Re: MaxMind GeoIP support in 3.0.8.2
Carter Bullard <[email protected]> Mon, 1 Oct 2018 10:39:48 -0400
| Newsgroups | gmane.network.argus |
|---|---|
| Message-ID | <[email protected]> |
--Apple-Mail=_A4F9A559-2048-4A6D-8FBA-0C5077850634 Content-Type: multipart/alternative; boundary="Apple-Mail=_48F3CD62-4048-475F-B345-1B3B1C48391A" --Apple-Mail=_48F3CD62-4048-475F-B345-1B3B1C48391A Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hey Kevin, I think I figured out a better regex for your =E2=80=9CFL=E2=80=9D in = both scity and dcity, regardless of order and placement in the label =E2=80= =A6 (?=3D.*\bscity=3D[^:]+FL\b)(?=3D.*\bdcity=3D[^:]+FL\b).+ This will require that you compile the clients with a pcre library, as = some regex libraries don=E2=80=99t support =E2=80=9C?=3D.=E2=80=9D = repetition. That can be specified at ./configure time . Carter > On Oct 1, 2018, at 9:50 AM, Carter Bullard <[email protected]> wrote: >=20 > Hey Kevin, > Dave is right on the money, and great to see that you guys got it = working !! =20 >=20 > You can search the label using regular expressions (pcre style regex = if you compiled that library in) just as Dave indicates. You can use a = simple regex like =E2=80=9CFL=E2=80=9D to get the flows that have = anything to do with =E2=80=98FL=E2=80=99 and then do your own parsing to = get exactly what you want, something like: >=20 > ra -S localhost -M label=3D=E2=80=9CFL=E2=80=9D -s stime saddr = daddr proto spkts dpkts label -c, >=20 > And then process the label string to get your values, or you can = regex and match the FL as a part of both the =E2=80=98scity=E2=80=99 and = =E2=80=98dcity=E2=80=99 fields. Something like: >=20 > -M label=3D=E2=80=9Cscity=3D.*FL.*dcity=3D.*FL=E2=80=9D >=20 > In general, the labeler will put the scity, then the dcity values into = the label in that order, and should put the values you specify on the = line into the label, in the order given. But, because a previous = labeler could have put scity and/or dcity values in the label before you = put your values, you don=E2=80=99t know what the order of values maybe = for scity or dcity. When there are multiple values, ralabel and radium = have the ability to reorder values, so that it can deal with duplicate = values. Daves regex will match if FL is just after the =E2=80=98=3D=E2=80= =98 which will cover 95% of the scenarios. I have multiple labelers, = radium is always putting lat,lon bounding boxes for IP addresses, so if = I have something later putting in city codes, it may end up at the end = of a list of other objects that apply to =E2=80=99scity=E2=80=99 or = =E2=80=98dcity=E2=80=99. And of course, the =E2=80=99scity=E2=80=99 and = =E2=80=98dcity=E2=80=99 may not be in that order =E2=80=A6 In this case = the best regex may be: >=20 > -M label=3D"(?=3D.*scity=3D.*FL)(?=3D.*dcity=3D.*FL)=E2=80=9D >=20 > This matches scity=E2=80=A6FL and dcity=E2=80=A6FL regardless of the = order in the label. May still need some tweaking, but hopefully you get = the idea ... >=20 > Carter >=20 >=20 >> On Sep 30, 2018, at 10:42 AM, David Edelman <[email protected] = <mailto:[email protected]>> wrote: >>=20 >> -----BEGIN PGP SIGNED MESSAGE-----=20 >> Hash: SHA1=20 >> Use the ra command line flag -M label=3D=E2=80=99scity=3DFL.*dcity=3DFL= =E2=80=99 I seem to remember that regular expressions work for this = filter. Use the single quote to escape the *=20 >> =20 >> If the regular expression doesn=E2=80=99t work let me know. You = can=E2=80=99t use ragrep since that looks at theuser data portion of = the flow, not the label metadata. >> =20 >> - --Dave=20 >> =20 >> From: Kevin Branch <[email protected] = <mailto:[email protected]>>=20 >> Sent: Saturday, September 29, 2018 11:14 PM=20 >> To: David Edelman <[email protected] <mailto:[email protected]>>=20 >> Cc: Carter Bullard <[email protected] <mailto:[email protected]>>; = Argus <[email protected] = <mailto:[email protected]>>=20 >> Subject: Re: [ARGUS] MaxMind GeoIP support in 3.0.8.2=20 >> =20 >> David, thanks! That was the missing piece.=20 >> =20 >> I switched to=20 >> =20 >> RALABEL_GEOIP_CITY=3D"saddr,daddr:region,cco"=20 >> =20 >> and I saw what I wanted:=20 >> =20 >> # ra -r /argus/today/unt-01.arg -N1 -w - | ralabel -f = /etc/ralabel.conf -r - -s label:30 -N20=20 >> Label=20 >> scity=3DFL,US:dcity=3DMO,US=20 >> =20 >> All along I have been trying to label source and destination IPs with = state,country like above. It took a fair bit of experimenting to get = the state part figured out due to that field being referred to as "reg" = in the ralabel.conf comment documentation while actually it has to be = referenced as "region" to work. >> =20 >> Now for my hopefully last question: How can I have ra use that label = content as search criteria? I am trying to use ra to count up total = traffic volume seen where the source and destination IP are both in = Florida. I suspect ra will not let me use label, scity or dcity values = as filter criteria. Can ragrep help here? Or will I have to go the = rasqlinsert route to accomplish this? >> =20 >> Thanks,=20 >> Kevin=20 >> =20 >> =20 >> On Sat, Sep 29, 2018 at 3:47 PM David Edelman <[email protected] = <mailto:[email protected]> <mailto:[email protected] = <mailto:[email protected]>> > wrote:=20 >> -----BEGIN PGP SIGNED MESSAGE-----=20 >> Hash: SHA1=20 >> It looks like we are almost there, you need to indicate which = addresses need to have the labels associated=20 >> Please change this in your configuration file=20 >> =20 >> =20 >> RALABEL_GEOIP_CITY=3D"saddr,daddr:city "=20 >> =20 >> This information might help Looking at the code, the netmask = is not functional=20 >> =20 >> #=20 >> # Data for city relevant data is enabled through enabling = and configuring=20 >> # the city database support. The types of data available = are:=20 >> # country_code, country_code3, country_name, region, = city, postal_code,=20 >> # latitude, longitude, metro_code, area_code and = continent_code.=20 >> # time_offset is also available.=20 >> #=20 >> # The concept is that you should be able to add semantics = for any=20 >> # IP address that is in the argus record. Support = addresses are:=20 >> #=20 >> # saddr, daddr, inode=20 >> #=20 >> # The labels provided will be tagged as:=20 >> # scity, dcity, icity=20 >> #=20 >> # To configure what you want to have placed in the label, = use the list of=20 >> # objects, in whatever order you like, as the = RALABEL_GEOPIP_CITY string=20 >> # using these keywords:=20 >> # cco - country_code=20 >> # cco3 - country_code3=20 >> # cname - country_name=20 >> # reg - region=20 >> # city - city=20 >> # pcode - postal_code=20 >> # lat - latitude=20 >> # long - longitude=20 >> # metro - metro_code=20 >> # area - area_code=20 >> # cont - continent_code=20 >> # netmask - netmask value=20 >> #=20 >> # Working examples could be:=20 >> # RALABEL_GEOIP_CITY=3D"saddr,daddr:lat/lon"=20 >> # RALABEL_GEOIP_CITY=3D"*:city,region,cname,lat,lon"=20 >> #=20 >> #RALABEL_GEOIP_CITY=3D"saddr,daddr,inode:off,cont,lat,lon"=20 >> #RALABEL_GEOIP_CITY_FILE=3D"/usr/local/share/GeoIP/GeoIP.dat"=20= >> =20 >> =20 >> =20 >> - --Dave=20 >> =20 >> =20 >> =20 >> From: Kevin Branch <[email protected] = <mailto:[email protected]> = <mailto:[email protected] = <mailto:[email protected]>> >=20 >> Sent: Saturday, September 29, 2018 11:57 AM=20 >> To: Carter Bullard <[email protected] = <mailto:[email protected]> <mailto:[email protected] = <mailto:[email protected]>> >=20 >> Cc: David Edelman <[email protected] = <mailto:[email protected]> <mailto:[email protected] = <mailto:[email protected]>> >; Argus <[email protected] = <mailto:[email protected]> = <mailto:[email protected] = <mailto:[email protected]>> >=20 >> Subject: Re: [ARGUS] MaxMind GeoIP support in 3.0.8.2=20 >> =20 >> Hi Carter and David,=20 >> =20 >> I just tried the following with the same ralabel.conf as = before:=20 >> ra -r /argus/today/unt-01.arg -w - | ralabel -f = /etc/ralabel.conf -r - -s label:200 -N20=20 >> and saw this. Looks like I was using the wrong syntax which = I am glad to know better now, but the GeoIP lookups are still not = happening: >> "scity=3D:dcity=3D"=20 >> "scity=3D:dcity=3D"=20 >> "scity=3D:dcity=3D"=20 >> "scity=3D:dcity=3D"=20 >> "scity=3D:dcity=3D"=20 >> "scity=3D:dcity=3D"=20 >> "scity=3D:dcity=3D"=20 >> "scity=3D:dcity=3D"=20 >> "scity=3D:dcity=3D"=20 >> "scity=3D:dcity=3D"=20 >> "scity=3D:dcity=3D"=20 >> "scity=3D:dcity=3D"=20 >> =20 >> I know the data file is good because it works with this:=20 >> # geoiplookup -f /usr/local/share/GeoIP/GeoIPCity.dat = 207.48.48.19=20 >> GeoIP City Edition, Rev 1: US, MO, Missouri, = Chesterfield, 63017, 38.650002, -90.533401, 609, 314=20 >> =20 >> In case it helps, I rebuilt argus-clients with the .debug = flag file present and then ran this command limited to only a single = argus record that I independently confirmed has a srcip value known to = geoiplookup >> # ra -r /argus/today/unt-01.arg -N1 -w - | ralabel -f = /etc/ralabel.conf -r - -s label:50 -N200 -D3=20 >> ralabel[44570.40b753ff8e7f0000]: 15:52:57.950161 = ArgusNewLabeler (0x7f8eff3f7010, 0) returning 0x1b057c0=20 >> ralabel[44570.40b753ff8e7f0000]: 15:52:57.959656 = RaLabelParseResourceFile (/etc/ralabel.conf) returning 0=20 >> ralabel[44570.40b753ff8e7f0000]: 15:52:57.959730 = ArgusReadConnection() read 16 bytes=20 >> ralabel[44570.40b753ff8e7f0000]: 15:52:57.959748 = ArgusReadConnection() read 112 bytes=20 >> ralabel[44570.40b753ff8e7f0000]: 15:52:57.961133 = ArgusInitAddrtoname (0x7f8eff3f7010, 0xa9fe6700, 0xffffff00)=20 >> ralabel[44570.40b753ff8e7f0000]: 15:52:57.961145 = ArgusParseInit(0x7f8eff3f7010 0x7f8eff386010=20 >> ralabel[44570.40b753ff8e7f0000]: 15:52:57.961155 = ArgusReadConnection(0xff386010, 1) returning 1=20 >> ralabel[44570.40b753ff8e7f0000]: 15:52:57.961329 = ArgusAddToRecordLabel (0x7f8eff3f7010, 0x1b188c0, scity=3D:dcity=3D) = returning 0 >> Label=20 >> scity=3D:dcity=3D=20= >> ralabel[44570.40b753ff8e7f0000]: 15:52:57.961385 = ArgusCloseInput(0xff386010) closing=20 >> ralabel[44570.40b753ff8e7f0000]: 15:52:57.961408 = ArgusCloseInput(0xff386010) done=20 >> ralabel[44570.40b753ff8e7f0000]: 15:52:57.961415 = main: ArgusReadFileStream (-) done=20 >> ralabel[44570.40b753ff8e7f0000]: 15:52:57.961426 = main: reading files completed=20 >> ralabel[44570.40b753ff8e7f0000]: 15:52:57.961432 = ArgusShutDown (0)=20 >> ralabel[44570.40b753ff8e7f0000]: 15:52:57.961439 = RaParseComplete (0) returning=20 >> ralabel[44570.40b753ff8e7f0000]: 15:52:57.961444 = RaParseComplete(caught signal 0)=20 >> [email protected] = <mailto:[email protected]>:~/argus-clients-3.0.8# = <mailto:[email protected]:~/argus-clients-3.0.8 = <mailto:[email protected]:~/argus-clients-3.0.8>#> = <mailto:[email protected]:~/argus-clients-3.0.8 = <mailto:[email protected]:~/argus-clients-3.0.8>#> ra -r = /argus/today/unt-01.arg -N1 -w - | ralabel -f /etc/ralabel.conf -r - -s = label:50 -N200 -D8 >> ralabel[4462.40472429a37f0000]: 15:53:24.374433 = ArgusFree (0x26b2250)=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.374461 = ArgusFree (0x26b22b0)=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.374469 = ArgusFree (0x26b2310)=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.374474 = ArgusFree (0x26b2370)=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.374479 = ArgusFree (0x26b23d0)=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.374484 = ArgusFree (0x26b2430)=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.374489 = ArgusFree (0x26b2490)=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.374494 = ArgusFree (0x26b24f0)=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.374499 = ArgusFree (0x26b2550)=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.374504 = ArgusFree (0x26b25b0)=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.374509 = ArgusFree (0x26b2610)=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.374533 = ArgusCalloc (1, 80) returning 0x26b2610=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.374544 = ArgusCalloc (1, 296) returning 0x26b27c0=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.374566 = ArgusCalloc (1, 112) returning 0x26b2950=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.374577 = ArgusCalloc (1, 80) returning 0x26b25b0=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.374595 = ArgusNewQueue () returning 0x26b25b0=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.374613 = ArgusCalloc (65536, 8) returning 0x2849a010=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.374619 = ArgusNewLabeler (0x7fa329100010, 0) returning 0x26b27c0=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.384352 = RaLabelParseResourceFile (/etc/ralabel.conf) returning 0=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.384387 = ArgusCalloc (1, 560) returning 0x26b2250=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.384411 = ArgusCalloc (1, 112) returning 0x26b2e80=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.384418 = ArgusCalloc (1, 80) returning 0x26b2f00=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.384424 = ArgusNewQueue () returning 0x26b2f00=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.384430 = ArgusCalloc (1, 56) returning 0x26b2f60=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.384454 = ArgusCalloc (65536, 8) returning 0x27358010=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.384461 = ArgusNewHashTable (65536) returning 0x26b2f60=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.384483 = ArgusReadConnection() read 16 bytes=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.384498 = ArgusReadConnection() read 112 bytes=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.384514 = ArgusCalloc (1, 4194304) returning 0x26f57010=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.384523 = ArgusCalloc (1, 262144) returning 0x26f16010=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.385934 = ArgusInitAddrtoname (0x7fa329100010, 0xa9fe6700, 0xffffff00)=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.385947 = ArgusParseInit(0x7fa329100010 0x7fa32908f010=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.385956 = ArgusReadConnection(0x2908f010, 1) returning 1=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.385969 = ArgusReadFileStream() starting=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.385981 = ArgusReadStreamSocket (0x7fa32908f010) read 380 bytes=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386015 = ArgusCalloc (1, 384) returning 0x26c58c0=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386025 = ArgusCalloc (1, 12) returning 0x26c5a50=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386031 = ArgusCalloc (1, 80) returning 0x26c5a70=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386037 = ArgusCalloc (1, 36) returning 0x26c5ad0=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386042 = ArgusCalloc (1, 52) returning 0x26c5b00=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386047 = ArgusCalloc (1, 80) returning 0x26c5b40=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386053 = ArgusCalloc (1, 120) returning 0x26c5ba0=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386058 = ArgusCalloc (1, 8) returning 0x26c5c20=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386063 = ArgusCalloc (1, 164) returning 0x26c5c40=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386070 = ArgusCalloc (1, 20) returning 0x26c5cf0=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386075 = ArgusCalloc (1, 20) returning 0x26c5d10=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386080 = ArgusCalloc (1, 12) returning 0x26c5d30=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386092 = ArgusCalloc (1, 16) returning 0x26c5d50=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386131 = ArgusCalloc (1, 12) returning 0x26c5e80=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386234 = ArgusAddToRecordLabel (0x7fa329100010, 0x26c58c0, scity=3D:dcity=3D) = returning 0 >> Label=20 >> scity=3D:dcity=3D=20= >> ralabel[4462.40472429a37f0000]: 15:53:24.386280 = ArgusFree (0x26c5a50)=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386287 = ArgusFree (0x26c5a70)=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386292 = ArgusFree (0x26c5ad0)=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386297 = ArgusFree (0x26c5b00)=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386301 = ArgusFree (0x26c5b40)=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386304 = ArgusFree (0x26c5ba0)=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386308 = ArgusFree (0x26c5c20)=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386312 = ArgusFree (0x26c5c40)=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386316 = ArgusFree (0x26c5cf0)=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386322 = ArgusFree (0x26c5d10)=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386359 = ArgusFree (0x26c5d30)=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386369 = ArgusFree (0x26c5e80)=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386377 = ArgusFree (0x26c5d50)=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386384 = ArgusFree (0x26c58c0)=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386392 = RaProcessRecord (0x2908f630) returning=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386400 = RaScheduleRecord (0x7fa329100010, 0x7fa32908f630) scheduled=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386408 = ArgusHandleRecord (0x7fa326f57010, 0x7fa329221800) returning 380 >> ralabel[4462.40472429a37f0000]: 15:53:24.386417 = ArgusReadStreamSocket (0x7fa32908f010) returning 0=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386432 = ArgusReadStreamSocket (0x7fa32908f010) read 0 bytes=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386439 = ArgusReadStreamSocket (0x7fa32908f010) returning 1=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386447 = ArgusCloseInput(0x2908f010) closing=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386463 = ArgusFree (0x7fa326f57010)=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386473 = ArgusFree (0x7fa326f16010)=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386492 = ArgusCloseInput(0x2908f010) done=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386500 = ArgusReadFileStream() returning=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386508 main: = ArgusReadFileStream (-) done=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386522 = ArgusFree (0x7fa32908f010)=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386529 main: = reading files completed=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386536 = ArgusShutDown (0)=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386546 = ArgusFree (0x26b2190)=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386553 = ArgusDeleteQueue (0x26b2190) returning=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386561 = ArgusFree (0x26b21f0)=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386569 = ArgusDeleteQueue (0x26b21f0) returning=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386599 = RaParseComplete (0) returning=20 >> ralabel[4462.40472429a37f0000]: 15:53:24.386608 = RaParseComplete(caught signal 0)=20 >> =20 >> Thanks for looking at this,=20 >> Kevin=20 >> =20 >> =20 >> On Sat, Sep 29, 2018 at 11:18 AM Carter Bullard = <[email protected] <mailto:[email protected]> = <mailto:[email protected] <mailto:[email protected]>> = <mailto:[email protected] <mailto:[email protected]>> > wrote:=20 >> Hey Kevin,=20 >> Any success ???=20 >> Carter=20 >> <http://qosient.com/ <http://qosient.com/>>=20 >> <http://qosient.com/ <http://qosient.com/>>=20 >> Carter Bullard =E2=80=A2 CTO <http://qosient.com/ = <http://qosient.com/>>=20 >> 150 E 57th Street Suite 12D <http://qosient.com/ = <http://qosient.com/>>=20 >> New York, New York 10022-2795 <http://qosient.com/ = <http://qosient.com/>>=20 >> Phone +1.212.588.9133 =E2=80=A2 Mobile +1.917.497.9494 = <http://qosient.com/ <http://qosient.com/>>=20 >> =20 >> On Sep 28, 2018, at 9:40 PM, David Edelman = <[email protected] <mailto:[email protected]> = <mailto:[email protected] <mailto:[email protected]>> > wrote: = <http://qosient.com/ <http://qosient.com/>>=20 >> -----BEGIN PGP SIGNED MESSAGE-----=20 >> Hash: SHA1 <http://qosient.com/ = <http://qosient.com/>>=20 >> Please try this: <http://qosient.com/ = <http://qosient.com/>>=20 >> # ra -r /argus/today/unt-01.arg -w - | = ralabel -f /etc/ralabel.conf -r - -s label:200 -N20 = <http://qosient.com/ <http://qosient.com/>>=20 >> <http://qosient.com/ <http://qosient.com/>>=20= >> From: Argus-info = <[email protected] = <mailto:[email protected]><mail= to:[email protected] = <mailto:[email protected]>> > On Behalf Of Kevin Branch=20 >> Sent: Friday, September 28, 2018 5:25 PM=20 >> To: Carter Bullard <[email protected] = <mailto:[email protected]> <mailto:[email protected] = <mailto:[email protected]>> >=20 >> Cc: Argus <[email protected] = <mailto:[email protected]> = <mailto:[email protected] = <mailto:[email protected]>> >=20 >> Subject: Re: [ARGUS] MaxMind GeoIP support in = 3.0.8.2 <http://qosient.com/ <http://qosient.com/>>=20 >> <http://qosient.com/ <http://qosient.com/>>=20= >> Looks like GeoIP is linked in already: = <http://qosient.com/ <http://qosient.com/>>=20 >> <http://qosient.com/ <http://qosient.com/>>=20= >> # ldd `which ralabel`=20 >> linux-vdso.so.1 =3D> = (0x00007ffddaf8a000)=20 >> libm.so.6 =3D> = /lib/x86_64-linux-gnu/libm.so.6 (0x00007f5fe67c9000)=20 >> libpthread.so.0 =3D> = /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f5fe65ab000)=20 >> libGeoIP.so.1 =3D> = /usr/lib/x86_64-linux-gnu/libGeoIP.so.1 (0x00007f5fe637c000)=20 >> libc.so.6 =3D> = /lib/x86_64-linux-gnu/libc.so.6 (0x00007f5fe5fb3000)=20 >> /lib64/ld-linux-x86-64.so.2 = (0x00007f5fe6acf000) <http://qosient.com/ <http://qosient.com/>>=20 >> <http://qosient.com/ <http://qosient.com/>>=20= >> I switched to just "lat,lon" like you = suggested in ralabel.conf: <http://qosient.com/ <http://qosient.com/>>=20= >> <http://qosient.com/ <http://qosient.com/>>=20= >> # cat /etc/ralabel.conf <http://qosient.com/ = <http://qosient.com/>>=20 >> RALABEL_ARIN_COUNTRY_CODES=3Dno = <http://qosient.com/ <http://qosient.com/>>=20 >> <http://qosient.com/ = <http://qosient.com/>>=20 >> RALABEL_GEOIP_ASN=3Dyes = <http://qosient.com/ <http://qosient.com/>>=20 >> = RALABEL_GEOIP_ASN_FILE=3D"/usr/local/share/GeoIP/GeoIPASNum.dat" = <http://qosient.com/ <http://qosient.com/>>=20 >> <http://qosient.com/ = <http://qosient.com/>>=20 >> RALABEL_GEOIP_CITY=3D"lat,lon" = <http://qosient.com/ <http://qosient.com/>>=20 >> = RALABEL_GEOIP_CITY_FILE=3D"/usr/local/share/GeoIP/GeoIPCity.dat" = <http://qosient.com/ <http://qosient.com/>>=20 >> <http://qosient.com/ <http://qosient.com/>>=20= >> But I don't see anything but ASNs getting = added in: <http://qosient.com/ <http://qosient.com/>>=20 >> <http://qosient.com/ <http://qosient.com/>>=20= >> # ra -r /argus/today/unt-01.arg -w - | = ralabel -f /etc/ralabel.conf -r - -s sas,das,scity,dcity,icity | head = -n20 <http://qosient.com/ <http://qosient.com/>>=20 >> sAS dAS <http://qosient.com/ = <http://qosient.com/>>=20 >> 4323 <http://qosient.com/ = <http://qosient.com/>>=20 >> 4323 <http://qosient.com/ = <http://qosient.com/>>=20 >> 4323 <http://qosient.com/ = <http://qosient.com/>>=20 >> 22927 4323 <http://qosient.com/ = <http://qosient.com/>>=20 >> 6582 4323 <http://qosient.com/ = <http://qosient.com/>>=20 >> 7018 4323 <http://qosient.com/ = <http://qosient.com/>>=20 >> 4323 3 <http://qosient.com/ = <http://qosient.com/>>=20 >> 4323 <http://qosient.com/ = <http://qosient.com/>>=20 >> 4323 15169 <http://qosient.com/ = <http://qosient.com/>>=20 >> 4323 <http://qosient.com/ = <http://qosient.com/>>=20 >> 4323 <http://qosient.com/ = <http://qosient.com/>>=20 >> 4323 15169 <http://qosient.com/ = <http://qosient.com/>>=20 >> 4323 21928 <http://qosient.com/ = <http://qosient.com/>>=20 >> 2828 4323 <http://qosient.com/ = <http://qosient.com/>>=20 >> <http://qosient.com/ <http://qosient.com/>>=20= >> Thoughts? <http://qosient.com/ = <http://qosient.com/>>=20 >> Kevin <http://qosient.com/ = <http://qosient.com/>>=20 >> <http://qosient.com/ <http://qosient.com/>>=20= >> On Fri, Sep 28, 2018 at 2:36 PM Carter = Bullard <[email protected] <mailto:[email protected]> = <mailto:[email protected] <mailto:[email protected]>> = <mailto:[email protected] <mailto:[email protected]>> > wrote: = <http://qosient.com/ <http://qosient.com/>>=20 >> Hey Kevin, <http://qosient.com/ = <http://qosient.com/>>=20 >> If you do a ./configure =E2=80=94help = you=E2=80=99ll see all the options that ./configure supports. If you = specify =E2=80=94with-GeoIP it wants the directory where the GeoIP = library is. <http://qosient.com/ <http://qosient.com/>>=20 >> =E2=80=94with-GeoIP=3DDIR. compile = with GeoIP in <dir> <http://qosient.com/ <http://qosient.com/>>=20 >> <http://qosient.com/ = <http://qosient.com/>>=20 >> You can check if the library is bound = to the client binaries with ldd =E2=80=A6 <http://qosient.com/ = <http://qosient.com/>>=20 >> ldd `which ralabel` = <http://qosient.com/ <http://qosient.com/>>=20 >> <http://qosient.com/ = <http://qosient.com/>>=20 >> If you=E2=80=99re already bound, the = city stuff should work =E2=80=A6. I=E2=80=99m not familiar with = =E2=80=9Creg,cco=E2=80=9D as GeoIP City objects off the top of my head. = I=E2=80=99m familiar with =E2=80=9Coff,cont,lat,lon,region,city,cname=E2=80= =9D. Maybe try lat,lon as a test, as I use that all the time .. = <http://qosient.com/ <http://qosient.com/>>=20 >> <http://qosient.com/ = <http://qosient.com/>>=20 >> Carter <http://qosient.com/ = <http://qosient.com/>>=20 >> =20 >> <http://qosient.com/ = <http://qosient.com/>>=20 >> =20 >> =20 >> <http://qosient.com/ = <http://qosient.com/>>=20 >> On Sep 28, 2018, at 1:59 PM, = Kevin Branch <[email protected] = <mailto:[email protected]><mailto:[email protected]= m <mailto:[email protected]>> = <mailto:[email protected] = <mailto:[email protected]>> > wrote: <http://qosient.com/ = <http://qosient.com/>>=20 >> <http://qosient.com/ = <http://qosient.com/>>=20 >> Hi Carter, = <http://qosient.com/ <http://qosient.com/>>=20 >> <http://qosient.com/ = <http://qosient.com/>>=20 >> I was just trying today to = make ralabel on argus 3.0.8.2 do GeoIP labeling with GeoIPCity.dat, but = even though the file referred to in ralabel.conf for that purpose = exists, no GeoIP labeling takes place. ASN lookups work great, but = ralabel never adds any scity or dcity fields. <http://qosient.com/ = <http://qosient.com/>>=20 >> <http://qosient.com/ = <http://qosient.com/>>=20 >> My ralabel.conf: = <http://qosient.com/ <http://qosient.com/>>=20 >> <http://qosient.com/ = <http://qosient.com/>>=20 >> = RALABEL_ARIN_COUNTRY_CODES=3Dno <http://qosient.com/ = <http://qosient.com/>>=20 >> <http://qosient.com/ = <http://qosient.com/>>=20 >> RALABEL_GEOIP_ASN=3Dyes= <http://qosient.com/ <http://qosient.com/>>=20 >> = RALABEL_GEOIP_ASN_FILE=3D"/usr/local/share/GeoIP/GeoIPASNum.dat" = <http://qosient.com/ <http://qosient.com/>>=20 >> <http://qosient.com/ = <http://qosient.com/>>=20 >> = RALABEL_GEOIP_CITY=3D"reg,cco" <http://qosient.com/ = <http://qosient.com/>>=20 >> = RALABEL_GEOIP_CITY_FILE=3D"/usr/local/share/GeoIP/GeoIPCity.dat" = <http://qosient.com/ <http://qosient.com/>>=20 >> <http://qosient.com/ = <http://qosient.com/>>=20 >> No errors are thrown by = ralabel. I thought maybe I needed to specially compile in GeoIP support = like I read about here: https://qosient.com/argus/geolocation.shtml = <https://qosient.com/argus/geolocation.shtml> <http://qosient.com/ = <http://qosient.com/>>=20 >> but when I run "./configure = --with-GeoIP=3Dyes" it throws this error: <http://qosient.com/ = <http://qosient.com/>>=20 >> configure: WARNING: = unrecognized options: --with-GeoIP <http://qosient.com/ = <http://qosient.com/>>=20 >> However, I presume the fact = that ASN lookups work means that MaxMind GeoIP support libraries are = already installed, and presumably installed by default in the latest = argus now. <http://qosient.com/ <http://qosient.com/>>=20 >> <http://qosient.com/ = <http://qosient.com/>>=20 >> # ra -r = /argus/today/unt-01.arg -w - | ralabel -f /etc/ralabel.conf -r - -s = sas,das,scity,dcity,icity | head -n20 <http://qosient.com/ = <http://qosient.com/>>=20 >> sAS dAS = <http://qosient.com/ <http://qosient.com/>>=20 >> 4323 <http://qosient.com/ = <http://qosient.com/>>=20 >> 4323 <http://qosient.com/ = <http://qosient.com/>>=20 >> 4323 <http://qosient.com/ = <http://qosient.com/>>=20 >> 22927 4323 = <http://qosient.com/ <http://qosient.com/>>=20 >> 6582 4323 = <http://qosient.com/ <http://qosient.com/>>=20 >> 7018 4323 = <http://qosient.com/ <http://qosient.com/>>=20 >> 4323 3 = <http://qosient.com/ <http://qosient.com/>>=20 >> 4323 <http://qosient.com/ = <http://qosient.com/>>=20 >> 4323 15169 = <http://qosient.com/ <http://qosient.com/>>=20 >> 4323 <http://qosient.com/ = <http://qosient.com/>>=20 >> 4323 <http://qosient.com/ = <http://qosient.com/>>=20 >> 4323 15169 = <http://qosient.com/ <http://qosient.com/>>=20 >> 4323 21928 = <http://qosient.com/ <http://qosient.com/>>=20 >> 2828 4323 = <http://qosient.com/ <http://qosient.com/>>=20 >> <http://qosient.com/ = <http://qosient.com/>>=20 >> Any thoughts on what I am = missing or how I might further debug this issue? <http://qosient.com/ = <http://qosient.com/>>=20 >> <http://qosient.com/ = <http://qosient.com/>>=20 >> Thanks! <http://qosient.com/ = <http://qosient.com/>>=20 >> Kevin <http://qosient.com/ = <http://qosient.com/>>=20 >> =20 >> -----BEGIN PGP SIGNATURE----- = <http://qosient.com/ <http://qosient.com/>>=20 >> = iF0EARECAB0WIQQP+UHquEepll566aqXCCyZOY1FIQUCW67X6gAKCRCXCCyZOY1F=20 >> = IdLwAKDv6tPpe7OwLBEEfM1YTnAD8MxZCgCeOlGEEuEIUvqlyIMh8CPBWctmBd0=3D=20 >> =3Dp/tg=20 >> -----END PGP SIGNATURE----- = <http://qosient.com/ <http://qosient.com/>>=20 >> -----BEGIN PGP SIGNATURE-----=20 >> = iF0EARECAB0WIQQP+UHquEepll566aqXCCyZOY1FIQUCW6/WuAAKCRCXCCyZOY1F=20 >> = IYGaAKDk/9QFqcgbEWN6bN9eMNitGAXU7ACfduIQKuGR7lsDTCkdRogye0u8TxM=3D=20 >> =3DeoBH=20 >> -----END PGP SIGNATURE-----=20 >> -----BEGIN PGP SIGNATURE-----=20 >> iF0EARECAB0WIQQP+UHquEepll566aqXCCyZOY1FIQUCW7DgxQAKCRCXCCyZOY1F=20 >> IW8GAJ9tlHBAzoC4LAVWCw09qF4MfwuhOQCg7MxVBI5MKea4aax2551/gQ28mlE=3D=20 >> =3DCZnI=20 >> -----END PGP SIGNATURE-----=20 >=20 --Apple-Mail=_48F3CD62-4048-475F-B345-1B3B1C48391A Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; = charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; = -webkit-nbsp-mode: space; line-break: after-white-space;" class=3D"">Hey = Kevin,<div class=3D"">I think I figured out a better regex for your = =E2=80=9CFL=E2=80=9D in both scity and dcity, regardless of order and = placement in the label =E2=80=A6</div><div class=3D""><br = class=3D""></div><div class=3D""> = (?=3D.*\bscity=3D[^:]+FL\b)(?=3D.*\bdcity=3D[^:]+FL\b).+</div><div = class=3D""><br class=3D""></div><div class=3D"">This will require that = you compile the clients with a pcre library, as some regex libraries = don=E2=80=99t support =E2=80=9C?=3D.=E2=80=9D repetition. That can = be specified at ./configure time .</div><div class=3D""><br = class=3D""><div class=3D"">Carter</div><div class=3D""><br = class=3D""><div><br class=3D""><blockquote type=3D"cite" class=3D""><div = class=3D"">On Oct 1, 2018, at 9:50 AM, Carter Bullard <<a = href=3D"mailto:[email protected]" class=3D"">[email protected]</a>> = wrote:</div><br class=3D"Apple-interchange-newline"><div class=3D""><meta = http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dutf-8" = class=3D""><div style=3D"word-wrap: break-word; -webkit-nbsp-mode: = space; line-break: after-white-space;" class=3D"">Hey Kevin,<div = class=3D"">Dave is right on the money, and great to see that you guys = got it working !! </div><div class=3D""><br = class=3D""></div><div class=3D"">You can search the label using regular = expressions (pcre style regex if you compiled that library in) just as = Dave indicates. You can use a simple regex like =E2=80=9CFL=E2=80=9D= to get the flows that have anything to do with =E2=80=98FL=E2=80=99 and = then do your own parsing to get exactly what you want, something = like:</div><div class=3D""><br class=3D""></div><div class=3D""> = ra -S localhost -M label=3D=E2=80=9CFL=E2=80=9D -s stime saddr = daddr proto spkts dpkts label -c,</div><div class=3D""><br = class=3D""></div><div class=3D"">And then process the label string to = get your values, or you can regex and match the FL as a part of = both the =E2=80=98scity=E2=80=99 and =E2=80=98dcity=E2=80=99 fields. = Something like:</div><div class=3D""><br class=3D""></div><div = class=3D""> -M label=3D=E2=80=9Cscity=3D.*FL.*dcity=3D.*FL=E2= =80=9D</div><div class=3D""><br class=3D""></div><div class=3D"">In = general, the labeler will put the scity, then the dcity values into the = label in that order, and should put the values you specify on the line = into the label, in the order given. But, because a previous = labeler could have put scity and/or dcity values in the label before you = put your values, you don=E2=80=99t know what the order of values maybe = for scity or dcity. When there are multiple values, ralabel and = radium have the ability to reorder values, so that it can deal with = duplicate values. Daves regex will match if FL is just after the = =E2=80=98=3D=E2=80=98 which will cover 95% of the scenarios. = I have multiple labelers, radium is always putting lat,lon = bounding boxes for IP addresses, so if I have something later putting in = city codes, it may end up at the end of a list of other objects that = apply to =E2=80=99scity=E2=80=99 or =E2=80=98dcity=E2=80=99. And = of course, the =E2=80=99scity=E2=80=99 and =E2=80=98dcity=E2=80=99 may = not be in that order =E2=80=A6 In this case the best regex may = be:</div><div class=3D""><br class=3D""></div><div class=3D""> = -M label=3D"(?=3D.*scity=3D.*FL)(?=3D.*dcity=3D.*FL)=E2=80=9D</div><= div class=3D""><br class=3D""></div><div class=3D"">This matches = scity=E2=80=A6FL and dcity=E2=80=A6FL regardless of the order in the = label. May still need some tweaking, but hopefully you get the = idea ...</div><div class=3D""><br class=3D""><div = class=3D"">Carter</div><div class=3D""><br class=3D""><div class=3D""><br = class=3D""><blockquote type=3D"cite" class=3D""><div class=3D"">On Sep = 30, 2018, at 10:42 AM, David Edelman <<a = href=3D"mailto:[email protected]" class=3D"">[email protected]</a>> = wrote:</div><br class=3D"Apple-interchange-newline"><div class=3D""><div = class=3D"WordSection1" style=3D"page: WordSection1; caret-color: rgb(0, = 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;"><div class=3D"">-----BEGIN PGP SIGNED = MESSAGE-----<span class=3D"Apple-converted-space"> </span><br = class=3D"">Hash: SHA1<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div class=3D"">Use the ra command line flag -M = label=3D=E2=80=99scity=3DFL.*dcity=3DFL=E2=80=99 I seem to = remember that regular expressions work for this filter. Use the single = quote to escape the *<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div class=3D""> <span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div class=3D"">If the regular expression = doesn=E2=80=99t work let me know. You can=E2=80=99t use ragrep since = that looks at theuser data portion of the flow, not the label = metadata.<o:p class=3D""></o:p></div><div class=3D""> <span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div class=3D"">- --Dave<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div class=3D""> <span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div class=3D"">From: Kevin Branch <<a = href=3D"mailto:[email protected]" style=3D"color: purple; = text-decoration: underline;" = class=3D"">[email protected]</a>><span = class=3D"Apple-converted-space"> </span><br class=3D"">Sent: = Saturday, September 29, 2018 11:14 PM<span = class=3D"Apple-converted-space"> </span><br class=3D"">To: David = Edelman <<a href=3D"mailto:[email protected]" style=3D"color: = purple; text-decoration: underline;" = class=3D"">[email protected]</a>><span = class=3D"Apple-converted-space"> </span><br class=3D"">Cc: Carter = Bullard <<a href=3D"mailto:[email protected]" style=3D"color: = purple; text-decoration: underline;" = class=3D"">[email protected]</a>>; Argus <<a = href=3D"mailto:[email protected]" style=3D"color: purple; = text-decoration: underline;" = class=3D"">[email protected]</a>><span = class=3D"Apple-converted-space"> </span><br class=3D"">Subject: Re: = [ARGUS] MaxMind GeoIP support in 3.0.8.2<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div class=3D""> <span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div class=3D"">David, thanks! That was the = missing piece.<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div class=3D""> <span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div class=3D"">I switched to<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div class=3D""> <span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D"">RALABEL_GEOIP_CITY=3D"saddr,daddr:region,cco"<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div class=3D""> <span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div class=3D"">and I saw what I wanted:<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div class=3D""> <span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div class=3D""># ra -r /argus/today/unt-01.arg = -N1 -w - | ralabel -f /etc/ralabel.conf -r - -s label:30 -N20<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> &nb= sp;  = ; Label<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = scity=3DFL,US:dcity=3DMO,US<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div class=3D""> <span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div class=3D"">All along I have been trying to = label source and destination IPs with state,country like above. It = took a fair bit of experimenting to get the state part figured out due = to that field being referred to as "reg" in the ralabel.conf comment = documentation while actually it has to be referenced as "region" to = work.<o:p class=3D""></o:p></div><div class=3D""> <span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div class=3D"">Now for my hopefully last = question: How can I have ra use that label content as search = criteria? I am trying to use ra to count up total traffic volume = seen where the source and destination IP are both in Florida. I = suspect ra will not let me use label, scity or dcity values as filter = criteria. Can ragrep help here? Or will I have to go the = rasqlinsert route to accomplish this?<o:p class=3D""></o:p></div><div = class=3D""> <span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div class=3D"">Thanks,<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div class=3D"">Kevin<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div class=3D""> <span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div class=3D""> <span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div class=3D"">On Sat, Sep 29, 2018 at 3:47 PM = David Edelman <<a href=3D"mailto:[email protected]" style=3D"color: = purple; text-decoration: underline;" = class=3D"">[email protected]</a><span = class=3D"Apple-converted-space"> </span><<a = href=3D"mailto:[email protected]" style=3D"color: purple; = text-decoration: underline;" class=3D"">mailto:[email protected]</a>> = > wrote:<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> -----BEGIN PGP = SIGNED MESSAGE-----<span class=3D"Apple-converted-space"> </span><br = class=3D""> Hash: SHA1<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> It looks like we = are almost there, you need to indicate which addresses need to have the = labels associated<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> Please change this = in your configuration file<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> <span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> <span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = RALABEL_GEOIP_CITY=3D"saddr,daddr:city "<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> <span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> This information = might help Looking at the code, the netmask is not functional<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> <span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> #<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = # Data for city relevant data is enabled through = enabling and configuring<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = # the city database support. The types of data = available are:<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = # country_code, country_code3, = country_name, region, city, postal_code,<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = # latitude, longitude, metro_code, = area_code and continent_code.<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = # time_offset is also = available.<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> #<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = # The concept is that you should be able to add = semantics for any<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = # IP address that is in the argus record. = Support addresses are:<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> #<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = # saddr, daddr, inode<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> #<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = # The labels provided will be tagged as:<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = # scity, dcity, icity<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> #<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = # To configure what you want to have placed in the = label, use the list of<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = # objects, in whatever order you like, as the = RALABEL_GEOPIP_CITY string<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = # using these keywords:<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = # cco - = country_code<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = # cco3 - country_code3<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = # cname - country_name<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = # reg - region<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = # city - city<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = # pcode - postal_code<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = # lat - latitude<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = # long - longitude<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = # metro - metro_code<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = # area - area_code<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = # cont - continent_code<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = # netmask - netmask value<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> #<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = # Working examples could be:<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = # = RALABEL_GEOIP_CITY=3D"saddr,daddr:lat/lon"<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = # = RALABEL_GEOIP_CITY=3D"*:city,region,cname,lat,lon"<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> #<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = #RALABEL_GEOIP_CITY=3D"saddr,daddr,inode:off,cont,lat,lon"<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = #RALABEL_GEOIP_CITY_FILE=3D"/usr/local/share/GeoIP/GeoIP.dat"<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> <span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> <span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> <span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> - --Dave<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> <span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> <span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> <span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> From: Kevin Branch = <<a href=3D"mailto:[email protected]" style=3D"color: = purple; text-decoration: underline;" = class=3D"">[email protected]</a><span = class=3D"Apple-converted-space"> </span><<a = href=3D"mailto:[email protected]" style=3D"color: purple; = text-decoration: underline;" = class=3D"">mailto:[email protected]</a>> ><span = class=3D"Apple-converted-space"> </span><br = class=3D""> Sent: Saturday, = September 29, 2018 11:57 AM<span = class=3D"Apple-converted-space"> </span><br = class=3D""> To: Carter Bullard = <<a href=3D"mailto:[email protected]" style=3D"color: purple; = text-decoration: underline;" class=3D"">[email protected]</a><span = class=3D"Apple-converted-space"> </span><<a = href=3D"mailto:[email protected]" style=3D"color: purple; = text-decoration: underline;" class=3D"">mailto:[email protected]</a>> = ><span class=3D"Apple-converted-space"> </span><br = class=3D""> Cc: David Edelman = <<a href=3D"mailto:[email protected]" style=3D"color: purple; = text-decoration: underline;" class=3D"">[email protected]</a><span = class=3D"Apple-converted-space"> </span><<a = href=3D"mailto:[email protected]" style=3D"color: purple; = text-decoration: underline;" class=3D"">mailto:[email protected]</a>> = >; Argus <<a href=3D"mailto:[email protected]" = style=3D"color: purple; text-decoration: underline;" = class=3D"">[email protected]</a><span = class=3D"Apple-converted-space"> </span><<a = href=3D"mailto:[email protected]" style=3D"color: purple; = text-decoration: underline;" = class=3D"">mailto:[email protected]</a>> ><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> Subject: Re: = [ARGUS] MaxMind GeoIP support in 3.0.8.2<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> <span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> Hi Carter and = David,<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> <span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> I just tried the = following with the same ralabel.conf as before:<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = ra -r /argus/today/unt-01.arg = -w - | ralabel -f /etc/ralabel.conf -r - -s label:200 -N20<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> and saw = this. Looks like I was using the wrong syntax which I am glad to = know better now, but the GeoIP lookups are still not happening:<o:p = class=3D""></o:p></div><div = class=3D""> = "scity=3D:dcity=3D"<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = "scity=3D:dcity=3D"<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = "scity=3D:dcity=3D"<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = "scity=3D:dcity=3D"<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = "scity=3D:dcity=3D"<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = "scity=3D:dcity=3D"<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = "scity=3D:dcity=3D"<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = "scity=3D:dcity=3D"<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = "scity=3D:dcity=3D"<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = "scity=3D:dcity=3D"<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = "scity=3D:dcity=3D"<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = "scity=3D:dcity=3D"<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> <span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> I know the data = file is good because it works with this:<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = # geoiplookup -f = /usr/local/share/GeoIP/GeoIPCity.dat 207.48.48.19<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = GeoIP City Edition, Rev 1: = US, MO, Missouri, Chesterfield, 63017, 38.650002, -90.533401, 609, = 314<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = <span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> In case it helps, = I rebuilt argus-clients with the .debug flag file present and then ran = this command limited to only a single argus record that I independently = confirmed has a srcip value known to geoiplookup<o:p = class=3D""></o:p></div><div = class=3D""> = # ra -r = /argus/today/unt-01.arg -N1 -w - | ralabel -f /etc/ralabel.conf -r - -s = label:50 -N200 -D3<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.950161 ArgusNewLabeler = (0x7f8eff3f7010, 0) returning 0x1b057c0<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.959656 = RaLabelParseResourceFile (/etc/ralabel.conf) returning 0<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.959730 ArgusReadConnection() = read 16 bytes<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.959748 ArgusReadConnection() = read 112 bytes<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961133 ArgusInitAddrtoname = (0x7f8eff3f7010, 0xa9fe6700, 0xffffff00)<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961145 = ArgusParseInit(0x7f8eff3f7010 0x7f8eff386010<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961155 = ArgusReadConnection(0xff386010, 1) returning 1<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961329 ArgusAddToRecordLabel = (0x7f8eff3f7010, 0x1b188c0, scity=3D:dcity=3D) returning 0<o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; = &n= bsp; Label<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; = scity=3D:dcity=3D<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961385 = ArgusCloseInput(0xff386010) closing<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961408 = ArgusCloseInput(0xff386010) done<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961415 main: = ArgusReadFileStream (-) done<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961426 main: reading files = completed<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961432 ArgusShutDown (0)<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961439 RaParseComplete (0) = returning<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961444 RaParseComplete(caught = signal 0)<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = <span = class=3D"Apple-converted-space"> </span><a = href=3D"mailto:[email protected]" style=3D"color: purple; = text-decoration: underline;" = class=3D"">[email protected]</a>:~/argus-clients-3.0.8# <<a = href=3D"mailto:[email protected]:~/argus-clients-3.0.8" = style=3D"color: purple; text-decoration: underline;" = class=3D"">mailto:[email protected]:~/argus-clients-3.0.8</a>#>&nbs= p; <<a href=3D"mailto:[email protected]:~/argus-clients-3.0.8" = style=3D"color: purple; text-decoration: underline;" = class=3D"">mailto:[email protected]:~/argus-clients-3.0.8</a>#>&nbs= p; ra -r /argus/today/unt-01.arg -N1 -w - | ralabel -f /etc/ralabel.conf = -r - -s label:50 -N200 -D8<o:p class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.374433 ArgusFree = (0x26b2250)<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.374461 ArgusFree = (0x26b22b0)<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.374469 ArgusFree = (0x26b2310)<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.374474 ArgusFree = (0x26b2370)<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.374479 ArgusFree = (0x26b23d0)<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.374484 ArgusFree = (0x26b2430)<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.374489 ArgusFree = (0x26b2490)<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.374494 ArgusFree = (0x26b24f0)<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.374499 ArgusFree = (0x26b2550)<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.374504 ArgusFree = (0x26b25b0)<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.374509 ArgusFree = (0x26b2610)<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.374533 ArgusCalloc (1, 80) = returning 0x26b2610<span class=3D"Apple-converted-space"> </span><o:p= class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.374544 ArgusCalloc (1, 296) = returning 0x26b27c0<span class=3D"Apple-converted-space"> </span><o:p= class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.374566 ArgusCalloc (1, 112) = returning 0x26b2950<span class=3D"Apple-converted-space"> </span><o:p= class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.374577 ArgusCalloc (1, 80) = returning 0x26b25b0<span class=3D"Apple-converted-space"> </span><o:p= class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.374595 ArgusNewQueue () = returning 0x26b25b0<span class=3D"Apple-converted-space"> </span><o:p= class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.374613 ArgusCalloc (65536, 8) = returning 0x2849a010<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.374619 ArgusNewLabeler = (0x7fa329100010, 0) returning 0x26b27c0<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.384352 RaLabelParseResourceFile = (/etc/ralabel.conf) returning 0<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.384387 ArgusCalloc (1, 560) = returning 0x26b2250<span class=3D"Apple-converted-space"> </span><o:p= class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.384411 ArgusCalloc (1, 112) = returning 0x26b2e80<span class=3D"Apple-converted-space"> </span><o:p= class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.384418 ArgusCalloc (1, 80) = returning 0x26b2f00<span class=3D"Apple-converted-space"> </span><o:p= class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.384424 ArgusNewQueue () = returning 0x26b2f00<span class=3D"Apple-converted-space"> </span><o:p= class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.384430 ArgusCalloc (1, 56) = returning 0x26b2f60<span class=3D"Apple-converted-space"> </span><o:p= class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.384454 ArgusCalloc (65536, 8) = returning 0x27358010<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.384461 ArgusNewHashTable = (65536) returning 0x26b2f60<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.384483 ArgusReadConnection() = read 16 bytes<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.384498 ArgusReadConnection() = read 112 bytes<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.384514 ArgusCalloc (1, 4194304) = returning 0x26f57010<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.384523 ArgusCalloc (1, 262144) = returning 0x26f16010<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.385934 ArgusInitAddrtoname = (0x7fa329100010, 0xa9fe6700, 0xffffff00)<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.385947 = ArgusParseInit(0x7fa329100010 0x7fa32908f010<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.385956 = ArgusReadConnection(0x2908f010, 1) returning 1<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.385969 ArgusReadFileStream() = starting<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.385981 ArgusReadStreamSocket = (0x7fa32908f010) read 380 bytes<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386015 ArgusCalloc (1, 384) = returning 0x26c58c0<span class=3D"Apple-converted-space"> </span><o:p= class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386025 ArgusCalloc (1, 12) = returning 0x26c5a50<span class=3D"Apple-converted-space"> </span><o:p= class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386031 ArgusCalloc (1, 80) = returning 0x26c5a70<span class=3D"Apple-converted-space"> </span><o:p= class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386037 ArgusCalloc (1, 36) = returning 0x26c5ad0<span class=3D"Apple-converted-space"> </span><o:p= class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386042 ArgusCalloc (1, 52) = returning 0x26c5b00<span class=3D"Apple-converted-space"> </span><o:p= class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386047 ArgusCalloc (1, 80) = returning 0x26c5b40<span class=3D"Apple-converted-space"> </span><o:p= class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386053 ArgusCalloc (1, 120) = returning 0x26c5ba0<span class=3D"Apple-converted-space"> </span><o:p= class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386058 ArgusCalloc (1, 8) = returning 0x26c5c20<span class=3D"Apple-converted-space"> </span><o:p= class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386063 ArgusCalloc (1, 164) = returning 0x26c5c40<span class=3D"Apple-converted-space"> </span><o:p= class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386070 ArgusCalloc (1, 20) = returning 0x26c5cf0<span class=3D"Apple-converted-space"> </span><o:p= class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386075 ArgusCalloc (1, 20) = returning 0x26c5d10<span class=3D"Apple-converted-space"> </span><o:p= class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386080 ArgusCalloc (1, 12) = returning 0x26c5d30<span class=3D"Apple-converted-space"> </span><o:p= class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386092 ArgusCalloc (1, 16) = returning 0x26c5d50<span class=3D"Apple-converted-space"> </span><o:p= class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386131 ArgusCalloc (1, 12) = returning 0x26c5e80<span class=3D"Apple-converted-space"> </span><o:p= class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386234 ArgusAddToRecordLabel = (0x7fa329100010, 0x26c58c0, scity=3D:dcity=3D) returning 0<o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; = &n= bsp; Label<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; = scity=3D:dcity=3D<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386280 ArgusFree = (0x26c5a50)<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386287 ArgusFree = (0x26c5a70)<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386292 ArgusFree = (0x26c5ad0)<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386297 ArgusFree = (0x26c5b00)<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386301 ArgusFree = (0x26c5b40)<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386304 ArgusFree = (0x26c5ba0)<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386308 ArgusFree = (0x26c5c20)<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386312 ArgusFree = (0x26c5c40)<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386316 ArgusFree = (0x26c5cf0)<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386322 ArgusFree = (0x26c5d10)<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386359 ArgusFree = (0x26c5d30)<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386369 ArgusFree = (0x26c5e80)<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386377 ArgusFree = (0x26c5d50)<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386384 ArgusFree = (0x26c58c0)<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386392 RaProcessRecord = (0x2908f630) returning<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386400 RaScheduleRecord = (0x7fa329100010, 0x7fa32908f630) scheduled<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386408 ArgusHandleRecord = (0x7fa326f57010, 0x7fa329221800) returning 380<o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386417 ArgusReadStreamSocket = (0x7fa32908f010) returning 0<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386432 ArgusReadStreamSocket = (0x7fa32908f010) read 0 bytes<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386439 ArgusReadStreamSocket = (0x7fa32908f010) returning 1<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386447 = ArgusCloseInput(0x2908f010) closing<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386463 ArgusFree = (0x7fa326f57010)<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386473 ArgusFree = (0x7fa326f16010)<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386492 = ArgusCloseInput(0x2908f010) done<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386500 ArgusReadFileStream() = returning<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386508 main: = ArgusReadFileStream (-) done<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386522 ArgusFree = (0x7fa32908f010)<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386529 main: reading files = completed<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386536 ArgusShutDown (0)<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386546 ArgusFree = (0x26b2190)<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386553 ArgusDeleteQueue = (0x26b2190) returning<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386561 ArgusFree = (0x26b21f0)<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386569 ArgusDeleteQueue = (0x26b21f0) returning<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386599 RaParseComplete (0) = returning<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = = ralabel[4462.40472429a37f0000]: 15:53:24.386608 RaParseComplete(caught = signal 0)<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = <span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> Thanks for looking = at this,<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> Kevin<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> <span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> <span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> On Sat, Sep 29, = 2018 at 11:18 AM Carter Bullard <<a href=3D"mailto:[email protected]" = style=3D"color: purple; text-decoration: underline;" = class=3D"">[email protected]</a><span = class=3D"Apple-converted-space"> </span><<a = href=3D"mailto:[email protected]" style=3D"color: purple; = text-decoration: underline;" = class=3D"">mailto:[email protected]</a>> <<a = href=3D"mailto:[email protected]" style=3D"color: purple; = text-decoration: underline;" class=3D"">mailto:[email protected]</a>> = > wrote:<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = Hey Kevin,<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = Any success ???<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = Carter<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> Carter Bullard =E2=80= =A2 CTO <<a href=3D"http://qosient.com/" style=3D"color: purple; = text-decoration: underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> 150 E 57th Street = Suite 12D <<a href=3D"http://qosient.com/" style=3D"color: purple; = text-decoration: underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> New York, New York = 10022-2795 <<a href=3D"http://qosient.com/" style=3D"color: purple; = text-decoration: underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> Phone = +1.212.588.9133 =E2=80=A2 Mobile +1.917.497.9494 <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = <span = class=3D"Apple-converted-space"> </span><br = class=3D""> = On Sep 28, 2018, at 9:40 PM, = David Edelman <<a href=3D"mailto:[email protected]" style=3D"color: = purple; text-decoration: underline;" = class=3D"">[email protected]</a><span = class=3D"Apple-converted-space"> </span><<a = href=3D"mailto:[email protected]" style=3D"color: purple; = text-decoration: underline;" class=3D"">mailto:[email protected]</a>> = > wrote: <<a href=3D"http://qosient.com/" style=3D"color: purple; = text-decoration: underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; -----BEGIN PGP SIGNED MESSAGE-----<span = class=3D"Apple-converted-space"> </span><br = class=3D""> = &n= bsp; Hash: SHA1 <<a href=3D"http://qosient.com/" = style=3D"color: purple; text-decoration: underline;" = class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; Please try this: <<a href=3D"http://qosient.com/" = style=3D"color: purple; text-decoration: underline;" = class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; # ra -r /argus/today/unt-01.arg -w - | ralabel -f = /etc/ralabel.conf -r - -s label:200 -N20 <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; <<a href=3D"http://qosient.com/" = style=3D"color: purple; text-decoration: underline;" = class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; From: Argus-info <<a = href=3D"mailto:[email protected]= u" style=3D"color: purple; text-decoration: underline;" = class=3D"">[email protected]</a= ><<a href=3D"mailto:[email protected]" style=3D"color: = purple; text-decoration: underline;" = class=3D"">mailto:[email protected]</a>> > On Behalf = Of Kevin Branch<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; Sent: Friday, September 28, 2018 5:25 PM<span = class=3D"Apple-converted-space"> </span><br = class=3D""> = &n= bsp; To: Carter Bullard <<a = href=3D"mailto:[email protected]" style=3D"color: purple; = text-decoration: underline;" class=3D"">[email protected]</a><span = class=3D"Apple-converted-space"> </span><<a = href=3D"mailto:[email protected]" style=3D"color: purple; = text-decoration: underline;" class=3D"">mailto:[email protected]</a>> = ><span class=3D"Apple-converted-space"> </span><br = class=3D""> = &n= bsp; Cc: Argus <<a = href=3D"mailto:[email protected]" style=3D"color: purple; = text-decoration: underline;" = class=3D"">[email protected]</a><span = class=3D"Apple-converted-space"> </span><<a = href=3D"mailto:[email protected]" style=3D"color: purple; = text-decoration: underline;" = class=3D"">mailto:[email protected]</a>> ><span = class=3D"Apple-converted-space"> </span><br = class=3D""> = &n= bsp; Subject: Re: [ARGUS] MaxMind GeoIP support in 3.0.8.2 = <<a href=3D"http://qosient.com/" style=3D"color: purple; = text-decoration: underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; <<a href=3D"http://qosient.com/" = style=3D"color: purple; text-decoration: underline;" = class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; Looks like GeoIP is linked in already: <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; <<a href=3D"http://qosient.com/" = style=3D"color: purple; text-decoration: underline;" = class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; # ldd `which ralabel`<span = class=3D"Apple-converted-space"> </span><br = class=3D""> = &n= bsp; = linux-vdso.so.1 =3D> (0x00007ffddaf8a000)<span = class=3D"Apple-converted-space"> </span><br = class=3D""> = &n= bsp; = libm.so.6 =3D> /lib/x86_64-linux-gnu/libm.so.6 = (0x00007f5fe67c9000)<span class=3D"Apple-converted-space"> </span><br= class=3D""> = &n= bsp; = libpthread.so.0 =3D> /lib/x86_64-linux-gnu/libpthread.so.0 = (0x00007f5fe65ab000)<span class=3D"Apple-converted-space"> </span><br= class=3D""> = &n= bsp; = libGeoIP.so.1 =3D> /usr/lib/x86_64-linux-gnu/libGeoIP.so.1 = (0x00007f5fe637c000)<span class=3D"Apple-converted-space"> </span><br= class=3D""> = &n= bsp; = libc.so.6 =3D> /lib/x86_64-linux-gnu/libc.so.6 = (0x00007f5fe5fb3000)<span class=3D"Apple-converted-space"> </span><br= class=3D""> = &n= bsp; = /lib64/ld-linux-x86-64.so.2 (0x00007f5fe6acf000) <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; <<a href=3D"http://qosient.com/" = style=3D"color: purple; text-decoration: underline;" = class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; I switched to just "lat,lon" like you suggested in = ralabel.conf: <<a href=3D"http://qosient.com/" style=3D"color: = purple; text-decoration: underline;" = class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; <<a href=3D"http://qosient.com/" = style=3D"color: purple; text-decoration: underline;" = class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; # cat /etc/ralabel.conf <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; = RALABEL_ARIN_COUNTRY_CODES=3Dno <<a href=3D"http://qosient.com/" = style=3D"color: purple; text-decoration: underline;" = class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; = <<a href=3D"http://qosient.com/" style=3D"color: purple; = text-decoration: underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; = RALABEL_GEOIP_ASN=3Dyes <<a href=3D"http://qosient.com/" = style=3D"color: purple; text-decoration: underline;" = class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; = RALABEL_GEOIP_ASN_FILE=3D"/usr/local/share/GeoIP/GeoIPASNum.dat" <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; = <<a href=3D"http://qosient.com/" style=3D"color: purple; = text-decoration: underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; = RALABEL_GEOIP_CITY=3D"lat,lon" <<a href=3D"http://qosient.com/" = style=3D"color: purple; text-decoration: underline;" = class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; = RALABEL_GEOIP_CITY_FILE=3D"/usr/local/share/GeoIP/GeoIPCity.dat" <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; <<a href=3D"http://qosient.com/" = style=3D"color: purple; text-decoration: underline;" = class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; But I don't see anything but ASNs getting added in: = <<a href=3D"http://qosient.com/" style=3D"color: purple; = text-decoration: underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; <<a href=3D"http://qosient.com/" = style=3D"color: purple; text-decoration: underline;" = class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; # ra -r /argus/today/unt-01.arg -w - | ralabel -f = /etc/ralabel.conf -r - -s sas,das,scity,dcity,icity | head -n20 <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; sAS dAS <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; 4323 <<a href=3D"http://qosient.com/" = style=3D"color: purple; text-decoration: underline;" = class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; 4323 <<a href=3D"http://qosient.com/" = style=3D"color: purple; text-decoration: underline;" = class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; 4323 <<a href=3D"http://qosient.com/" = style=3D"color: purple; text-decoration: underline;" = class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; 22927 4323 <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; 6582 4323 <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; 7018 4323 <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; 4323 3 <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; 4323 <<a href=3D"http://qosient.com/" = style=3D"color: purple; text-decoration: underline;" = class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; 4323 15169 <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; 4323 <<a href=3D"http://qosient.com/" = style=3D"color: purple; text-decoration: underline;" = class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; 4323 <<a href=3D"http://qosient.com/" = style=3D"color: purple; text-decoration: underline;" = class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; 4323 15169 <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; 4323 21928 <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; 2828 4323 <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; <<a href=3D"http://qosient.com/" = style=3D"color: purple; text-decoration: underline;" = class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; Thoughts? <<a href=3D"http://qosient.com/" = style=3D"color: purple; text-decoration: underline;" = class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; Kevin <<a href=3D"http://qosient.com/" style=3D"color:= purple; text-decoration: underline;" = class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; <<a href=3D"http://qosient.com/" = style=3D"color: purple; text-decoration: underline;" = class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; On Fri, Sep 28, 2018 at 2:36 PM Carter Bullard <<a = href=3D"mailto:[email protected]" style=3D"color: purple; = text-decoration: underline;" class=3D"">[email protected]</a><span = class=3D"Apple-converted-space"> </span><<a = href=3D"mailto:[email protected]" style=3D"color: purple; = text-decoration: underline;" = class=3D"">mailto:[email protected]</a>> <<a = href=3D"mailto:[email protected]" style=3D"color: purple; = text-decoration: underline;" class=3D"">mailto:[email protected]</a>> = > wrote: <<a href=3D"http://qosient.com/" style=3D"color: purple; = text-decoration: underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; Hey = Kevin, <<a href=3D"http://qosient.com/" style=3D"color: purple; = text-decoration: underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; If you = do a ./configure =E2=80=94help you=E2=80=99ll see all the options that = ./configure supports. If you specify =E2=80=94with-GeoIP it wants = the directory where the GeoIP library is. <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; =E2=80=94with-GeoIP=3DDIR. compile with GeoIP in <dir> <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; = <<a href=3D"http://qosient.com/" style=3D"color: purple; = text-decoration: underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; You can = check if the library is bound to the client binaries with ldd =E2=80=A6 = <<a href=3D"http://qosient.com/" style=3D"color: purple; = text-decoration: underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; ldd `which ralabel` <<a href=3D"http://qosient.com/" = style=3D"color: purple; text-decoration: underline;" = class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; = <<a href=3D"http://qosient.com/" style=3D"color: purple; = text-decoration: underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; If = you=E2=80=99re already bound, the city stuff should work =E2=80=A6. = I=E2=80=99m not familiar with =E2=80=9Creg,cco=E2=80=9D as GeoIP City = objects off the top of my head. I=E2=80=99m familiar with = =E2=80=9Coff,cont,lat,lon,region,city,cname=E2=80=9D. Maybe try = lat,lon as a test, as I use that all the time .. <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; = <<a href=3D"http://qosient.com/" style=3D"color: purple; = text-decoration: underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; Carter = <<a href=3D"http://qosient.com/" style=3D"color: purple; = text-decoration: underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; <span = class=3D"Apple-converted-space"> </span><br = class=3D""> = &n= bsp; &nbs= p; <<a href=3D"http://qosient.com/" style=3D"color: purple; = text-decoration: underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; <span = class=3D"Apple-converted-space"> </span><br = class=3D""> = &n= bsp; <span = class=3D"Apple-converted-space"> </span><br = class=3D""> = &n= bsp; <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; On Sep 28, 2018, at 1:59 PM, = Kevin Branch <<a href=3D"mailto:[email protected]" = style=3D"color: purple; text-decoration: underline;" = class=3D"">[email protected]</a><<a = href=3D"mailto:[email protected]" style=3D"color: purple; = text-decoration: underline;" = class=3D"">mailto:[email protected]</a>> <<a = href=3D"mailto:[email protected]" style=3D"color: purple; = text-decoration: underline;" = class=3D"">mailto:[email protected]</a>> > wrote: = <<a href=3D"http://qosient.com/" style=3D"color: purple; = text-decoration: underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; Hi Carter, <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; I was just trying today to make = ralabel on argus 3.0.8.2 do GeoIP labeling with GeoIPCity.dat, but even = though the file referred to in ralabel.conf for that purpose exists, no = GeoIP labeling takes place. ASN lookups work great, = but ralabel never adds any scity or dcity fields. <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; My ralabel.conf: <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; = RALABEL_ARIN_COUNTRY_CODES=3Dno <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; = <<a href=3D"http://qosient.com/" style=3D"color: = purple; text-decoration: underline;" = class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; = RALABEL_GEOIP_ASN=3Dyes <<a href=3D"http://qosient.com/" = style=3D"color: purple; text-decoration: underline;" = class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; = = RALABEL_GEOIP_ASN_FILE=3D"/usr/local/share/GeoIP/GeoIPASNum.dat" <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; = <<a href=3D"http://qosient.com/" style=3D"color: = purple; text-decoration: underline;" = class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; = RALABEL_GEOIP_CITY=3D"reg,cco" <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; = = RALABEL_GEOIP_CITY_FILE=3D"/usr/local/share/GeoIP/GeoIPCity.dat" <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; No errors are thrown by = ralabel. I thought maybe I needed to specially compile in GeoIP = support like I read about here: <span = class=3D"Apple-converted-space"> </span><a = href=3D"https://qosient.com/argus/geolocation.shtml" style=3D"color: = purple; text-decoration: underline;" = class=3D"">https://qosient.com/argus/geolocation.shtml</a><span = class=3D"Apple-converted-space"> </span><<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; but when I run "./configure = --with-GeoIP=3Dyes" it throws this error: <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; = configure: WARNING: unrecognized options: --with-GeoIP = <<a href=3D"http://qosient.com/" style=3D"color: purple; = text-decoration: underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; However, I presume the fact that = ASN lookups work means that MaxMind GeoIP support libraries are already = installed, and presumably installed by default in the latest argus now. = <<a href=3D"http://qosient.com/" style=3D"color: purple; = text-decoration: underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; # ra -r /argus/today/unt-01.arg = -w - | ralabel -f /etc/ralabel.conf -r - -s sas,das,scity,dcity,icity | = head -n20 <<a href=3D"http://qosient.com/" style=3D"color: purple; = text-decoration: underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; = sAS dAS <<a href=3D"http://qosient.com/" = style=3D"color: purple; text-decoration: underline;" = class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; 4323 <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; 4323 <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; 4323 <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; 22927 4323 = <<a href=3D"http://qosient.com/" style=3D"color: purple; = text-decoration: underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; 6582 4323 = <<a href=3D"http://qosient.com/" style=3D"color: purple; = text-decoration: underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; 7018 4323 = <<a href=3D"http://qosient.com/" style=3D"color: purple; = text-decoration: underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; = 4323 3 <<a href=3D"http://qosient.com/" = style=3D"color: purple; text-decoration: underline;" = class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; 4323 <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; 4323 15169 = <<a href=3D"http://qosient.com/" style=3D"color: purple; = text-decoration: underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; 4323 <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; 4323 <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; 4323 15169 = <<a href=3D"http://qosient.com/" style=3D"color: purple; = text-decoration: underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; 4323 21928 = <<a href=3D"http://qosient.com/" style=3D"color: purple; = text-decoration: underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; 2828 4323 = <<a href=3D"http://qosient.com/" style=3D"color: purple; = text-decoration: underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; Any thoughts on what I am missing = or how I might further debug this issue? <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; Thanks! <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; &nbs= p; Kevin <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; <spa= n class=3D"Apple-converted-space"> </span><br = class=3D""> = &n= bsp; -----BEGIN PGP SIGNATURE----- <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = &n= bsp; = iF0EARECAB0WIQQP+UHquEepll566aqXCCyZOY1FIQUCW67X6gAKCRCXCCyZOY1F<span = class=3D"Apple-converted-space"> </span><br = class=3D""> = &n= bsp; = IdLwAKDv6tPpe7OwLBEEfM1YTnAD8MxZCgCeOlGEEuEIUvqlyIMh8CPBWctmBd0=3D<span = class=3D"Apple-converted-space"> </span><br = class=3D""> = &n= bsp; =3Dp/tg<span = class=3D"Apple-converted-space"> </span><br = class=3D""> = &n= bsp; -----END PGP SIGNATURE----- <<a = href=3D"http://qosient.com/" style=3D"color: purple; text-decoration: = underline;" class=3D"">http://qosient.com/</a>><span = class=3D"Apple-converted-space"> </span><br = class=3D""> -----BEGIN PGP = SIGNATURE-----<span class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D""> = iF0EARECAB0WIQQP+UHquEepll566aqXCCyZOY1FIQUCW6/WuAAKCRCXCCyZOY1F<span = class=3D"Apple-converted-space"> </span><br = class=3D""> = IYGaAKDk/9QFqcgbEWN6bN9eMNitGAXU7ACfduIQKuGR7lsDTCkdRogye0u8TxM=3D<span = class=3D"Apple-converted-space"> </span><br = class=3D""> =3DeoBH<span = class=3D"Apple-converted-space"> </span><br = class=3D""> -----END PGP = SIGNATURE-----<span class=3D"Apple-converted-space"> </span><br = class=3D"">-----BEGIN PGP SIGNATURE-----<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div><div = class=3D"">iF0EARECAB0WIQQP+UHquEepll566aqXCCyZOY1FIQUCW7DgxQAKCRCXCCyZOY1= F<span class=3D"Apple-converted-space"> </span><br = class=3D"">IW8GAJ9tlHBAzoC4LAVWCw09qF4MfwuhOQCg7MxVBI5MKea4aax2551/gQ28mlE= =3D<span class=3D"Apple-converted-space"> </span><br = class=3D"">=3DCZnI<span class=3D"Apple-converted-space"> </span><br = class=3D"">-----END PGP SIGNATURE-----<span = class=3D"Apple-converted-space"> </span><o:p = class=3D""></o:p></div></div></div></blockquote></div><br = class=3D""></div></div></div></div></blockquote></div><br = class=3D""></div></div></body></html>= --Apple-Mail=_48F3CD62-4048-475F-B345-1B3B1C48391A-- --Apple-Mail=_A4F9A559-2048-4A6D-8FBA-0C5077850634 Content-Disposition: attachment; filename=smime.p7s Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIMfzCCBjkw ggUhoAMCAQICAi9KMA0GCSqGSIb3DQEBBQUAMHAxCzAJBgNVBAYTAlVTMRgwFgYDVQQKEw9VLlMu IEdvdmVybm1lbnQxDDAKBgNVBAsTA0VDQTEiMCAGA1UECxMZQ2VydGlmaWNhdGlvbiBBdXRob3Jp dGllczEVMBMGA1UEAxMMT1JDIEVDQSBTVyA1MB4XDTE2MDQyMTE0NTIyMFoXDTE5MDQyMDE0NTIy MFowgYYxCzAJBgNVBAYTAlVTMRgwFgYDVQQKEw9VLlMuIEdvdmVybm1lbnQxDDAKBgNVBAsTA0VD QTEMMAoGA1UECxMDT1JDMRQwEgYDVQQLEwtRb1NpZW50IExMQzErMCkGA1UEAxMiQnVsbGFyZC5X aWxsaWFtLkMuT1JDMTAwMDAzNzEwMS5JRDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB ANH6wFljIqTSG24iCguRKRXuVSd+j+Kd6bqupbNZl6sDbpXmWHqPUtAjEsDTQ1+IdUnaeS+n3/YJ xGWM1XzUuKCecSLQ+ntBdgCB37Bh8erLRDZm4UedsSap3x2MnEYoZ1i8PyStV5Ul6i5LmK7ZhwLg x7uM7rNrxMWbBxN/+Wv2gyX7FtchW2Txg+zItNkGZRa91v3/B+KlNNfo6bc3NM0K9KXrB3Ny3npq UYCL92T6fd9RSj1I162GOvssVYz9VN4+XIsORq91cg0Wz8fy7Jav5KODCd8ucq/7N/FvDiRvLUCH 8PXyXfoh0sQc9IgQMK1AZQlcXSrBYoR3ZkX/AsMCAwEAAaOCAsQwggLAMB8GA1UdIwQYMBaAFLwP dwuNo7OFQ8I2k2asAql3wz1SMB0GA1UdDgQWBBQ2fPubIDMNKIiq3FHKp7g2gsTiFzCCASMGCCsG AQUFBwEBBIIBFTCCAREwHgYIKwYBBQUHMAGGEmh0dHA6Ly9ldmEub3JjLmNvbTAyBggrBgEFBQcw AoYmaHR0cDovL2VjYS5vcmMuY29tL2NhQ2VydHMvRUNBLVNXNS5wN2MwgboGCCsGAQUFBzAChoGt bGRhcDovL2VjYS1kcy5vcmMuY29tL2NuJTNkT1JDJTIwRUNBJTIwU1clMjA1JTJjb3UlM2RDZXJ0 aWZpY2F0aW9uJTIwQXV0aG9yaXRpZXMlMmNvdSUzZEVDQSUyY28lM2RVLlMuJTIwR292ZXJubWVu dCUyY2MlM2RVUz9jQUNlcnRpZmljYXRlO2JpbmFyeSxjcm9zc0NlcnRpZmljYXRlUGFpcjtiaW5h cnkwDgYDVR0PAQH/BAQDAgbAMB0GA1UdEQQWMBSBEmNhcnRlckBxb3NpZW50LmNvbTAXBgNVHSAE EDAOMAwGCmCGSAFlAwIBDAEwgfEGA1UdHwSB6TCB5jAroCmgJ4YlaHR0cDovL2VjYS5vcmMuY29t L0NSTHMvT1JDRUNBU1c1LmNybDCBtqCBs6CBsIaBrWxkYXA6Ly9lY2EtZHMub3JjLmNvbTozODkv Y24lM0RPUkMlMjBFQ0ElMjBTVyUyMDUlMkMlMjBvdSUzRENlcnRpZmljYXRpb24lMjBBdXRob3Jp dGllcyUyQyUyMG91JTNERUNBJTJDJTIwbyUzRFUuUy4lMjBHb3Zlcm5tZW50JTJDJTIwYyUzRFVT P2NlcnRpZmljYXRlUmV2b2NhdGlvbkxpc3Q7YmluYXJ5MBsGA1UdCQQUMBIwEAYIKwYBBQUHCQQx BBMCVVMwDQYJKoZIhvcNAQEFBQADggEBAAkMoOFvsrwavbMIXgi3AiID+bGLUfsKxxSrvo0S1kej KhSdt+LXl+BCdf9kU8SwBXHH8iy6maLxEKFOPrsXGp9ZnyOx1vfw+J9S0jYqp/fU9IFTSPPm8Khv Fv8rfL11EbAtbHm586rrMsPe2FhwWZTIm2ji0QpYl2zj/GO6sC6WvwQRJ5m+bkqbPPGiF8sJuMlO UgatWlSZ5NhPcDBV2c2s0J2xVIKPJla8BUh3os2F5amQ8FVodQ7tWV5YaqaJb0Tv2RAnZXR2fwWD WQHzmO/aXOs6kHjcuIgrfniHr2aEBBmJHhBqFjWBAVWcpv5iyl3ncnyWDvIFa416d73GXPUwggY+ MIIFJqADAgECAgIvSzANBgkqhkiG9w0BAQUFADBwMQswCQYDVQQGEwJVUzEYMBYGA1UEChMPVS5T LiBHb3Zlcm5tZW50MQwwCgYDVQQLEwNFQ0ExIjAgBgNVBAsTGUNlcnRpZmljYXRpb24gQXV0aG9y aXRpZXMxFTATBgNVBAMTDE9SQyBFQ0EgU1cgNTAeFw0xNjA0MjExNDUzNDBaFw0xOTA0MjAxNDUz NDBaMIGLMQswCQYDVQQGEwJVUzEYMBYGA1UEChMPVS5TLiBHb3Zlcm5tZW50MQwwCgYDVQQLEwNF Q0ExDDAKBgNVBAsTA09SQzEUMBIGA1UECxMLUW9TaWVudCBMTEMxMDAuBgNVBAMTJ0J1bGxhcmQu V2lsbGlhbS5DLk9SQzEwMDAwMzcxMDEuRW5jcnlwdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBAMiLLDCrphBIUmeFdgZD5vBlSaNhBo1dZM2sR+eHD4vdoUFznPh87zBtIKwuKCYmlU0M X/5Jw1wHngilWKwPnTkC5eZjgCUXz/mfXv5FZNYtcJcnztjApI/IPaisQYShIXWgre3e3AAnhH7r M4ycbcu8WZfF4XZe4dHH2GmITdcOjg+Z0Ss0UU5+C0OFMcpdq22DussR/FIVViiF4FoLY7ULhlax 6X9Pfx0f8sUgy5BB0rIk4MsIP6kGEMFOvgOzvD3xU7KrQdOYn29Fkl9/DNCenblsaJIlcNY5T6bP 0NGDtOuqW59YiNRs13pmEwOi6nTJDcev4gQaaL+oby7PgZ0CAwEAAaOCAsQwggLAMB8GA1UdIwQY MBaAFLwPdwuNo7OFQ8I2k2asAql3wz1SMB0GA1UdDgQWBBRv/fXsVi7iFzcAUnKrvDB9YsJsVzCC ASMGCCsGAQUFBwEBBIIBFTCCAREwHgYIKwYBBQUHMAGGEmh0dHA6Ly9ldmEub3JjLmNvbTAyBggr BgEFBQcwAoYmaHR0cDovL2VjYS5vcmMuY29tL2NhQ2VydHMvRUNBLVNXNS5wN2MwgboGCCsGAQUF BzAChoGtbGRhcDovL2VjYS1kcy5vcmMuY29tL2NuJTNkT1JDJTIwRUNBJTIwU1clMjA1JTJjb3Ul M2RDZXJ0aWZpY2F0aW9uJTIwQXV0aG9yaXRpZXMlMmNvdSUzZEVDQSUyY28lM2RVLlMuJTIwR292 ZXJubWVudCUyY2MlM2RVUz9jQUNlcnRpZmljYXRlO2JpbmFyeSxjcm9zc0NlcnRpZmljYXRlUGFp cjtiaW5hcnkwDgYDVR0PAQH/BAQDAgUgMB0GA1UdEQQWMBSBEmNhcnRlckBxb3NpZW50LmNvbTAX BgNVHSAEEDAOMAwGCmCGSAFlAwIBDAEwgfEGA1UdHwSB6TCB5jAroCmgJ4YlaHR0cDovL2VjYS5v cmMuY29tL0NSTHMvT1JDRUNBU1c1LmNybDCBtqCBs6CBsIaBrWxkYXA6Ly9lY2EtZHMub3JjLmNv bTozODkvY24lM0RPUkMlMjBFQ0ElMjBTVyUyMDUlMkMlMjBvdSUzRENlcnRpZmljYXRpb24lMjBB dXRob3JpdGllcyUyQyUyMG91JTNERUNBJTJDJTIwbyUzRFUuUy4lMjBHb3Zlcm5tZW50JTJDJTIw YyUzRFVTP2NlcnRpZmljYXRlUmV2b2NhdGlvbkxpc3Q7YmluYXJ5MBsGA1UdCQQUMBIwEAYIKwYB BQUHCQQxBBMCVVMwDQYJKoZIhvcNAQEFBQADggEBAB02Nw1iFxe8IdKfcXxcb0V2Agom5zeGM6wa YxOL8KGRIGL/nXUh0KoPAkRadzzAf2ZgkpjKJoO0JPJuhiiz1shyCraweMiUAkrcMx/IGyI8nGDo t6ZUGiNo+7gABryqLgGQtGRE9rOxhB0YOKijxxcdEtZW8kghVM+Wfe0+NS8P+jU5ZgoipRunccHs K0/eUgY62SU0vr0ZzWib9888/FV4NDNShi1DkMMEzFNnPcv1Ms2MP7swAgW2CrlChuktI1M1umjx V/BBlFTjLLRfB22ARLLDMXIHQ5VM7S6ltFzxWD7RUXDRb2WvHoS3u0XTLV/ES72/kyOJxxopGafE oUQxggMQMIIDDAIBATB2MHAxCzAJBgNVBAYTAlVTMRgwFgYDVQQKEw9VLlMuIEdvdmVybm1lbnQx DDAKBgNVBAsTA0VDQTEiMCAGA1UECxMZQ2VydGlmaWNhdGlvbiBBdXRob3JpdGllczEVMBMGA1UE AxMMT1JDIEVDQSBTVyA1AgIvSjAJBgUrDgMCGgUAoIIBbzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcN AQcBMBwGCSqGSIb3DQEJBTEPFw0xODEwMDExNDM5NDlaMCMGCSqGSIb3DQEJBDEWBBT45+aQYhFH b8LJB2Lu6xU/Oi/qCDCBhQYJKwYBBAGCNxAEMXgwdjBwMQswCQYDVQQGEwJVUzEYMBYGA1UEChMP VS5TLiBHb3Zlcm5tZW50MQwwCgYDVQQLEwNFQ0ExIjAgBgNVBAsTGUNlcnRpZmljYXRpb24gQXV0 aG9yaXRpZXMxFTATBgNVBAMTDE9SQyBFQ0EgU1cgNQICL0swgYcGCyqGSIb3DQEJEAILMXigdjBw MQswCQYDVQQGEwJVUzEYMBYGA1UEChMPVS5TLiBHb3Zlcm5tZW50MQwwCgYDVQQLEwNFQ0ExIjAg BgNVBAsTGUNlcnRpZmljYXRpb24gQXV0aG9yaXRpZXMxFTATBgNVBAMTDE9SQyBFQ0EgU1cgNQIC L0swDQYJKoZIhvcNAQEBBQAEggEAL0/hHjZ7wTiGnP/woxcrtrq7S9JN09C0PzyvatQcKWt71JFz X6Ff1otxkXLSOEiACHVE8eian8EJGw6stsxE6Thkohbi6+EkqeZdomBwx8qXnuiXnZlWCroDPUga rbPyUyxTu74rttRisLLof83oLOMd4xsU9Cp3KSWpv+tv8LsAlBP+Pwf1c5x8Xj3NSoUg4ynMF8I4 WO8eJKSHXciyfT/Qz/adaOxpgw9Aa+MOjVwgL906di2m9cS7R0PLZ+fEO6HTLYReYelf+u2uGeMU 80+DOsU099wlm8DjBIGRwhXP67IS4nQSWiysrJ9yIXJ1nfVLiB+Nmlqxc8ooyk/blwAAAAAAAA== --Apple-Mail=_A4F9A559-2048-4A6D-8FBA-0C5077850634--