RANONYMIZE.CONF(5)

💖 RANONYMIZE.CONF 💖

okay bestie, so this is the manual page for ranonymize.conf in section 5 (File Formats Manual) of the manual. it's a config file page. it's giving ✨system administration✨ but make it cute. let's get into it 🫶

---

✨ NAME ✨

ranonymize.conf — the configuration file for ranonymize(1). that's it, that's the name, slay 💅

---

🌸 SYNOPSIS 🌸

ranonymize.conf

---

🦋 DESCRIPTION 🦋

so this config file is where you go to set options for argus data anonymization. that's the whole vibe. it's the lil settings file that lets you control how your argus data gets scrubbed before you let it out into the world 🌈

---

👑 OPTIONS 👑

the anonymization clients have a small number of options for controlling specific aspects of the anonymization function and its output. small but mighty, fr fr.

⏰ Timestamps, Reference and Sequence Numbers ⏰

ranonymize anonymizes a bunch of fields in Argus records, like:

• the network addresses
• protocol specific port numbers
• timestamps
• transaction reference numbers
• the sequence numbers

so for some of these — specifically the timestamps, the transaction reference numbers and the sequence numbers, which are generally monotonically increasing counters — the good anonymization technique is to shift the values by a constant, so the sequential relationships between values stay intact. the vibes of the ordering? preserved. iconic.

the config gives you some flexibility here so you can control that fixed offset shifting anonymization. the constant value can be generated by the anonymization client at "random" — that's the default behavior, no cap — or you can provide a "fixed:x", where x is the fixed offset. and of course, the keyword "none" turns off the default anonymization for these values. your call, bestie.

RANON_TRANSREFNUM_OFFSET=random
RANON_SEQNUM_OFFSET=random
RANON_TIME_SEC_OFFSET=random
RANON_TIME_USEC_OFFSET=random

🧚 Ethernet Address Vendor Codes 🧚

when it's anonymizing ethernet addresses, ranonymize has the option to preserve the vendor portion, if you want that. this lets analytical programs still differentiate anonymized data by vendor type. lowkey genius. this feature is turned off by default tho.

RANON_PRESERVE_ETHERNET_VENDOR=no

📡 Broadcast Addresses 📡

ranonymize has the option to preserve the semantic that an address is a broadcast address. and this is very important when you're doing flow analysis for either operational or performance management tasks, using anonymized data. don't skip this one, i'm serious 😭

RANON_PRESERVE_BROADCAST_ADDRESS=yes

🌐 IPv4 Address Anonymization 🌐

okay so IPv4 addresses are composed of two parts: a network part and a host part. because a site's addressing strategy might have integrated semantics that you'd want retained in the anonymized addresses, IPv4 address anonymization involves specifying a one-to-one translation table for both the network and host address spaces in an IPv4 address.

once a new network address has been allocated, every occurence of that network address gets substituted in the anonymizer's output stream. and the host address space is anonymized in an independent but similar fashion. two separate lil worlds, same energy ✨

ranonymize lets you specify the type of anonymization method used in a number of categories. for network and host address conversion, ranonymize can support "sequential", "random" or "no" anonymization. here's the breakdown:

• Sequential anonymization — allocating new addresses in a monotonically increasing fashion on a first come first serve basis.
• Random anonymization — allocates random addresses from the working pool of addresses.
• "no" anonymization — preserves the address type, whether it's network, host, or both.

the default working pool of network addresses contains only non-routable addresses, and starts with 10.0.0.0. and all anonymized addresses are treated as Class C network addresses, in order to conserve the anonymization allocation demands.

now the example, because examples ate 💅 — if the first Argus record contained the addresses 128.64.2.4 and 132.243.2.87 as the source and destination, sequential anonymization would generate the addresses 10.0.0.1 and 10.0.1.1 as the new source and destination addresses. why? because the two addresses have differing network parts, 128.64.2 and 132.243.2, so these would be allocated 10.0.0 and 10.0.1 respectively (sequential allocation). and because these are the first hosts to be allocated, the host parts are both 1. math is math 🧮

random anonymization could generate 10.24.31.203 and 10.1.34.18 as possible addresses, since both the Class C network address would be allocated randomly from the 10 network space, and the host address part would be allocated randomly from the possible host addresses.

sequential randomization uses the least amount of memory and minimizes anonymization processing time, while random provides better address scrambling. tradeoffs, bestie, tradeoffs.

Implemenation note: currently only supporting sequential

RANON_NET_ANONYMIZATION=sequential
RANON_HOST_ANONYMIZATION=sequential

🪜 Address Hierarchy 🪜

ranonymize has the option to preserve the network address hierarchy at various levels of granularity. this lets you preserve the addressing relationships between addresses. the options are "cidr", "class", "subnet" and "no".

Class network adddress heirarchy preservation causes ranonymize() to allocate new network addresses base on the address class. all CLASSA network addresses will be allocated new addresses from the Class A network pool. network addresses will be allocated as 24 bit CIDR addresses, in that the first 24 bits will map to a unique 24 network address, and host addresses will be allocated from the 254 address pool (0 and 255 can be preserved, see below).

RANON_PRESERVE_NET_ADDRESS_HIERARCHY=cidr

🎯 Specific Network Address Aliasing 🎯

ranonymize can be configured to perform specific network address translation. these must be specified as 24 bit CIDR addresses. and RANON_PRESERVE_NET_ADDRESS_HIERARCHY must be set to "cidr" for this feature to work. no cidr, no feature, that's the rule 🫶

examples would be:

RANON_SPECIFY_NET_TRANSLATION=192.168.0.0::128.2.134.0
RANON_SPECIFY_NET_TRANSLATION=64.12.0.0::134.5.0.0
RANON_SPECIFY_NET_TRANSLATION=128.2.0.0::200.200.0.0

🏠 Specific Host Address Aliasing 🏠

ranonymize can be configured to perform specific host address translation. these addresses are allocated prior to reading any data, and are removed from the potential network address pool, regardless of the anonymization strategy. feel free to list as many addresses that you would like. go off, list them all 💅

examples would be:

RANON_SPECIFY_HOST_TRANSLATION=192.168.0.64::128.2.34.5

🚪 Transport SAP Aliasing 🚪

ranonymize can be configured to preserve specific ranges of port numbers. for convenience, ranonymize() can be configured to preserve:

• the IANA well known port allocation range (0-1023)
• the registered ports (1024-49151)
• and/or the private port range (49152 - 65535)

also, ranonymize() can be configured to preserve specific port numbers. these numbers are independent of protocol type, so if port 23461 is to be preserved, it will be preserved for both tcp and udp based flows. equal treatment for all protocols, periodt ✨

RANON_PRESERVE_WELLKNOWN_PORT_NUMS=yes
RANON_PRESERVE_REGISTERED_PORT_NUMS=no
RANON_PRESERVE_PRIVATE_PORT_NUMS=no

---

©️ COPYRIGHT ©️

Copyright (c) 2000-2024 QoSient. All rights reserved.

---

👀 SEE ALSO 👀

• ranonymize(1)

---

okay that's the whole page bestie, you're officially certified in ranonymize.conf 💖 this was ranonymize.conf version 5.0.3, dated 14 September 2016, and it's giving classic manual-page realness. go anonymize something responsibly, mwah 🎀🦋✨