RACOLOR.CONF(5)

💖 RACOLOR.CONF 💖

okay bestie, welcome to racolor.conf — that's section 5 of the File Formats Manual, so you know it's a config file situation. this is where you tell ratop how to make your packets pretty. 🌈

---

✨ NAME ✨

racolor.conf — the racolor resource file. that's it, that's the whole job. it's the vibe sheet. 💅

---

🦋 SYNOPSIS 🦋

racolor.conf

no args, no flags, she just is. iconic behavior honestly.

---

🎀 DESCRIPTION 🎀

so this right here is a color configuration file for ratop.1. 💖 it's modeled after a ralabel(1) configuration file, so if you already know that one you're gonna feel right at home. and the way you actually summon it is by referencing it in a ratop.1 rarc.5 configuration file, using the RA_COLOR_CONFIG variable. write that down bestie. ✏️

the concept — and lowkey this is the whole point — is to give you a bunch of painting strategies for any or all fields in an argus record. you get to pick the order of the painting, and the hope (the dream, the aspiration 🫶) is that you end up with something actually useful.

the method is flow filter based field painting. that means it uses the standard flow filter strategies to give you a general purpose coloring scheme. no cap, it's just flow filters all the way down. 🌊

this is similar to racluster()'s fall through matching scheme. so here's the tea: you fall through the list of filters, and if one matches, you use the color specification to paint specific fields in the record. 🎨 and if you want to keep going down the list even after a match — that's the fall-through part — you just add a "cont" to the end of the matching rule. slay.

the format is:

filter="ra filter"  color="field[,field,...]:COLOR[+ATTRIBUTE]"  [cont]

filter can be any working ra flow record filter, contained in double quotes

color is composed of a comma separated list of fields, that will be painted
using the ncurses supported COLOR(s) and an optional ATTRIBUTE(s).

each line can be followed with an optional "cont"inue label, to indicate
that it should not stop with this match, but keep going down the list.

so yeah — filter is any working ra flow record filter, in double quotes. color is a comma separated list of fields that get painted using the ncurses supported COLOR(s), plus an optional ATTRIBUTE(s). and each line can carry an optional "cont"inue label to say don't stop here, keep scrolling the list. 🛼

here's a working example color specification, because seeing it hits different:

filter="udp"                    color="proto:VIOLET"                                cont
filter="tcp"                    color="saddr,daddr,dir,sport,dport,proto:WHITE"     cont
filter="tcp and dst port http"  color="dport:GREEN"                                 cont
filter="tcp"                    color="sport:BLUE+DIM"                              cont
filter="dst port domain"        color="dport:CYAN+DIM"                              cont
filter="dst port imaps"         color="dport:MAGENTA+DIM"                           cont
filter="src pkts gt 50"         color="spkts,dpkts,sbytes,dbytes:RED+BLINK"
filter="src co CN"              color="all:RED+BLINK"

look at that fall-through chain go. the last two have no cont, so they stop — match and done, no more scrolling. periodt. 💀✨

---

👑 COPYRIGHT 👑

Copyright (c) 2000-2024 QoSient. All rights reserved.

---

🌸 SEE ALSO 🌸

• ratop(1)

---

and that's the whole page bestie!! 🦋💜 this was racolor.conf from racolor.conf 5.0.3, dated 30 September 2016. go paint some packets, you're gonna eat. 🎀✨