Re: ratop with racolor blanks our daddr
[email protected] Fri, 19 Jul 2019 16:56:36 -0400
| Newsgroups | gmane.network.argus |
|---|---|
| Message-ID | <[email protected]> |
--Apple-Mail=_20CDAE2E-1BA1-4747-831C-482C3AE5F93B Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hey Steven, In ratop, you should be able to save the display screen with the = =E2=80=9C:w=E2=80=9D option and then a filename. It will write all the = flows in its cache to a file, and then you can read that file in with = ratop.1 to see if it still has the daddr blacked out =E2=80=A6. All I = would need is that file ... Carter =20 > On Jul 19, 2019, at 4:39 PM, Steven L <[email protected]> = wrote: >=20 > Hi Carter, >=20 > Data set is coming off a nic via argus. I'll see if I can do the same = off of a pcap. >=20 >=20 > ###################################### > rarc.conf: > ###################################### > RA_ARGUS_SERVER=3Dlocalhost:561 > RA_USEC_PRECISION=3D2 > RA_SORT_ALGORITHMS=3Dload > RA_COLOR_SUPPORT=3D"yes" > RA_COLOR_CONFIG=3D"racolor.conf" >=20 >=20 > ###################################### > racolor.conf: > ###################################### > filter=3D"" color=3D"all:BLACK" cont > filter=3D"" color=3D"all:WHITE" cont > filter=3D"src load eq 0" color=3D"saddr:BLUE" cont > filter=3D"src load eq 0" color=3D"daddr:BLUE" cont >=20 >=20 > ###################################### > command: > ###################################### > ratop -F rarc.conf -H -n -s ltime idle saddr sport dir daddr dport = proto load rate bytes pkts state dur sdsb >=20 >=20 >=20 >=20 >=20 >=20 >=20 > On Fri, Jul 19, 2019 at 8:47 AM <[email protected] = <mailto:[email protected]>> wrote: > Hey Steve, > So the color map is a bit map, and the notion that initializing all = the bits explicitly before you start, isn=E2=80=99t crazy =E2=80=A6 but = not something the user should have to do. > I=E2=80=99ll take a look at the code today =E2=80=A6 any chance you = have a .racolor.conf, .rarc and a data set you can share that shows the = problem ??? >=20 > Carter >=20 >> On Jul 19, 2019, at 9:44 AM, Steven L <[email protected] = <mailto:[email protected]>> wrote: >>=20 >> A more "enhanced" workaround is to have the below at the top of the = racolor.config. This will put the text back to the proper foreground = color. >>=20 >> filter=3D"" color=3D"all:BLACK" cont >> filter=3D"" color=3D"all:WHITE" cont >>=20 >>=20 >>=20 >> On Thu, Jul 18, 2019 at 3:31 PM <[email protected] = <mailto:[email protected]>> wrote: >> So there does appear to be a bug in the parser =E2=80=A6 not sure yet = what, as I haven=E2=80=99t had a chance to look into it. >> I=E2=80=99m thinking that if you put an explicit line at the top and = then add your logic, that you=E2=80=99ll be setting the text to = something other than the "foreground=E2=80=9D . Is this a workaround = ??? >>=20 >> Carter >>=20 >>> On Jul 18, 2019, at 6:17 PM, Steven L <[email protected] = <mailto:[email protected]>> wrote: >>>=20 >>> When I do this: filter=3D"net 0.0.0.0/0 <http://0.0.0.0/0>" = color=3D"all:BLACK" cont >>>=20 >>> Some items are blanked out. >>> <image.png> >>>=20 >>> When do this: filter=3D"" color=3D"all:BLACK" = cont >>> Everything shows up. Interesting! >>> <image.png> >>>=20 >>>>=20 >>>=20 >>=20 >>=20 >> _______________________________________________ >> argus mailing list >> [email protected] <mailto:[email protected]> >> https://pairlist1.pair.net/mailman/listinfo/argus = <https://pairlist1.pair.net/mailman/listinfo/argus> >=20 --Apple-Mail=_20CDAE2E-1BA1-4747-831C-482C3AE5F93B Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; = charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; = -webkit-nbsp-mode: space; line-break: after-white-space;" class=3D"">Hey = Steven,<div class=3D"">In ratop, you should be able to save the display = screen with the =E2=80=9C:w=E2=80=9D option and then a filename. = It will write all the flows in its cache to a file, and then you = can read that file in with ratop.1 to see if it still has the daddr = blacked out =E2=80=A6. All I would need is that file ...</div><div = class=3D""><br class=3D""><div class=3D"">Carter<div class=3D""><div = dir=3D"auto" style=3D"caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); = letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: = break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" = class=3D""><div dir=3D"auto" style=3D"caret-color: rgb(0, 0, 0); color: = rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: = 0px; text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: = break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" = class=3D""> </div></div> </div> <div><br class=3D""><blockquote type=3D"cite" class=3D""><div = class=3D"">On Jul 19, 2019, at 4:39 PM, Steven L <<a = href=3D"mailto:[email protected]" = class=3D"">[email protected]</a>> wrote:</div><br = class=3D"Apple-interchange-newline"><div class=3D""><div dir=3D"ltr" = class=3D"">Hi Carter,<div class=3D""><br class=3D""></div><div = class=3D"">Data set is coming off a nic via argus. I'll see if I can do = the same off of a pcap.</div><div class=3D""><br class=3D""></div><div = class=3D""><br class=3D""></div><div = class=3D"">######################################</div><div = class=3D"">rarc.conf:</div><div class=3D""><div = class=3D"">######################################</div>RA_ARGUS_SERVER=3Dl= ocalhost:561<br class=3D"">RA_USEC_PRECISION=3D2<br = class=3D"">RA_SORT_ALGORITHMS=3Dload<br = class=3D"">RA_COLOR_SUPPORT=3D"yes"<br = class=3D"">RA_COLOR_CONFIG=3D"racolor.conf"<br class=3D""><br = class=3D""><br class=3D""><div = class=3D"">######################################</div>racolor.conf:<br = class=3D""><div = class=3D"">######################################</div></div><div = class=3D"">filter=3D"" color=3D"all:BLACK" = = cont<br class=3D"">filter=3D"" color=3D"all:WHITE" = = cont<br class=3D"">filter=3D"src load eq 0" = color=3D"saddr:BLUE" cont<br class=3D"">filter=3D"src load eq 0" = color=3D"daddr:BLUE" cont<br class=3D""><br class=3D""><br class=3D""><div= class=3D"">######################################</div>command:</div><div= class=3D"">######################################</div><div = class=3D"">ratop -F rarc.conf -H -n -s ltime idle saddr sport dir daddr = dport proto load rate bytes pkts state dur sdsb<br class=3D""></div><div = class=3D""><br class=3D""></div><div class=3D""><br class=3D""></div><div = class=3D""><br class=3D""></div><div class=3D""><br class=3D""></div><div = class=3D""><br class=3D""></div><div class=3D""><br = class=3D""></div></div><br class=3D""><div class=3D"gmail_quote"><div = dir=3D"ltr" class=3D"gmail_attr">On Fri, Jul 19, 2019 at 8:47 AM <<a = href=3D"mailto:[email protected]" class=3D"">[email protected]</a>> = wrote:<br class=3D""></div><blockquote class=3D"gmail_quote" = style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid = rgb(204,204,204);padding-left:1ex"><div style=3D"overflow-wrap: = break-word;" class=3D"">Hey Steve,<div class=3D"">So the color map is a = bit map, and the notion that initializing all the bits explicitly before = you start, isn=E2=80=99t crazy =E2=80=A6 but not something the = user should have to do.</div><div class=3D"">I=E2=80=99ll take a look at = the code today =E2=80=A6 any chance you have a .racolor.conf, .rarc and = a data set you can share that shows the problem ???</div><div = class=3D""><br class=3D""><div class=3D"">Carter<div class=3D""> </div> <div class=3D""><br class=3D""><blockquote type=3D"cite" class=3D""><div = class=3D"">On Jul 19, 2019, at 9:44 AM, Steven L <<a = href=3D"mailto:[email protected]" target=3D"_blank" = class=3D"">[email protected]</a>> wrote:</div><br = class=3D"gmail-m_5456741801393687894Apple-interchange-newline"><div = class=3D""><div dir=3D"ltr" class=3D"">A more "enhanced" workaround is = to have the below at the top of the racolor.config. This will put the = text back to the proper foreground color.<div class=3D""><div = class=3D""><br class=3D""></div><div class=3D"">filter=3D"" = color=3D"all:BLACK" cont<br = class=3D"">filter=3D"" color=3D"all:WHITE" = cont<br class=3D""></div><div class=3D""><br class=3D""></div><div = class=3D""><br class=3D""></div></div></div><br class=3D""><div = class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Thu, Jul = 18, 2019 at 3:31 PM <<a href=3D"mailto:[email protected]" = target=3D"_blank" class=3D"">[email protected]</a>> wrote:<br = class=3D""></div><blockquote class=3D"gmail_quote" style=3D"margin:0px = 0px 0px 0.8ex;border-left:1px solid = rgb(204,204,204);padding-left:1ex"><div class=3D"">So there does appear = to be a bug in the parser =E2=80=A6 not sure yet what, as I haven=E2=80=99= t had a chance to look into it.<br class=3D""><div class=3D""><div = class=3D""><div class=3D""><div class=3D"">I=E2=80=99m thinking that if = you put an explicit line at the top and then add your logic, that = you=E2=80=99ll be setting the text to something other than the = "foreground=E2=80=9D . Is this a workaround ???</div><div = class=3D""><br class=3D""></div><div class=3D"">Carter<br class=3D""><div = class=3D""> <div class=3D""><br class=3D""><blockquote type=3D"cite" class=3D""><div = class=3D"">On Jul 18, 2019, at 6:17 PM, Steven L <<a = href=3D"mailto:[email protected]" target=3D"_blank" = class=3D"">[email protected]</a>> wrote:</div><br = class=3D"gmail-m_5456741801393687894gmail-m_-8957631122322737515Apple-inte= rchange-newline"><div class=3D""><div dir=3D"ltr" class=3D""><div = class=3D"">When I do this: filter=3D"net <a = href=3D"http://0.0.0.0/0" target=3D"_blank" class=3D"">0.0.0.0/0</a>" = color=3D"all:BLACK" = cont</div><div = class=3D""><br class=3D""></div><div class=3D"">Some items are blanked = out.</div><div class=3D""><div class=3D""><span = id=3D"gmail-m_5456741801393687894gmail-m_-8957631122322737515cid:ii_jy98fn= gk0" class=3D""><image.png></span><br class=3D""></div></div><div = class=3D""><br class=3D""></div><div class=3D"">When do = this: filter=3D"" color=3D"all:BLACK" = = cont</div><div class=3D"">Everything shows up. = Interesting!</div><div class=3D""><div class=3D""><span = id=3D"gmail-m_5456741801393687894gmail-m_-8957631122322737515cid:ii_jy98gq= og1" class=3D""><image.png></span><br class=3D""></div></div><div = class=3D""><br class=3D""></div><div class=3D"gmail_quote"><blockquote = class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px = solid rgb(204,204,204);padding-left:1ex"><div class=3D""><div = class=3D""><div class=3D""><div class=3D""><blockquote type=3D"cite" = class=3D""><div class=3D""><div class=3D"gmail_quote"><blockquote = class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px = solid rgb(204,204,204);padding-left:1ex"><div class=3D""><div = class=3D""><div class=3D""><br = class=3D""></div></div></div></blockquote></div> </div></blockquote></div><br = class=3D""></div></div></div></blockquote></div></div> </div></blockquote></div><br class=3D""></div></div></div></div></div><br = class=3D""></div></blockquote></div> _______________________________________________<br class=3D"">argus = mailing list<br class=3D""><a href=3D"mailto:[email protected]" = target=3D"_blank" class=3D"">[email protected]</a><br class=3D""><a = href=3D"https://pairlist1.pair.net/mailman/listinfo/argus" = target=3D"_blank" = class=3D"">https://pairlist1.pair.net/mailman/listinfo/argus</a><br = class=3D""></div></blockquote></div><br = class=3D""></div></div></div></blockquote></div> </div></blockquote></div><br class=3D""></div></div></body></html>= --Apple-Mail=_20CDAE2E-1BA1-4747-831C-482C3AE5F93B--