RALABEL.CONF(5)

💖 NAME

ralabel.conf — the resource file for ralabel(1), aka the group chat where you tell your labeler bestie what to do. 💅

✨ SYNOPSIS

ralabel.conf

🦋 DESCRIPTION

okay so. this whole file? it's a ralabel(1) configuration file. that's the job. 🫶

the ~concept~ is that we hand you a whole lineup of labeling strategies, and every single labeler comes with its own configuration capabilities. which means you get to pick the order the labeling goes in — and that's highkey the whole point, because that's what supports hierarchical labeling. layers on layers, bestie. 🧚

and here's a valid and simple configuration file. it genuinely doesn't do anything in particular, but it is one that gets used at some sites. so. there it is. 🙈

🌸 Supported Labeling Strategies

🎀 Addresss Based Classification

address based classifications are all about building a patricia tree that we can hang labels off of. 🌳 the strategy is to order the address label configuration files, and boom — you've developed a hierarchical label scheme. it's giving organized.

🌈 IANA IPv4 and IPv6 Address Classification Labeling

RALABEL_IANA_ADDRESS

the type of IP network address can be used by so many analysis programs to make decisions. and while the IANA standard classifications don't change, this type of classification should be extendable, so local sites can bring their own additional labeling capabilities to the table. 💅

RALABEL_IANA_ADDRESS=yes
RALABEL_IANA_ADDRESS_FILE="/usr/local/argus/iana-address-file"

💜 Addresss Based Country Code Classification

RALABEL_ARIN_COUNTRY_CODES

this one leverages the feature where ra* clients cant print country codes for the IP addresses that are in a flow record. the country codes get generated from the ARIN delegated address space files. so specify the location of your DELEGATED_IP file right here, or in your .rarc file (which is default). ✨

and here's the tea: unlike the GeoIP based country code labeling, these codes can be sorted, filtered and aggregated. so if you want to do that type of operations with country codes, enable this feature right here. no cap. 👑

RALABEL_ARIN_COUNTRY_CODES=yes
RA_DELEGATED_IP="/usr/local/argus/delegated-ipv4-latest"

🦋 BIND Based Classification

RALABEL_BIND_NAME

BIND services provide address to name translations, and these reverse lookup strategies can hand you FQDN labels, or domain labels, that can be added to flow. the IP addresses that can be 'labeled' are saddr, daddr, or inode. and fyi, the keywords "yes" and "all" are synonomous — both of them result in labeling all three IP addresses. 😌

use this strategy to provide transient semantic enhancement based on ip address values.

RALABEL_BIND_NAME="all"

🍓 Port Based Classification

RALABEL_IANA_PORT

port based classifications involve a simple assignment of a text label to a specific port number. 💖 while IANA standard classifications are supported throught the Unix /etc/services file assignments, and the basic "src port" and "dst port" ra* filter schemes, this scheme is the one used to enhance/modify that labeling strategy. the text associated with a port number gets placed in the metadata label field, and it's searched using the regular expression searching strategies that are available to label matching. 🔍

use this strategy to provide transient semantic enhancement based on port values.

RALABEL_IANA_PORT=yes
RALABEL_IANA_PORT_FILE="/usr/local/argus/iana-port-numbers"

💀 Flow Filter Based Classification

flow filter based classification uses the standard flow filter strategies to provide a general purpose labeling scheme. the concept is similar to racluster()'s fall through matching scheme. fall through the list of filters, and if it matches, add the label. 🔥 and if you want to keep going through the list once there is a match, add a "cont" to the end of the matching rule. periodt.

RALABEL_ARGUS_FLOW

RALABEL_ARGUS_FLOW=yes
RALABEL_ARGUS_FLOW_FILE="/usr/local/argus/argus-flow-file"

🌟 GeoIP Based Labeling

the labeling features can use the databases provided by MaxMind using the GeoIP LGPL libraries. if your code was configured to use these libraries, then enable the features right here. 💫

GeoIP provides a lot of support for geo-location, so you configure support by enabling a feature and providing the appropriate binary data files. quick heads up though: ASN reporting is done from a separate set of data files, obtained from MaxMind.com, so enabling this feature is independent of the traditional city data available. 🙈

RALABEL_GEOIP_ASN

labeling data with Origin ASN values is honestly so chill — it involves simply indicating the desire, and the filename for the database of ASN numbers. 💅

RALABEL_GEOIP_ASN=yes
RALABEL_GEOIP_ASN_FILE="/usr/local/share/GeoIP/GeoIPASNum.dat"

RALABEL_GEOIP_CITY

data for city relevant data is enabled through enabling and configuring the city database support. the types of data available are:

country_code, country_code3, country_name, region, city, postal_code, latitude, longitude, metro_code, area_code and continent_code. time_offset is also available. 🎀

the concept is that you should be able to add semantics for any IP address that is in the argus record. support addresses are:

saddr, daddr, inode

the labels provided will be tagged as:

scity, dcity, icity

to configure what you want to have placed in the label, use the list of objects, in whatever order you like, as the RALABLE_GEOPIP_CITY string using these keywords (yes bestie, that spelling, i don't make the rules 💀):

• cco — country_code
• cco3 — country_code3
• cname — country_name
• reg — region
• city — city
• pcode — postal_code
• lat — latitude
• long — longitude
• metro — metro_code
• area — area_code
• cont — continent_code
• off — GMT time offset

working examples could be:

RALABEL_GEOIP_CITY="saddr,daddr:lat/lon"
RALABEL_GEOIP_CITY="*:city,region,cname,lat,lon"

RALABEL_GEOIP_CITY="saddr,daddr,inode:lat,lon"
RALABEL_GEOIP_CITY_FILE="/usr/local/share/GeoIP/GeoIPCity.dat"

👑 COPYRIGHT

Copyright (c) 2000-2024 QoSient All rights reserved.

🌈 SEE ALSO

• ralabel(1)

---

and that's the whole page, bestie! 🎀 you just read ralabel.conf(5) from the File Formats Manual, version 5.0.3, dated 02 June 2016, brought to you by QoSient. mwah 💋 now go label something iconic. ✨