Re: ratop with racolor blanks our daddr
Steven L <[email protected]> Fri, 19 Jul 2019 13:39:21 -0700
| Newsgroups | gmane.network.argus |
|---|---|
| Message-ID | <CAOz9k+huPjCcyZq8d9srmf=4dQ5=k7GhGDFe64A1Cj2EU9FJvQ@mail.gmail.com> |
--000000000000406936058e0eb903 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Carter, Data set is coming off a nic via argus. I'll see if I can do the same off of a pcap. ###################################### rarc.conf: ###################################### RA_ARGUS_SERVER=3Dlocalhost:561 RA_USEC_PRECISION=3D2 RA_SORT_ALGORITHMS=3Dload RA_COLOR_SUPPORT=3D"yes" RA_COLOR_CONFIG=3D"racolor.conf" ###################################### racolor.conf: ###################################### filter=3D"" color=3D"all:BLACK" cont filter=3D"" color=3D"all:WHITE" cont filter=3D"src load eq 0" color=3D"saddr:BLUE" cont filter=3D"src load eq 0" color=3D"daddr:BLUE" cont ###################################### command: ###################################### ratop -F rarc.conf -H -n -s ltime idle saddr sport dir daddr dport proto load rate bytes pkts state dur sdsb On Fri, Jul 19, 2019 at 8:47 AM <[email protected]> wrote: > Hey Steve, > So the color map is a bit map, and the notion that initializing all the > bits explicitly before you start, isn=E2=80=99t crazy =E2=80=A6 but not = something the user > should have to do. > I=E2=80=99ll take a look at the code today =E2=80=A6 any chance you have = a .racolor.conf, > .rarc and a data set you can share that shows the problem ??? > > Carter > > On Jul 19, 2019, at 9:44 AM, Steven L <[email protected]> wrote: > > A more "enhanced" workaround is to have the below at the top of the > racolor.config. This will put the text back to the proper foreground colo= r. > > filter=3D"" color=3D"all:BLACK" cont > filter=3D"" color=3D"all:WHITE" cont > > > > On Thu, Jul 18, 2019 at 3:31 PM <[email protected]> wrote: > >> So there does appear to be a bug in the parser =E2=80=A6 not sure yet wh= at, as I >> haven=E2=80=99t had a chance to look into it. >> I=E2=80=99m thinking that if you put an explicit line at the top and the= n add >> your logic, that you=E2=80=99ll be setting the text to something other t= han the >> "foreground=E2=80=9D . Is this a workaround ??? >> >> Carter >> >> On Jul 18, 2019, at 6:17 PM, Steven L <[email protected]> wrote: >> >> When I do this: filter=3D"net 0.0.0.0/0" color=3D"all:BLACK" >> cont >> >> Some items are blanked out. >> <image.png> >> >> When do this: filter=3D"" color=3D"all:BLACK" >> cont >> Everything shows up. Interesting! >> <image.png> >> >> >>>> >>> >> >> _______________________________________________ > argus mailing list > [email protected] > https://pairlist1.pair.net/mailman/listinfo/argus > > > --000000000000406936058e0eb903 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">Hi Carter,<div><br></div><div>Data set is coming off a nic= via argus. I'll see if I can do the same off of a pcap.</div><div><br>= </div><div><br></div><div>######################################</div><div>= rarc.conf:</div><div><div>######################################</div>RA_AR= GUS_SERVER=3Dlocalhost:561<br>RA_USEC_PRECISION=3D2<br>RA_SORT_ALGORITHMS= =3Dload<br>RA_COLOR_SUPPORT=3D"yes"<br>RA_COLOR_CONFIG=3D"ra= color.conf"<br><br><br><div>######################################</di= v>racolor.conf:<br><div>######################################</div></div><= div>filter=3D"" =C2=A0 =C2=A0 color=3D"all:BLACK" =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 cont<br>filter=3D"" =C2=A0 =C2=A0 color=3D"all= :WHITE" =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 cont<br>filter=3D"src load eq 0" =C2= =A0 color=3D"saddr:BLUE" cont<br>filter=3D"src load eq 0&quo= t; =C2=A0 color=3D"daddr:BLUE" cont<br><br><br><div>#############= #########################</div>command:</div><div>#########################= #############</div><div>ratop -F rarc.conf -H -n -s ltime idle saddr sport = dir daddr dport proto load rate bytes pkts state dur sdsb<br></div><div><br= ></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br= ></div></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail= _attr">On Fri, Jul 19, 2019 at 8:47 AM <<a href=3D"mailto:carter@qosient= .com">[email protected]</a>> wrote:<br></div><blockquote class=3D"gmail= _quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204= ,204);padding-left:1ex"><div style=3D"overflow-wrap: break-word;">Hey Steve= ,<div>So the color map is a bit map, and the notion that initializing all t= he bits explicitly before you start, =C2=A0isn=E2=80=99t crazy =E2=80=A6 bu= t not something the user should have to do.</div><div>I=E2=80=99ll take a l= ook at the code today =E2=80=A6 any chance you have a .racolor.conf, .rarc = and a data set you can share that shows the problem ???</div><div><br><div>= Carter<div> </div> <div><br><blockquote type=3D"cite"><div>On Jul 19, 2019, at 9:44 AM, Steven= L <<a href=3D"mailto:[email protected]" target=3D"_blank">bluebl= [email protected]</a>> wrote:</div><br class=3D"gmail-m_545674180139368= 7894Apple-interchange-newline"><div><div dir=3D"ltr">A more "enhanced&= quot; workaround is to have the below at the top of the racolor.config. Thi= s will put the text back to the proper foreground color.<div><div><br></div= ><div>filter=3D"" =C2=A0 =C2=A0 color=3D"all:BLACK"=C2= =A0 =C2=A0 =C2=A0 cont<br>filter=3D"" =C2=A0 =C2=A0 color=3D"= ;all:WHITE"=C2=A0 =C2=A0 =C2=A0 cont<br></div><div><br></div><div><br>= </div></div></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"= gmail_attr">On Thu, Jul 18, 2019 at 3:31 PM <<a href=3D"mailto:carter@qo= sient.com" target=3D"_blank">[email protected]</a>> wrote:<br></div><bl= ockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-lef= t:1px solid rgb(204,204,204);padding-left:1ex"><div>So there does appear to= be a bug in the parser =E2=80=A6 not sure yet what, as I haven=E2=80=99t h= ad a chance to look into it.<br><div><div><div><div>I=E2=80=99m thinking th= at if you put an explicit line at the top and then add your logic, that you= =E2=80=99ll be setting the text to something other than the "foregroun= d=E2=80=9D .=C2=A0 Is this a workaround ???</div><div><br></div><div>Carter= <br><div> <div><br><blockquote type=3D"cite"><div>On Jul 18, 2019, at 6:17 PM, Steven= L <<a href=3D"mailto:[email protected]" target=3D"_blank">bluebl= [email protected]</a>> wrote:</div><br class=3D"gmail-m_545674180139368= 7894gmail-m_-8957631122322737515Apple-interchange-newline"><div><div dir=3D= "ltr"><div>When I do this:=C2=A0 filter=3D"net <a href=3D"http://0.0.0= .0/0" target=3D"_blank">0.0.0.0/0</a>" =C2=A0 =C2=A0 color=3D"all= :BLACK" =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 cont</div><div><br></div><div>Some items are b= lanked out.</div><div><div><span id=3D"gmail-m_5456741801393687894gmail-m_-= 8957631122322737515cid:ii_jy98fngk0"><image.png></span><br></div></di= v><div><br></div><div>When do this:=C2=A0filter=3D"" =C2=A0 =C2= =A0 color=3D"all:BLACK" =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 cont</div><div>Everything= shows up. Interesting!</div><div><div><span id=3D"gmail-m_5456741801393687= 894gmail-m_-8957631122322737515cid:ii_jy98gqog1"><image.png></span><b= r></div></div><div><br></div><div class=3D"gmail_quote"><blockquote class= =3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rg= b(204,204,204);padding-left:1ex"><div><div><div><div><blockquote type=3D"ci= te"><div><div class=3D"gmail_quote"><blockquote class=3D"gmail_quote" style= =3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding= -left:1ex"><div><div><div><br></div></div></div></blockquote></div> </div></blockquote></div><br></div></div></div></blockquote></div></div> </div></blockquote></div><br></div></div></div></div></div><br></div></bloc= kquote></div> _______________________________________________<br>argus mailing list<br><a= href=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a><= br><a href=3D"https://pairlist1.pair.net/mailman/listinfo/argus" target=3D"= _blank">https://pairlist1.pair.net/mailman/listinfo/argus</a><br></div></bl= ockquote></div><br></div></div></div></blockquote></div> --000000000000406936058e0eb903--