RAGEN(1)

✨ NAME ✨

ragen — generates synthetic argus(8) data streams / files 💫 no cap, that's literally the whole job description.

🎀 SYNOPSIS 🎀

ragen [-f conf] [-m agr(s)] [-M mode(s)] [-P procnum] [raoptions] [--
filter-expression]

🌸 DESCRIPTION 🌸

okay so here's the tea, bestie 🫖 — ragen reads argus data from an argus-data source and uses that data as a baseline to generate synthetic argus data records. it's giving glow-up but for packets 💅

the synthetic data is based on the input data plus the flow key criteria you specify, either on the command line or in a ragen configuration file, and then it outputs a valid argus-stream. she's consistent, she's valid, she slays ✨

this tool is primarily used to create AI/ML training data 🧠🤖 so like, you're basically feeding the robots. main character energy fr.

💖 Please see ragen.5 for detailed information regarding ragen configuration. yes, the 5 page. go read her, she ate.

💅 OPTIONS 💅

ragen, like all ra based clients, supports a number of ra options including filtering of input argus records through a terminating filter expression, and the ability to specify the output style, format and contents for printing data. See ra(1) for a complete description of ra options. the ragen(1) specific options are, and I quote, these 👇

• -m aggregation object — pick your aggregation vibe. the supported aggregation objects are:
  • none — do not merge records. results in no aggregation whatsoever, it's giving "I'm an individual" 💀
  • all — merge every single record into one single record. one record to rule them all, iconic.
  • srcid — argus source identifier.
  • smac — source mac(ether) addr.
  • dmac — destination mac(ether) addr.
  • soui — the oui portion of the source mac(ether) addr.
  • doui — the oui portion of the destination mac(ether) addr.
  • smpls — source mpls label.
  • dmpls — destination label addr.
  • svlan — source vlan label.
  • dvlan — destination vlan addr.
  • saddr/[l|m] — source IP addr, optionally with / cidr len or m.a.s.k.
  • daddr/[l|m] — destination IP addr, optionally with / cidr len or m.a.s.k.
  • matrix/l — sorted src and dst IP addr, with cidr len.
  • proto — transaction protocol.
  • sport — source port number. Implies use of proto 👀
  • dport — destination port number. Implies use of proto 👀
  • stos — source TOS byte value.
  • dtos — destination TOS byte value.
  • sttl — src -> dst TTL value.
  • dttl — dst -> src TTL value.
  • stcpb — src -> dst TCP base sequence number.
  • dtcpb — dst -> src TCP base sequence number.
  • inode[/l|m]] — intermediate node IP addr, with optional / cidr len or m.a.s.k. source of ICMP mapped events.
  • sco — source ARIN country code, if present.
  • dco — destination ARIN country code, if present.
  • sas — source node origin AS number, if available.
  • das — destination node origin AS number, if available.
  • ias — intermediate node origin AS number, if available.
• -M modes — the supported modes are, get ready 🎬:
  • correct — attempt to correct the direction of flows by also searching the reverse flow key, if a match isn't found in the cache. this mode is on by default when using the default full 5-tuple flow key definitions. she's helpful like that 🫶
  • nocorrect — turn off flow correction for direction. this mode is used by default if the flow key has been changed. so like, if you switched it up, she stops correcting, periodt.
  • norep — do not generate an aggregate statistic for each flow. this is used primarily when the output represents a single object. primarily used when merging status records to generate single flows that represent single transactions. one flow, one transaction, no extra commentary 💅
  • rmon — generate data suitable for producing RMON types of metrics.
  • ind — process each input file independantly, so that after the end of each inputfile, ragen flushes its output. yes bestie, flush it 🌊
  • replace — replace each inputfile contents with the aggregated output. the initial file compression status is maintained. (yes this one literally rewrites your files, be normal about it 🔥)
• -P<procnum> — specify the number of processors to use for aggregation. Default is 1. one. single. processor. she's humble 🎀
• -V — verbose operation, printing a line of output for each input file processed. Very useful when using the ra() -R option. like, extremely useful. you'll be obsessed 😭

🦋 INVOCATION 🦋

a sample invocation of ragen(1). this call reads argus(8) data from inputfile and aggregates the TCP protocol based argus(8) data. by default, ragen(1) merges using the standard 5-tuple flow key. this method is used to merge multiple status records into a single flow record per transaction. so like, five status records walk in, one flow record walks out. slay ✨

% ra -r argus.tcp.2012.02.13.12.20.00
    StartTime      Dur Trans      Flgs  Proto        SrcAddr  Sport   Dir        DstAddr  Dport  TotPkts State
 12:23:07.268    0.997     1  e i         tcp   192.168.0.68.59016     ->  208.59.201.75.http        298   CON
 12:23:08.294    1.000     1  e           tcp   192.168.0.68.59016     ->  208.59.201.75.http        111   CON
 12:23:09.294    0.991     1  e d         tcp   192.168.0.68.59016     ->  208.59.201.75.http        637   CON
 12:23:10.331    0.330     1  e           tcp   192.168.0.68.59016     ->  208.59.201.75.http         89   CON
 12:23:32.183    0.010     1  e           tcp   192.168.0.68.59016     ->  208.59.201.75.http          3   FIN

% ragen -r argus.tcp.2012.02.13.12.20.00
    StartTime      Dur Trans      Flgs  Proto        SrcAddr  Sport   Dir        DstAddr  Dport  TotPkts State
 12:23:07.268   24.925     5  e d         tcp   192.168.0.68.59016     ->  208.59.201.75.http       1138   FIN

another sample invocation of ragen(1). this call reads argus(8) data from inputfile and aggregates the TCP protocol based argus(8) data, based on the source and destination address matrix and the protocol. it reports the metrics as a percent of the total. percentages?? she's doing math and she's doing it well 💅

% ragen -r argus.2012.02.13.17.20.00 -m saddr/16 daddr proto -% \
       -s stime dur trans proto saddr dir daddr pkts state - tcp and port https

    StartTime      Dur   pTrans  Proto        SrcAddr  Dir        DstAddr  pTotPkts State
 17:49:54.225    8.101   33.333    tcp 192.168.0.0/16   ->   17.154.66.18    23.372   FIN
 17:48:42.607  179.761   13.333    tcp 192.168.0.0/16   ->  17.172.224.25    31.052   FIN
 17:50:01.113    0.803    6.667    tcp 192.168.0.0/16   -> 17.250.248.161     5.676   FIN
 17:49:54.525    1.153    6.667    tcp 192.168.0.0/16   ->  64.12.173.137     5.509   FIN
 17:50:35.411  101.133   26.667    tcp 192.168.0.0/16   ->  184.28.150.87    19.199   RST
 17:49:56.061   73.415    6.667    tcp 192.168.0.0/16   ->   205.188.8.47    11.018   RST
 17:49:55.677    0.434    6.667    tcp 192.168.0.0/16   -> 205.188.101.10     4.174   FIN

👑 COPYRIGHT 👑

Copyright (c) 2000-2024 QoSient. All rights reserved. 🫡

🌈 SEE ALSO 🌈

racluster(5), ra(1), rarc(5), argus(8)

go read them, they're all part of the friend group 💜

🎀 FILES 🎀

literally nothing listed here bestie. the section exists, the contents are giving empty. respect the minimalism 💀✨

🌸 AUTHORS 🌸

Carter Bullard (carter@qosient.com). the icon, the legend, the moment 👑

💖 BUGS 💖

nothing listed. either she's perfect or nobody's filed anything yet. iykyk 🦋

and that's the whole page, bestie!! this was ragen version 5.0.3, dated 07 October 2023 — go generate something iconic, mwah 💋💖✨