitGAXU7ACfduIQKuGR7lsDTCkdRogye0u8TxM=3D=20
> =3DeoBH=20
> -----END PGP SIGNATURE-----=20
> -----BEGIN PGP SIGNATURE-----=20
> iF0EARECAB0WIQQP+UHquEepll566aqXCCyZOY1FIQUCW7DgxQAKCRCXCCyZOY1F=20
> IW8GAJ9tlHBAzoC4LAVWCw09qF4MfwuhOQCg7MxVBI5MKea4aax2551/gQ28mlE=3D=20
> =3DCZnI=20
> -----END PGP SIGNATURE-----=20
--Apple-Mail=_73326516-5DFB-4399-9A3E-9FDD46760874
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
charset=utf-8
<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; =
charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; =
-webkit-nbsp-mode: space; line-break: after-white-space;" class=3D"">Hey =
Kevin,<div class=3D"">Dave is right on the money, and great to see that =
you guys got it working !! </div><div class=3D""><br =
class=3D""></div><div class=3D"">You can search the label using regular =
expressions (pcre style regex if you compiled that library in) just as =
Dave indicates. You can use a simple regex like =E2=80=9CFL=E2=80=9D=
to get the flows that have anything to do with =E2=80=98FL=E2=80=99 and =
then do your own parsing to get exactly what you want, something =
like:</div><div class=3D""><br class=3D""></div><div class=3D""> =
ra -S localhost -M label=3D=E2=80=9CFL=E2=80=9D -s stime saddr =
daddr proto spkts dpkts label -c,</div><div class=3D""><br =
class=3D""></div><div class=3D"">And then process the label string to =
get your values, or you can regex and match the FL as a part of =
both the =E2=80=98scity=E2=80=99 and =E2=80=98dcity=E2=80=99 fields. =
Something like:</div><div class=3D""><br class=3D""></div><div =
class=3D""> -M label=3D=E2=80=9Cscity=3D.*FL.*dcity=3D.*FL=E2=
=80=9D</div><div class=3D""><br class=3D""></div><div class=3D"">In =
general, the labeler will put the scity, then the dcity values into the =
label in that order, and should put the values you specify on the line =
into the label, in the order given. But, because a previous =
labeler could have put scity and/or dcity values in the label before you =
put your values, you don=E2=80=99t know what the order of values maybe =
for scity or dcity. When there are multiple values, ralabel and =
radium have the ability to reorder values, so that it can deal with =
duplicate values. Daves regex will match if FL is just after the =
=E2=80=98=3D=E2=80=98 which will cover 95% of the scenarios. =
I have multiple labelers, radium is always putting lat,lon =
bounding boxes for IP addresses, so if I have something later putting in =
city codes, it may end up at the end of a list of other objects that =
apply to =E2=80=99scity=E2=80=99 or =E2=80=98dcity=E2=80=99. And =
of course, the =E2=80=99scity=E2=80=99 and =E2=80=98dcity=E2=80=99 may =
not be in that order =E2=80=A6 In this case the best regex may =
be:</div><div class=3D""><br class=3D""></div><div class=3D""> =
-M label=3D"(?=3D.*scity=3D.*FL)(?=3D.*dcity=3D.*FL)=E2=80=9D</div><=
div class=3D""><br class=3D""></div><div class=3D"">This matches =
scity=E2=80=A6FL and dcity=E2=80=A6FL regardless of the order in the =
label. May still need some tweaking, but hopefully you get the =
idea ...</div><div class=3D""><br class=3D""><div =
class=3D"">Carter</div><div class=3D""><br class=3D""><div><br =
class=3D""><blockquote type=3D"cite" class=3D""><div class=3D"">On Sep =
30, 2018, at 10:42 AM, David Edelman <<a =
href=3D"mailto:[email protected]" class=3D"">[email protected]</a>> =
wrote:</div><br class=3D"Apple-interchange-newline"><div class=3D""><div =
class=3D"WordSection1" style=3D"page: WordSection1; caret-color: rgb(0, =
0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; =
font-variant-caps: normal; font-weight: normal; letter-spacing: normal; =
text-align: start; text-indent: 0px; text-transform: none; white-space: =
normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; =
text-decoration: none;"><div class=3D"">-----BEGIN PGP SIGNED =
MESSAGE-----<span class=3D"Apple-converted-space"> </span><br =
class=3D"">Hash: SHA1<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div class=3D"">Use the ra command line flag -M =
label=3D=E2=80=99scity=3DFL.*dcity=3DFL=E2=80=99 I seem to =
remember that regular expressions work for this filter. Use the single =
quote to escape the *<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div class=3D""> <span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div class=3D"">If the regular expression =
doesn=E2=80=99t work let me know. You can=E2=80=99t use ragrep since =
that looks at theuser data portion of the flow, not the label =
metadata.<o:p class=3D""></o:p></div><div class=3D""> <span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div class=3D"">- --Dave<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div class=3D""> <span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div class=3D"">From: Kevin Branch <<a =
href=3D"mailto:[email protected]" style=3D"color: purple; =
text-decoration: underline;" =
class=3D"">[email protected]</a>><span =
class=3D"Apple-converted-space"> </span><br class=3D"">Sent: =
Saturday, September 29, 2018 11:14 PM<span =
class=3D"Apple-converted-space"> </span><br class=3D"">To: David =
Edelman <<a href=3D"mailto:[email protected]" style=3D"color: =
purple; text-decoration: underline;" =
class=3D"">[email protected]</a>><span =
class=3D"Apple-converted-space"> </span><br class=3D"">Cc: Carter =
Bullard <<a href=3D"mailto:[email protected]" style=3D"color: =
purple; text-decoration: underline;" =
class=3D"">[email protected]</a>>; Argus <<a =
href=3D"mailto:[email protected]" style=3D"color: purple; =
text-decoration: underline;" =
class=3D"">[email protected]</a>><span =
class=3D"Apple-converted-space"> </span><br class=3D"">Subject: Re: =
[ARGUS] MaxMind GeoIP support in 3.0.8.2<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div class=3D""> <span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div class=3D"">David, thanks! That was the =
missing piece.<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div class=3D""> <span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div class=3D"">I switched to<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div class=3D""> <span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D"">RALABEL_GEOIP_CITY=3D"saddr,daddr:region,cco"<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div class=3D""> <span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div class=3D"">and I saw what I wanted:<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div class=3D""> <span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div class=3D""># ra -r /argus/today/unt-01.arg =
-N1 -w - | ralabel -f /etc/ralabel.conf -r - -s label:30 -N20<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> &nb=
sp;  =
; Label<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
scity=3DFL,US:dcity=3DMO,US<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div class=3D""> <span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div class=3D"">All along I have been trying to =
label source and destination IPs with state,country like above. It =
took a fair bit of experimenting to get the state part figured out due =
to that field being referred to as "reg" in the ralabel.conf comment =
documentation while actually it has to be referenced as "region" to =
work.<o:p class=3D""></o:p></div><div class=3D""> <span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div class=3D"">Now for my hopefully last =
question: How can I have ra use that label content as search =
criteria? I am trying to use ra to count up total traffic volume =
seen where the source and destination IP are both in Florida. I =
suspect ra will not let me use label, scity or dcity values as filter =
criteria. Can ragrep help here? Or will I have to go the =
rasqlinsert route to accomplish this?<o:p class=3D""></o:p></div><div =
class=3D""> <span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div class=3D"">Thanks,<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div class=3D"">Kevin<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div class=3D""> <span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div class=3D""> <span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div class=3D"">On Sat, Sep 29, 2018 at 3:47 PM =
David Edelman <<a href=3D"mailto:[email protected]" style=3D"color: =
purple; text-decoration: underline;" =
class=3D"">[email protected]</a><span =
class=3D"Apple-converted-space"> </span><<a =
href=3D"mailto:[email protected]" style=3D"color: purple; =
text-decoration: underline;" class=3D"">mailto:[email protected]</a>> =
> wrote:<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> -----BEGIN PGP =
SIGNED MESSAGE-----<span class=3D"Apple-converted-space"> </span><br =
class=3D""> Hash: SHA1<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> It looks like we =
are almost there, you need to indicate which addresses need to have the =
labels associated<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> Please change this =
in your configuration file<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> <span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> <span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
RALABEL_GEOIP_CITY=3D"saddr,daddr:city "<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> <span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> This information =
might help Looking at the code, the netmask is not functional<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> <span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> #<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
# Data for city relevant data is enabled through =
enabling and configuring<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
# the city database support. The types of data =
available are:<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
# country_code, country_code3, =
country_name, region, city, postal_code,<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
# latitude, longitude, metro_code, =
area_code and continent_code.<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
# time_offset is also =
available.<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> #<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
# The concept is that you should be able to add =
semantics for any<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
# IP address that is in the argus record. =
Support addresses are:<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> #<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
# saddr, daddr, inode<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> #<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
# The labels provided will be tagged as:<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
# scity, dcity, icity<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> #<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
# To configure what you want to have placed in the =
label, use the list of<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
# objects, in whatever order you like, as the =
RALABEL_GEOPIP_CITY string<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
# using these keywords:<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
# cco - =
country_code<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
# cco3 - country_code3<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
# cname - country_name<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
# reg - region<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
# city - city<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
# pcode - postal_code<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
# lat - latitude<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
# long - longitude<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
# metro - metro_code<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
# area - area_code<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
# cont - continent_code<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
# netmask - netmask value<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> #<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
# Working examples could be:<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
# =
RALABEL_GEOIP_CITY=3D"saddr,daddr:lat/lon"<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
# =
RALABEL_GEOIP_CITY=3D"*:city,region,cname,lat,lon"<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> #<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
#RALABEL_GEOIP_CITY=3D"saddr,daddr,inode:off,cont,lat,lon"<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
#RALABEL_GEOIP_CITY_FILE=3D"/usr/local/share/GeoIP/GeoIP.dat"<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> <span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> <span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> <span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> - --Dave<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> <span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> <span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> <span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> From: Kevin Branch =
<<a href=3D"mailto:[email protected]" style=3D"color: =
purple; text-decoration: underline;" =
class=3D"">[email protected]</a><span =
class=3D"Apple-converted-space"> </span><<a =
href=3D"mailto:[email protected]" style=3D"color: purple; =
text-decoration: underline;" =
class=3D"">mailto:[email protected]</a>> ><span =
class=3D"Apple-converted-space"> </span><br =
class=3D""> Sent: Saturday, =
September 29, 2018 11:57 AM<span =
class=3D"Apple-converted-space"> </span><br =
class=3D""> To: Carter Bullard =
<<a href=3D"mailto:[email protected]" style=3D"color: purple; =
text-decoration: underline;" class=3D"">[email protected]</a><span =
class=3D"Apple-converted-space"> </span><<a =
href=3D"mailto:[email protected]" style=3D"color: purple; =
text-decoration: underline;" class=3D"">mailto:[email protected]</a>> =
><span class=3D"Apple-converted-space"> </span><br =
class=3D""> Cc: David Edelman =
<<a href=3D"mailto:[email protected]" style=3D"color: purple; =
text-decoration: underline;" class=3D"">[email protected]</a><span =
class=3D"Apple-converted-space"> </span><<a =
href=3D"mailto:[email protected]" style=3D"color: purple; =
text-decoration: underline;" class=3D"">mailto:[email protected]</a>> =
>; Argus <<a href=3D"mailto:[email protected]" =
style=3D"color: purple; text-decoration: underline;" =
class=3D"">[email protected]</a><span =
class=3D"Apple-converted-space"> </span><<a =
href=3D"mailto:[email protected]" style=3D"color: purple; =
text-decoration: underline;" =
class=3D"">mailto:[email protected]</a>> ><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> Subject: Re: =
[ARGUS] MaxMind GeoIP support in 3.0.8.2<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> <span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> Hi Carter and =
David,<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> <span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> I just tried the =
following with the same ralabel.conf as before:<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
ra -r /argus/today/unt-01.arg =
-w - | ralabel -f /etc/ralabel.conf -r - -s label:200 -N20<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> and saw =
this. Looks like I was using the wrong syntax which I am glad to =
know better now, but the GeoIP lookups are still not happening:<o:p =
class=3D""></o:p></div><div =
class=3D""> =
"scity=3D:dcity=3D"<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
"scity=3D:dcity=3D"<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
"scity=3D:dcity=3D"<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
"scity=3D:dcity=3D"<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
"scity=3D:dcity=3D"<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
"scity=3D:dcity=3D"<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
"scity=3D:dcity=3D"<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
"scity=3D:dcity=3D"<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
"scity=3D:dcity=3D"<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
"scity=3D:dcity=3D"<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
"scity=3D:dcity=3D"<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
"scity=3D:dcity=3D"<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> <span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> I know the data =
file is good because it works with this:<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
# geoiplookup -f =
/usr/local/share/GeoIP/GeoIPCity.dat 207.48.48.19<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
GeoIP City Edition, Rev 1: =
US, MO, Missouri, Chesterfield, 63017, 38.650002, -90.533401, 609, =
314<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> In case it helps, =
I rebuilt argus-clients with the .debug flag file present and then ran =
this command limited to only a single argus record that I independently =
confirmed has a srcip value known to geoiplookup<o:p =
class=3D""></o:p></div><div =
class=3D""> =
# ra -r =
/argus/today/unt-01.arg -N1 -w - | ralabel -f /etc/ralabel.conf -r - -s =
label:50 -N200 -D3<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[44570.40b753ff8e7f0000]: 15:52:57.950161 ArgusNewLabeler =
(0x7f8eff3f7010, 0) returning 0x1b057c0<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[44570.40b753ff8e7f0000]: 15:52:57.959656 =
RaLabelParseResourceFile (/etc/ralabel.conf) returning 0<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[44570.40b753ff8e7f0000]: 15:52:57.959730 ArgusReadConnection() =
read 16 bytes<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[44570.40b753ff8e7f0000]: 15:52:57.959748 ArgusReadConnection() =
read 112 bytes<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[44570.40b753ff8e7f0000]: 15:52:57.961133 ArgusInitAddrtoname =
(0x7f8eff3f7010, 0xa9fe6700, 0xffffff00)<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[44570.40b753ff8e7f0000]: 15:52:57.961145 =
ArgusParseInit(0x7f8eff3f7010 0x7f8eff386010<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[44570.40b753ff8e7f0000]: 15:52:57.961155 =
ArgusReadConnection(0xff386010, 1) returning 1<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[44570.40b753ff8e7f0000]: 15:52:57.961329 ArgusAddToRecordLabel =
(0x7f8eff3f7010, 0x1b188c0, scity=3D:dcity=3D) returning 0<o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; =
&n=
bsp; Label<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; =
scity=3D:dcity=3D<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[44570.40b753ff8e7f0000]: 15:52:57.961385 =
ArgusCloseInput(0xff386010) closing<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[44570.40b753ff8e7f0000]: 15:52:57.961408 =
ArgusCloseInput(0xff386010) done<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[44570.40b753ff8e7f0000]: 15:52:57.961415 main: =
ArgusReadFileStream (-) done<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[44570.40b753ff8e7f0000]: 15:52:57.961426 main: reading files =
completed<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[44570.40b753ff8e7f0000]: 15:52:57.961432 ArgusShutDown (0)<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[44570.40b753ff8e7f0000]: 15:52:57.961439 RaParseComplete (0) =
returning<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[44570.40b753ff8e7f0000]: 15:52:57.961444 RaParseComplete(caught =
signal 0)<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
<span =
class=3D"Apple-converted-space"> </span><a =
href=3D"mailto:[email protected]" style=3D"color: purple; =
text-decoration: underline;" =
class=3D"">[email protected]</a>:~/argus-clients-3.0.8# <<a =
href=3D"mailto:[email protected]:~/argus-clients-3.0.8" =
style=3D"color: purple; text-decoration: underline;" =
class=3D"">mailto:[email protected]:~/argus-clients-3.0.8</a>#>&nbs=
p; <<a href=3D"mailto:[email protected]:~/argus-clients-3.0.8" =
style=3D"color: purple; text-decoration: underline;" =
class=3D"">mailto:[email protected]:~/argus-clients-3.0.8</a>#>&nbs=
p; ra -r /argus/today/unt-01.arg -N1 -w - | ralabel -f /etc/ralabel.conf =
-r - -s label:50 -N200 -D8<o:p class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.374433 ArgusFree =
(0x26b2250)<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.374461 ArgusFree =
(0x26b22b0)<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.374469 ArgusFree =
(0x26b2310)<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.374474 ArgusFree =
(0x26b2370)<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.374479 ArgusFree =
(0x26b23d0)<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.374484 ArgusFree =
(0x26b2430)<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.374489 ArgusFree =
(0x26b2490)<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.374494 ArgusFree =
(0x26b24f0)<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.374499 ArgusFree =
(0x26b2550)<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.374504 ArgusFree =
(0x26b25b0)<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.374509 ArgusFree =
(0x26b2610)<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.374533 ArgusCalloc (1, 80) =
returning 0x26b2610<span class=3D"Apple-converted-space"> </span><o:p=
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.374544 ArgusCalloc (1, 296) =
returning 0x26b27c0<span class=3D"Apple-converted-space"> </span><o:p=
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.374566 ArgusCalloc (1, 112) =
returning 0x26b2950<span class=3D"Apple-converted-space"> </span><o:p=
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.374577 ArgusCalloc (1, 80) =
returning 0x26b25b0<span class=3D"Apple-converted-space"> </span><o:p=
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.374595 ArgusNewQueue () =
returning 0x26b25b0<span class=3D"Apple-converted-space"> </span><o:p=
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.374613 ArgusCalloc (65536, 8) =
returning 0x2849a010<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.374619 ArgusNewLabeler =
(0x7fa329100010, 0) returning 0x26b27c0<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.384352 RaLabelParseResourceFile =
(/etc/ralabel.conf) returning 0<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.384387 ArgusCalloc (1, 560) =
returning 0x26b2250<span class=3D"Apple-converted-space"> </span><o:p=
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.384411 ArgusCalloc (1, 112) =
returning 0x26b2e80<span class=3D"Apple-converted-space"> </span><o:p=
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.384418 ArgusCalloc (1, 80) =
returning 0x26b2f00<span class=3D"Apple-converted-space"> </span><o:p=
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.384424 ArgusNewQueue () =
returning 0x26b2f00<span class=3D"Apple-converted-space"> </span><o:p=
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.384430 ArgusCalloc (1, 56) =
returning 0x26b2f60<span class=3D"Apple-converted-space"> </span><o:p=
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.384454 ArgusCalloc (65536, 8) =
returning 0x27358010<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.384461 ArgusNewHashTable =
(65536) returning 0x26b2f60<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.384483 ArgusReadConnection() =
read 16 bytes<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.384498 ArgusReadConnection() =
read 112 bytes<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.384514 ArgusCalloc (1, 4194304) =
returning 0x26f57010<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.384523 ArgusCalloc (1, 262144) =
returning 0x26f16010<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.385934 ArgusInitAddrtoname =
(0x7fa329100010, 0xa9fe6700, 0xffffff00)<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.385947 =
ArgusParseInit(0x7fa329100010 0x7fa32908f010<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.385956 =
ArgusReadConnection(0x2908f010, 1) returning 1<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.385969 ArgusReadFileStream() =
starting<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.385981 ArgusReadStreamSocket =
(0x7fa32908f010) read 380 bytes<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386015 ArgusCalloc (1, 384) =
returning 0x26c58c0<span class=3D"Apple-converted-space"> </span><o:p=
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386025 ArgusCalloc (1, 12) =
returning 0x26c5a50<span class=3D"Apple-converted-space"> </span><o:p=
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386031 ArgusCalloc (1, 80) =
returning 0x26c5a70<span class=3D"Apple-converted-space"> </span><o:p=
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386037 ArgusCalloc (1, 36) =
returning 0x26c5ad0<span class=3D"Apple-converted-space"> </span><o:p=
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386042 ArgusCalloc (1, 52) =
returning 0x26c5b00<span class=3D"Apple-converted-space"> </span><o:p=
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386047 ArgusCalloc (1, 80) =
returning 0x26c5b40<span class=3D"Apple-converted-space"> </span><o:p=
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386053 ArgusCalloc (1, 120) =
returning 0x26c5ba0<span class=3D"Apple-converted-space"> </span><o:p=
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386058 ArgusCalloc (1, 8) =
returning 0x26c5c20<span class=3D"Apple-converted-space"> </span><o:p=
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386063 ArgusCalloc (1, 164) =
returning 0x26c5c40<span class=3D"Apple-converted-space"> </span><o:p=
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386070 ArgusCalloc (1, 20) =
returning 0x26c5cf0<span class=3D"Apple-converted-space"> </span><o:p=
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386075 ArgusCalloc (1, 20) =
returning 0x26c5d10<span class=3D"Apple-converted-space"> </span><o:p=
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386080 ArgusCalloc (1, 12) =
returning 0x26c5d30<span class=3D"Apple-converted-space"> </span><o:p=
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386092 ArgusCalloc (1, 16) =
returning 0x26c5d50<span class=3D"Apple-converted-space"> </span><o:p=
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386131 ArgusCalloc (1, 12) =
returning 0x26c5e80<span class=3D"Apple-converted-space"> </span><o:p=
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386234 ArgusAddToRecordLabel =
(0x7fa329100010, 0x26c58c0, scity=3D:dcity=3D) returning 0<o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; =
&n=
bsp; Label<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; =
scity=3D:dcity=3D<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386280 ArgusFree =
(0x26c5a50)<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386287 ArgusFree =
(0x26c5a70)<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386292 ArgusFree =
(0x26c5ad0)<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386297 ArgusFree =
(0x26c5b00)<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386301 ArgusFree =
(0x26c5b40)<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386304 ArgusFree =
(0x26c5ba0)<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386308 ArgusFree =
(0x26c5c20)<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386312 ArgusFree =
(0x26c5c40)<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386316 ArgusFree =
(0x26c5cf0)<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386322 ArgusFree =
(0x26c5d10)<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386359 ArgusFree =
(0x26c5d30)<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386369 ArgusFree =
(0x26c5e80)<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386377 ArgusFree =
(0x26c5d50)<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386384 ArgusFree =
(0x26c58c0)<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386392 RaProcessRecord =
(0x2908f630) returning<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386400 RaScheduleRecord =
(0x7fa329100010, 0x7fa32908f630) scheduled<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386408 ArgusHandleRecord =
(0x7fa326f57010, 0x7fa329221800) returning 380<o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386417 ArgusReadStreamSocket =
(0x7fa32908f010) returning 0<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386432 ArgusReadStreamSocket =
(0x7fa32908f010) read 0 bytes<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386439 ArgusReadStreamSocket =
(0x7fa32908f010) returning 1<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386447 =
ArgusCloseInput(0x2908f010) closing<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386463 ArgusFree =
(0x7fa326f57010)<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386473 ArgusFree =
(0x7fa326f16010)<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386492 =
ArgusCloseInput(0x2908f010) done<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386500 ArgusReadFileStream() =
returning<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386508 main: =
ArgusReadFileStream (-) done<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386522 ArgusFree =
(0x7fa32908f010)<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386529 main: reading files =
completed<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386536 ArgusShutDown (0)<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386546 ArgusFree =
(0x26b2190)<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386553 ArgusDeleteQueue =
(0x26b2190) returning<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386561 ArgusFree =
(0x26b21f0)<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386569 ArgusDeleteQueue =
(0x26b21f0) returning<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386599 RaParseComplete (0) =
returning<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
=
ralabel[4462.40472429a37f0000]: 15:53:24.386608 RaParseComplete(caught =
signal 0)<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> Thanks for looking =
at this,<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> Kevin<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> <span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> <span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> On Sat, Sep 29, =
2018 at 11:18 AM Carter Bullard <<a href=3D"mailto:[email protected]" =
style=3D"color: purple; text-decoration: underline;" =
class=3D"">[email protected]</a><span =
class=3D"Apple-converted-space"> </span><<a =
href=3D"mailto:[email protected]" style=3D"color: purple; =
text-decoration: underline;" =
class=3D"">mailto:[email protected]</a>> <<a =
href=3D"mailto:[email protected]" style=3D"color: purple; =
text-decoration: underline;" class=3D"">mailto:[email protected]</a>> =
> wrote:<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
Hey Kevin,<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
Any success ???<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
Carter<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> Carter Bullard =E2=80=
=A2 CTO <<a href=3D"http://qosient.com/" style=3D"color: purple; =
text-decoration: underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> 150 E 57th Street =
Suite 12D <<a href=3D"http://qosient.com/" style=3D"color: purple; =
text-decoration: underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> New York, New York =
10022-2795 <<a href=3D"http://qosient.com/" style=3D"color: purple; =
text-decoration: underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> Phone =
+1.212.588.9133 =E2=80=A2 Mobile +1.917.497.9494 <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
<span =
class=3D"Apple-converted-space"> </span><br =
class=3D""> =
On Sep 28, 2018, at 9:40 PM, =
David Edelman <<a href=3D"mailto:[email protected]" style=3D"color: =
purple; text-decoration: underline;" =
class=3D"">[email protected]</a><span =
class=3D"Apple-converted-space"> </span><<a =
href=3D"mailto:[email protected]" style=3D"color: purple; =
text-decoration: underline;" class=3D"">mailto:[email protected]</a>> =
> wrote: <<a href=3D"http://qosient.com/" style=3D"color: purple; =
text-decoration: underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; -----BEGIN PGP SIGNED MESSAGE-----<span =
class=3D"Apple-converted-space"> </span><br =
class=3D""> =
&n=
bsp; Hash: SHA1 <<a href=3D"http://qosient.com/" =
style=3D"color: purple; text-decoration: underline;" =
class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; Please try this: <<a href=3D"http://qosient.com/" =
style=3D"color: purple; text-decoration: underline;" =
class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; # ra -r /argus/today/unt-01.arg -w - | ralabel -f =
/etc/ralabel.conf -r - -s label:200 -N20 <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; <<a href=3D"http://qosient.com/" =
style=3D"color: purple; text-decoration: underline;" =
class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; From: Argus-info <<a =
href=3D"mailto:[email protected]=
u" style=3D"color: purple; text-decoration: underline;" =
class=3D"">[email protected]</a=
><<a href=3D"mailto:[email protected]" style=3D"color: =
purple; text-decoration: underline;" =
class=3D"">mailto:[email protected]</a>> > On Behalf =
Of Kevin Branch<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; Sent: Friday, September 28, 2018 5:25 PM<span =
class=3D"Apple-converted-space"> </span><br =
class=3D""> =
&n=
bsp; To: Carter Bullard <<a =
href=3D"mailto:[email protected]" style=3D"color: purple; =
text-decoration: underline;" class=3D"">[email protected]</a><span =
class=3D"Apple-converted-space"> </span><<a =
href=3D"mailto:[email protected]" style=3D"color: purple; =
text-decoration: underline;" class=3D"">mailto:[email protected]</a>> =
><span class=3D"Apple-converted-space"> </span><br =
class=3D""> =
&n=
bsp; Cc: Argus <<a =
href=3D"mailto:[email protected]" style=3D"color: purple; =
text-decoration: underline;" =
class=3D"">[email protected]</a><span =
class=3D"Apple-converted-space"> </span><<a =
href=3D"mailto:[email protected]" style=3D"color: purple; =
text-decoration: underline;" =
class=3D"">mailto:[email protected]</a>> ><span =
class=3D"Apple-converted-space"> </span><br =
class=3D""> =
&n=
bsp; Subject: Re: [ARGUS] MaxMind GeoIP support in 3.0.8.2 =
<<a href=3D"http://qosient.com/" style=3D"color: purple; =
text-decoration: underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; <<a href=3D"http://qosient.com/" =
style=3D"color: purple; text-decoration: underline;" =
class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; Looks like GeoIP is linked in already: <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; <<a href=3D"http://qosient.com/" =
style=3D"color: purple; text-decoration: underline;" =
class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; # ldd `which ralabel`<span =
class=3D"Apple-converted-space"> </span><br =
class=3D""> =
&n=
bsp; =
linux-vdso.so.1 =3D> (0x00007ffddaf8a000)<span =
class=3D"Apple-converted-space"> </span><br =
class=3D""> =
&n=
bsp; =
libm.so.6 =3D> /lib/x86_64-linux-gnu/libm.so.6 =
(0x00007f5fe67c9000)<span class=3D"Apple-converted-space"> </span><br=
class=3D""> =
&n=
bsp; =
libpthread.so.0 =3D> /lib/x86_64-linux-gnu/libpthread.so.0 =
(0x00007f5fe65ab000)<span class=3D"Apple-converted-space"> </span><br=
class=3D""> =
&n=
bsp; =
libGeoIP.so.1 =3D> /usr/lib/x86_64-linux-gnu/libGeoIP.so.1 =
(0x00007f5fe637c000)<span class=3D"Apple-converted-space"> </span><br=
class=3D""> =
&n=
bsp; =
libc.so.6 =3D> /lib/x86_64-linux-gnu/libc.so.6 =
(0x00007f5fe5fb3000)<span class=3D"Apple-converted-space"> </span><br=
class=3D""> =
&n=
bsp; =
/lib64/ld-linux-x86-64.so.2 (0x00007f5fe6acf000) <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; <<a href=3D"http://qosient.com/" =
style=3D"color: purple; text-decoration: underline;" =
class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; I switched to just "lat,lon" like you suggested in =
ralabel.conf: <<a href=3D"http://qosient.com/" style=3D"color: =
purple; text-decoration: underline;" =
class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; <<a href=3D"http://qosient.com/" =
style=3D"color: purple; text-decoration: underline;" =
class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; # cat /etc/ralabel.conf <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; =
RALABEL_ARIN_COUNTRY_CODES=3Dno <<a href=3D"http://qosient.com/" =
style=3D"color: purple; text-decoration: underline;" =
class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; =
<<a href=3D"http://qosient.com/" style=3D"color: purple; =
text-decoration: underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; =
RALABEL_GEOIP_ASN=3Dyes <<a href=3D"http://qosient.com/" =
style=3D"color: purple; text-decoration: underline;" =
class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; =
RALABEL_GEOIP_ASN_FILE=3D"/usr/local/share/GeoIP/GeoIPASNum.dat" <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; =
<<a href=3D"http://qosient.com/" style=3D"color: purple; =
text-decoration: underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; =
RALABEL_GEOIP_CITY=3D"lat,lon" <<a href=3D"http://qosient.com/" =
style=3D"color: purple; text-decoration: underline;" =
class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; =
RALABEL_GEOIP_CITY_FILE=3D"/usr/local/share/GeoIP/GeoIPCity.dat" <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; <<a href=3D"http://qosient.com/" =
style=3D"color: purple; text-decoration: underline;" =
class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; But I don't see anything but ASNs getting added in: =
<<a href=3D"http://qosient.com/" style=3D"color: purple; =
text-decoration: underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; <<a href=3D"http://qosient.com/" =
style=3D"color: purple; text-decoration: underline;" =
class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; # ra -r /argus/today/unt-01.arg -w - | ralabel -f =
/etc/ralabel.conf -r - -s sas,das,scity,dcity,icity | head -n20 <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; sAS dAS <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; 4323 <<a href=3D"http://qosient.com/" =
style=3D"color: purple; text-decoration: underline;" =
class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; 4323 <<a href=3D"http://qosient.com/" =
style=3D"color: purple; text-decoration: underline;" =
class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; 4323 <<a href=3D"http://qosient.com/" =
style=3D"color: purple; text-decoration: underline;" =
class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; 22927 4323 <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; 6582 4323 <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; 7018 4323 <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; 4323 3 <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; 4323 <<a href=3D"http://qosient.com/" =
style=3D"color: purple; text-decoration: underline;" =
class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; 4323 15169 <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; 4323 <<a href=3D"http://qosient.com/" =
style=3D"color: purple; text-decoration: underline;" =
class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; 4323 <<a href=3D"http://qosient.com/" =
style=3D"color: purple; text-decoration: underline;" =
class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; 4323 15169 <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; 4323 21928 <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; 2828 4323 <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; <<a href=3D"http://qosient.com/" =
style=3D"color: purple; text-decoration: underline;" =
class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; Thoughts? <<a href=3D"http://qosient.com/" =
style=3D"color: purple; text-decoration: underline;" =
class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; Kevin <<a href=3D"http://qosient.com/" style=3D"color:=
purple; text-decoration: underline;" =
class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; <<a href=3D"http://qosient.com/" =
style=3D"color: purple; text-decoration: underline;" =
class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; On Fri, Sep 28, 2018 at 2:36 PM Carter Bullard <<a =
href=3D"mailto:[email protected]" style=3D"color: purple; =
text-decoration: underline;" class=3D"">[email protected]</a><span =
class=3D"Apple-converted-space"> </span><<a =
href=3D"mailto:[email protected]" style=3D"color: purple; =
text-decoration: underline;" =
class=3D"">mailto:[email protected]</a>> <<a =
href=3D"mailto:[email protected]" style=3D"color: purple; =
text-decoration: underline;" class=3D"">mailto:[email protected]</a>> =
> wrote: <<a href=3D"http://qosient.com/" style=3D"color: purple; =
text-decoration: underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; Hey =
Kevin, <<a href=3D"http://qosient.com/" style=3D"color: purple; =
text-decoration: underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; If you =
do a ./configure =E2=80=94help you=E2=80=99ll see all the options that =
./configure supports. If you specify =E2=80=94with-GeoIP it wants =
the directory where the GeoIP library is. <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; =E2=80=94with-GeoIP=3DDIR. compile with GeoIP in <dir> <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; =
<<a href=3D"http://qosient.com/" style=3D"color: purple; =
text-decoration: underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; You can =
check if the library is bound to the client binaries with ldd =E2=80=A6 =
<<a href=3D"http://qosient.com/" style=3D"color: purple; =
text-decoration: underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; ldd `which ralabel` <<a href=3D"http://qosient.com/" =
style=3D"color: purple; text-decoration: underline;" =
class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; =
<<a href=3D"http://qosient.com/" style=3D"color: purple; =
text-decoration: underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; If =
you=E2=80=99re already bound, the city stuff should work =E2=80=A6. =
I=E2=80=99m not familiar with =E2=80=9Creg,cco=E2=80=9D as GeoIP City =
objects off the top of my head. I=E2=80=99m familiar with =
=E2=80=9Coff,cont,lat,lon,region,city,cname=E2=80=9D. Maybe try =
lat,lon as a test, as I use that all the time .. <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; =
<<a href=3D"http://qosient.com/" style=3D"color: purple; =
text-decoration: underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; Carter =
<<a href=3D"http://qosient.com/" style=3D"color: purple; =
text-decoration: underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; <span =
class=3D"Apple-converted-space"> </span><br =
class=3D""> =
&n=
bsp; &nbs=
p; <<a href=3D"http://qosient.com/" style=3D"color: purple; =
text-decoration: underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; <span =
class=3D"Apple-converted-space"> </span><br =
class=3D""> =
&n=
bsp; <span =
class=3D"Apple-converted-space"> </span><br =
class=3D""> =
&n=
bsp; <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; On Sep 28, 2018, at 1:59 PM, =
Kevin Branch <<a href=3D"mailto:[email protected]" =
style=3D"color: purple; text-decoration: underline;" =
class=3D"">[email protected]</a><<a =
href=3D"mailto:[email protected]" style=3D"color: purple; =
text-decoration: underline;" =
class=3D"">mailto:[email protected]</a>> <<a =
href=3D"mailto:[email protected]" style=3D"color: purple; =
text-decoration: underline;" =
class=3D"">mailto:[email protected]</a>> > wrote: =
<<a href=3D"http://qosient.com/" style=3D"color: purple; =
text-decoration: underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; Hi Carter, <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; I was just trying today to make =
ralabel on argus 3.0.8.2 do GeoIP labeling with GeoIPCity.dat, but even =
though the file referred to in ralabel.conf for that purpose exists, no =
GeoIP labeling takes place. ASN lookups work great, =
but ralabel never adds any scity or dcity fields. <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; My ralabel.conf: <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; =
RALABEL_ARIN_COUNTRY_CODES=3Dno <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; =
<<a href=3D"http://qosient.com/" style=3D"color: =
purple; text-decoration: underline;" =
class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; =
RALABEL_GEOIP_ASN=3Dyes <<a href=3D"http://qosient.com/" =
style=3D"color: purple; text-decoration: underline;" =
class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; =
=
RALABEL_GEOIP_ASN_FILE=3D"/usr/local/share/GeoIP/GeoIPASNum.dat" <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; =
<<a href=3D"http://qosient.com/" style=3D"color: =
purple; text-decoration: underline;" =
class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; =
RALABEL_GEOIP_CITY=3D"reg,cco" <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; =
=
RALABEL_GEOIP_CITY_FILE=3D"/usr/local/share/GeoIP/GeoIPCity.dat" <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; No errors are thrown by =
ralabel. I thought maybe I needed to specially compile in GeoIP =
support like I read about here: <span =
class=3D"Apple-converted-space"> </span><a =
href=3D"https://qosient.com/argus/geolocation.shtml" style=3D"color: =
purple; text-decoration: underline;" =
class=3D"">https://qosient.com/argus/geolocation.shtml</a><span =
class=3D"Apple-converted-space"> </span><<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; but when I run "./configure =
--with-GeoIP=3Dyes" it throws this error: <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; =
configure: WARNING: unrecognized options: --with-GeoIP =
<<a href=3D"http://qosient.com/" style=3D"color: purple; =
text-decoration: underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; However, I presume the fact that =
ASN lookups work means that MaxMind GeoIP support libraries are already =
installed, and presumably installed by default in the latest argus now. =
<<a href=3D"http://qosient.com/" style=3D"color: purple; =
text-decoration: underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; # ra -r /argus/today/unt-01.arg =
-w - | ralabel -f /etc/ralabel.conf -r - -s sas,das,scity,dcity,icity | =
head -n20 <<a href=3D"http://qosient.com/" style=3D"color: purple; =
text-decoration: underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; =
sAS dAS <<a href=3D"http://qosient.com/" =
style=3D"color: purple; text-decoration: underline;" =
class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; 4323 <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; 4323 <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; 4323 <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; 22927 4323 =
<<a href=3D"http://qosient.com/" style=3D"color: purple; =
text-decoration: underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; 6582 4323 =
<<a href=3D"http://qosient.com/" style=3D"color: purple; =
text-decoration: underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; 7018 4323 =
<<a href=3D"http://qosient.com/" style=3D"color: purple; =
text-decoration: underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; =
4323 3 <<a href=3D"http://qosient.com/" =
style=3D"color: purple; text-decoration: underline;" =
class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; 4323 <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; 4323 15169 =
<<a href=3D"http://qosient.com/" style=3D"color: purple; =
text-decoration: underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; 4323 <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; 4323 <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; 4323 15169 =
<<a href=3D"http://qosient.com/" style=3D"color: purple; =
text-decoration: underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; 4323 21928 =
<<a href=3D"http://qosient.com/" style=3D"color: purple; =
text-decoration: underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; 2828 4323 =
<<a href=3D"http://qosient.com/" style=3D"color: purple; =
text-decoration: underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; Any thoughts on what I am missing =
or how I might further debug this issue? <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; Thanks! <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; &nbs=
p; Kevin <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; <spa=
n class=3D"Apple-converted-space"> </span><br =
class=3D""> =
&n=
bsp; -----BEGIN PGP SIGNATURE----- <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
&n=
bsp; =
iF0EARECAB0WIQQP+UHquEepll566aqXCCyZOY1FIQUCW67X6gAKCRCXCCyZOY1F<span =
class=3D"Apple-converted-space"> </span><br =
class=3D""> =
&n=
bsp; =
IdLwAKDv6tPpe7OwLBEEfM1YTnAD8MxZCgCeOlGEEuEIUvqlyIMh8CPBWctmBd0=3D<span =
class=3D"Apple-converted-space"> </span><br =
class=3D""> =
&n=
bsp; =3Dp/tg<span =
class=3D"Apple-converted-space"> </span><br =
class=3D""> =
&n=
bsp; -----END PGP SIGNATURE----- <<a =
href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: =
underline;" class=3D"">http://qosient.com/</a>><span =
class=3D"Apple-converted-space"> </span><br =
class=3D""> -----BEGIN PGP =
SIGNATURE-----<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D""> =
iF0EARECAB0WIQQP+UHquEepll566aqXCCyZOY1FIQUCW6/WuAAKCRCXCCyZOY1F<span =
class=3D"Apple-converted-space"> </span><br =
class=3D""> =
IYGaAKDk/9QFqcgbEWN6bN9eMNitGAXU7ACfduIQKuGR7lsDTCkdRogye0u8TxM=3D<span =
class=3D"Apple-converted-space"> </span><br =
class=3D""> =3DeoBH<span =
class=3D"Apple-converted-space"> </span><br =
class=3D""> -----END PGP =
SIGNATURE-----<span class=3D"Apple-converted-space"> </span><br =
class=3D"">-----BEGIN PGP SIGNATURE-----<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div =
class=3D"">iF0EARECAB0WIQQP+UHquEepll566aqXCCyZOY1FIQUCW7DgxQAKCRCXCCyZOY1=
F<span class=3D"Apple-converted-space"> </span><br =
class=3D"">IW8GAJ9tlHBAzoC4LAVWCw09qF4MfwuhOQCg7MxVBI5MKea4aax2551/gQ28mlE=
=3D<span class=3D"Apple-converted-space"> </span><br =
class=3D"">=3DCZnI<span class=3D"Apple-converted-space"> </span><br =
class=3D"">-----END PGP SIGNATURE-----<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div></div></div></blockquote></div><br =
class=3D""></div></div></body></html>=
--Apple-Mail=_73326516-5DFB-4399-9A3E-9FDD46760874--
--Apple-Mail=_7E1EAD92-021A-43FC-84D1-37DF64973ED2
Content-Disposition: attachment;
filename=smime.p7s
Content-Type: application/pkcs7-signature;
name=smime.p7s
Content-Transfer-Encoding: base64
MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIMfzCCBjkw
ggUhoAMCAQICAi9KMA0GCSqGSIb3DQEBBQUAMHAxCzAJBgNVBAYTAlVTMRgwFgYDVQQKEw9VLlMu
IEdvdmVybm1lbnQxDDAKBgNVBAsTA0VDQTEiMCAGA1UECxMZQ2VydGlmaWNhdGlvbiBBdXRob3Jp
dGllczEVMBMGA1UEAxMMT1JDIEVDQSBTVyA1MB4XDTE2MDQyMTE0NTIyMFoXDTE5MDQyMDE0NTIy
MFowgYYxCzAJBgNVBAYTAlVTMRgwFgYDVQQKEw9VLlMuIEdvdmVybm1lbnQxDDAKBgNVBAsTA0VD
QTEMMAoGA1UECxMDT1JDMRQwEgYDVQQLEwtRb1NpZW50IExMQzErMCkGA1UEAxMiQnVsbGFyZC5X
aWxsaWFtLkMuT1JDMTAwMDAzNzEwMS5JRDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
ANH6wFljIqTSG24iCguRKRXuVSd+j+Kd6bqupbNZl6sDbpXmWHqPUtAjEsDTQ1+IdUnaeS+n3/YJ
xGWM1XzUuKCecSLQ+ntBdgCB37Bh8erLRDZm4UedsSap3x2MnEYoZ1i8PyStV5Ul6i5LmK7ZhwLg
x7uM7rNrxMWbBxN/+Wv2gyX7FtchW2Txg+zItNkGZRa91v3/B+KlNNfo6bc3NM0K9KXrB3Ny3npq
UYCL92T6fd9RSj1I162GOvssVYz9VN4+XIsORq91cg0Wz8fy7Jav5KODCd8ucq/7N/FvDiRvLUCH
8PXyXfoh0sQc9IgQMK1AZQlcXSrBYoR3ZkX/AsMCAwEAAaOCAsQwggLAMB8GA1UdIwQYMBaAFLwP
dwuNo7OFQ8I2k2asAql3wz1SMB0GA1UdDgQWBBQ2fPubIDMNKIiq3FHKp7g2gsTiFzCCASMGCCsG
AQUFBwEBBIIBFTCCAREwHgYIKwYBBQUHMAGGEmh0dHA6Ly9ldmEub3JjLmNvbTAyBggrBgEFBQcw
AoYmaHR0cDovL2VjYS5vcmMuY29tL2NhQ2VydHMvRUNBLVNXNS5wN2MwgboGCCsGAQUFBzAChoGt
bGRhcDovL2VjYS1kcy5vcmMuY29tL2NuJTNkT1JDJTIwRUNBJTIwU1clMjA1JTJjb3UlM2RDZXJ0
aWZpY2F0aW9uJTIwQXV0aG9yaXRpZXMlMmNvdSUzZEVDQSUyY28lM2RVLlMuJTIwR292ZXJubWVu
dCUyY2MlM2RVUz9jQUNlcnRpZmljYXRlO2JpbmFyeSxjcm9zc0NlcnRpZmljYXRlUGFpcjtiaW5h
cnkwDgYDVR0PAQH/BAQDAgbAMB0GA1UdEQQWMBSBEmNhcnRlckBxb3NpZW50LmNvbTAXBgNVHSAE
EDAOMAwGCmCGSAFlAwIBDAEwgfEGA1UdHwSB6TCB5jAroCmgJ4YlaHR0cDovL2VjYS5vcmMuY29t
L0NSTHMvT1JDRUNBU1c1LmNybDCBtqCBs6CBsIaBrWxkYXA6Ly9lY2EtZHMub3JjLmNvbTozODkv
Y24lM0RPUkMlMjBFQ0ElMjBTVyUyMDUlMkMlMjBvdSUzRENlcnRpZmljYXRpb24lMjBBdXRob3Jp
dGllcyUyQyUyMG91JTNERUNBJTJDJTIwbyUzRFUuUy4lMjBHb3Zlcm5tZW50JTJDJTIwYyUzRFVT
P2NlcnRpZmljYXRlUmV2b2NhdGlvbkxpc3Q7YmluYXJ5MBsGA1UdCQQUMBIwEAYIKwYBBQUHCQQx
BBMCVVMwDQYJKoZIhvcNAQEFBQADggEBAAkMoOFvsrwavbMIXgi3AiID+bGLUfsKxxSrvo0S1kej
KhSdt+LXl+BCdf9kU8SwBXHH8iy6maLxEKFOPrsXGp9ZnyOx1vfw+J9S0jYqp/fU9IFTSPPm8Khv
Fv8rfL11EbAtbHm586rrMsPe2FhwWZTIm2ji0QpYl2zj/GO6sC6WvwQRJ5m+bkqbPPGiF8sJuMlO
UgatWlSZ5NhPcDBV2c2s0J2xVIKPJla8BUh3os2F5amQ8FVodQ7tWV5YaqaJb0Tv2RAnZXR2fwWD
WQHzmO/aXOs6kHjcuIgrfniHr2aEBBmJHhBqFjWBAVWcpv5iyl3ncnyWDvIFa416d73GXPUwggY+
MIIFJqADAgECAgIvSzANBgkqhkiG9w0BAQUFADBwMQswCQYDVQQGEwJVUzEYMBYGA1UEChMPVS5T
LiBHb3Zlcm5tZW50MQwwCgYDVQQLEwNFQ0ExIjAgBgNVBAsTGUNlcnRpZmljYXRpb24gQXV0aG9y
aXRpZXMxFTATBgNVBAMTDE9SQyBFQ0EgU1cgNTAeFw0xNjA0MjExNDUzNDBaFw0xOTA0MjAxNDUz
NDBaMIGLMQswCQYDVQQGEwJVUzEYMBYGA1UEChMPVS5TLiBHb3Zlcm5tZW50MQwwCgYDVQQLEwNF
Q0ExDDAKBgNVBAsTA09SQzEUMBIGA1UECxMLUW9TaWVudCBMTEMxMDAuBgNVBAMTJ0J1bGxhcmQu
V2lsbGlhbS5DLk9SQzEwMDAwMzcxMDEuRW5jcnlwdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
AQoCggEBAMiLLDCrphBIUmeFdgZD5vBlSaNhBo1dZM2sR+eHD4vdoUFznPh87zBtIKwuKCYmlU0M
X/5Jw1wHngilWKwPnTkC5eZjgCUXz/mfXv5FZNYtcJcnztjApI/IPaisQYShIXWgre3e3AAnhH7r
M4ycbcu8WZfF4XZe4dHH2GmITdcOjg+Z0Ss0UU5+C0OFMcpdq22DussR/FIVViiF4FoLY7ULhlax
6X9Pfx0f8sUgy5BB0rIk4MsIP6kGEMFOvgOzvD3xU7KrQdOYn29Fkl9/DNCenblsaJIlcNY5T6bP
0NGDtOuqW59YiNRs13pmEwOi6nTJDcev4gQaaL+oby7PgZ0CAwEAAaOCAsQwggLAMB8GA1UdIwQY
MBaAFLwPdwuNo7OFQ8I2k2asAql3wz1SMB0GA1UdDgQWBBRv/fXsVi7iFzcAUnKrvDB9YsJsVzCC
ASMGCCsGAQUFBwEBBIIBFTCCAREwHgYIKwYBBQUHMAGGEmh0dHA6Ly9ldmEub3JjLmNvbTAyBggr
BgEFBQcwAoYmaHR0cDovL2VjYS5vcmMuY29tL2NhQ2VydHMvRUNBLVNXNS5wN2MwgboGCCsGAQUF
BzAChoGtbGRhcDovL2VjYS1kcy5vcmMuY29tL2NuJTNkT1JDJTIwRUNBJTIwU1clMjA1JTJjb3Ul
M2RDZXJ0aWZpY2F0aW9uJTIwQXV0aG9yaXRpZXMlMmNvdSUzZEVDQSUyY28lM2RVLlMuJTIwR292
ZXJubWVudCUyY2MlM2RVUz9jQUNlcnRpZmljYXRlO2JpbmFyeSxjcm9zc0NlcnRpZmljYXRlUGFp
cjtiaW5hcnkwDgYDVR0PAQH/BAQDAgUgMB0GA1UdEQQWMBSBEmNhcnRlckBxb3NpZW50LmNvbTAX
BgNVHSAEEDAOMAwGCmCGSAFlAwIBDAEwgfEGA1UdHwSB6TCB5jAroCmgJ4YlaHR0cDovL2VjYS5v
cmMuY29tL0NSTHMvT1JDRUNBU1c1LmNybDCBtqCBs6CBsIaBrWxkYXA6Ly9lY2EtZHMub3JjLmNv
bTozODkvY24lM0RPUkMlMjBFQ0ElMjBTVyUyMDUlMkMlMjBvdSUzRENlcnRpZmljYXRpb24lMjBB
dXRob3JpdGllcyUyQyUyMG91JTNERUNBJTJDJTIwbyUzRFUuUy4lMjBHb3Zlcm5tZW50JTJDJTIw
YyUzRFVTP2NlcnRpZmljYXRlUmV2b2NhdGlvbkxpc3Q7YmluYXJ5MBsGA1UdCQQUMBIwEAYIKwYB
BQUHCQQxBBMCVVMwDQYJKoZIhvcNAQEFBQADggEBAB02Nw1iFxe8IdKfcXxcb0V2Agom5zeGM6wa
YxOL8KGRIGL/nXUh0KoPAkRadzzAf2ZgkpjKJoO0JPJuhiiz1shyCraweMiUAkrcMx/IGyI8nGDo
t6ZUGiNo+7gABryqLgGQtGRE9rOxhB0YOKijxxcdEtZW8kghVM+Wfe0+NS8P+jU5ZgoipRunccHs
K0/eUgY62SU0vr0ZzWib9888/FV4NDNShi1DkMMEzFNnPcv1Ms2MP7swAgW2CrlChuktI1M1umjx
V/BBlFTjLLRfB22ARLLDMXIHQ5VM7S6ltFzxWD7RUXDRb2WvHoS3u0XTLV/ES72/kyOJxxopGafE
oUQxggMQMIIDDAIBATB2MHAxCzAJBgNVBAYTAlVTMRgwFgYDVQQKEw9VLlMuIEdvdmVybm1lbnQx
DDAKBgNVBAsTA0VDQTEiMCAGA1UECxMZQ2VydGlmaWNhdGlvbiBBdXRob3JpdGllczEVMBMGA1UE
AxMMT1JDIEVDQSBTVyA1AgIvSjAJBgUrDgMCGgUAoIIBbzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcN
AQcBMBwGCSqGSIb3DQEJBTEPFw0xODEwMDExMzUwMDhaMCMGCSqGSIb3DQEJBDEWBBTyFkxZzRhg
rFHX935TCg3t8Iv4azCBhQYJKwYBBAGCNxAEMXgwdjBwMQswCQYDVQQGEwJVUzEYMBYGA1UEChMP
VS5TLiBHb3Zlcm5tZW50MQwwCgYDVQQLEwNFQ0ExIjAgBgNVBAsTGUNlcnRpZmljYXRpb24gQXV0
aG9yaXRpZXMxFTATBgNVBAMTDE9SQyBFQ0EgU1cgNQICL0swgYcGCyqGSIb3DQEJEAILMXigdjBw
MQswCQYDVQQGEwJVUzEYMBYGA1UEChMPVS5TLiBHb3Zlcm5tZW50MQwwCgYDVQQLEwNFQ0ExIjAg
BgNVBAsTGUNlcnRpZmljYXRpb24gQXV0aG9yaXRpZXMxFTATBgNVBAMTDE9SQyBFQ0EgU1cgNQIC
L0swDQYJKoZIhvcNAQEBBQAEggEAfWRRzJnDrjBeAE03k0mtdZ97neOC/sk1T/+aLrd/jmu6/Zpk
oMc3lRAhbOmd0w/lDWX65rp015NGxRIMrhUf6vDcHdrewKSAkIZh0vC7N8+RFaOddXC5O3tOmam+
KIg8NhHqVlvyQNvXQ+fa1ZQhk8jE6VBq0uVVwomAqWaVjHRZ8cpuwIsdwS7CCCXFkuI3IXTeYhMw
NESz0L/jBhDqeAN7w6x8w1LXMI9lFXnHeEqosHE5hPi26UcHCgE9Hgk/MT+yJW3ZqwS3M+L0IlNo
CgAu88O/o0fJ7+HVnLrKxQGamwmAcWtWNIUS3qmoQ0+p6e3OaaUW4WOOIM30qQ/FBQAAAAAAAA==
--Apple-Mail=_7E1EAD92-021A-43FC-84D1-37DF64973ED2--