Argus Development mailing list - Real Time Flow Monitor (RTFM) for comprehensive IP network traffic auditing

ratop -S localhost:561 ratop[13840]: 10:57:08.317262 ratop not compiled with curses support. install ncurses and rebuild.

Having troubles using RATOP.  Everytime I try and use it I get this error:

[root <at> snakeeyes argus-clients-3.0.2.beta.12]# ratop -S localhost:561
ratop[13840]: 10:57:08.317262 ratop not compiled with curses support.
install ncurses and rebuild.

Here are the ncurses packages I have installed:

[root <at> snakeeyes argus-clients-3.0.2.beta.12]# yum list | grep ncurses
ncurses.i386                              5.5-24.20060715              installed
ncurses-devel.i386                        5.5-24.20060715              installed

Is there a specific way I need to 'compile' ratop???

I am running on the following:

[root <at> snakeeyes /]# cat /etc/redhat-release
CentOS release 5.3 (Final)

[root <at> snakeeyes /]# uname -a
Linux snakeeyes.??.com  2.6.18-128.1.10.el5 #1 SMP Thu May 7 10:39:21
EDT 2009 i686 i686 i386 GNU/Linux

Thanks..

Bartola

headers

Carter Bullard | 4 Sep 19:44

Re: ratop -S localhost:561 ratop[13840]: 10:57:08.317262 ratop not compiled with curses support. install ncurses and rebuild.

Hey Mark,
The clients find curses when you do the ./configure.  If you haven't  
done this
since installing, try:

    % make clobber
    % ./configure
    % make

Check that the ./configure finds either ncurses or curses.  If not  
send email.
You can type "./configure --help" and it will show you some options that
may be able to fix any problems you may have.

Carter

On Sep 4, 2009, at 10:59 AM, Mark Bartlett wrote:

> Having troubles using RATOP.  Everytime I try and use it I get this  
> error:
>
> [root <at> snakeeyes argus-clients-3.0.2.beta.12]# ratop -S localhost:561
> ratop[13840]: 10:57:08.317262 ratop not compiled with curses support.
> install ncurses and rebuild.
>
> Here are the ncurses packages I have installed:
>
> [root <at> snakeeyes argus-clients-3.0.2.beta.12]# yum list | grep ncurses
> ncurses.i386                               
> 5.5-24.20060715              installed

(Continue reading)

headers

Mark Bartlett | 4 Sep 22:44

Re: ratop -S localhost:561 ratop[13840]: 10:57:08.317262 ratop not compiled with curses support. install ncurses and rebuild.

That worked.. Thanks Carter!!!  Have a great 3 day weekend..

mab

On Fri, Sep 4, 2009 at 1:44 PM, Carter Bullard<carter <at> qosient.com> wrote:
> Hey Mark,
> The clients find curses when you do the ./configure.  If you haven't done
> this
> since installing, try:
>
>   % make clobber
>   % ./configure
>   % make
>
> Check that the ./configure finds either ncurses or curses.  If not send
> email.
> You can type "./configure --help" and it will show you some options that
> may be able to fix any problems you may have.
>
> Carter
>
> On Sep 4, 2009, at 10:59 AM, Mark Bartlett wrote:
>
>> Having troubles using RATOP.  Everytime I try and use it I get this error:
>>
>> [root <at> snakeeyes argus-clients-3.0.2.beta.12]# ratop -S localhost:561
>> ratop[13840]: 10:57:08.317262 ratop not compiled with curses support.
>> install ncurses and rebuild.
>>
>> Here are the ncurses packages I have installed:

(Continue reading)

headers

Carter Bullard | 9 Sep 15:50

Re: [PATCH] Fixed bug for 'syn' filtering

Hey Yun,

Thanks for the fix!!!!!

We discussed this on the mailing list briefly, and I think the best approach

is to introduce a "tcpflags" keyword, for the "syn or ack or push and reset"

like TCP flags filter, and keep "syn" as a keyword, just as you implemented

your change.

It will take me a little while to schedule the fix into the code, so bear with

me and remind me if it seems that the fix isn't getting into the code.

Carter

On Sep 8, 2009, at 5:45 AM, Yun Zheng Hu wrote:

Hello Carter,

I attached a patch that allows the argus clients to filter on the ‘syn’ flag. It was previously not possible, it would match syn + ack, altough it should only match syn.

Regards,
Yun
<argus-clients-3.0.0-syn-grammar.patch>

Attachment (smime.p7s): application/pkcs7-signature, 3815 bytes

headers

CS Lee | 10 Sep 07:02

ASN

hey carter,

I have these two lines in my ralabel.conf

RALABEL_GEOIP_ASN=yes
RALABEL_GEOIP_ASN_FILE="/Users/geek00l/Downloads/GEOIP/GeoIPASNum.dat"

I use the command -

ralabel -f ralabel.conf -r argus.out -w - | ra -s label

But nothing shows up, the GeoIP city do works though. I'm using argus client 3.0.2.beta.12

Thanks.

--
Best Regards,

CS Lee<geek00L[at]gmail.com>

http://geek00l.blogspot.com
http://defcraft.net

headers

CS Lee | 10 Sep 08:04

argus ralabel geoip

hi Carter and all,

In the ralabel.conf, you have these two lines -

#    Working examples could be:
#       RALABEL_GEOIP_CITY="saddr,daddr:lat/lon"
#       RALABEL_GEOIP_CITY="*:city,region,cname,lat,lon"

I think it is long instead of lon for longtitude or it won't work. Just point it out here in case anyone is using this and doesn't get it to work.

Cheers ;)

--
Best Regards,

CS Lee<geek00L[at]gmail.com>

http://geek00l.blogspot.com
http://defcraft.net

headers

CS Lee | 10 Sep 08:30

Argus geoip asn

hi all,

For anyone who want to use asn reporting, I just realize that asn is in different set of field instead of inside label, so the field to print out asn in argus record are

sas
das

So now you can actually filter, sort by the asn. Cheers ;)

Carter, just forget my previous question where I asked about asn in label

Best Regards,

CS Lee<geek00L[at]gmail.com>

http://geek00l.blogspot.com
http://defcraft.net

headers

Carter Bullard | 10 Sep 14:11

Re: ASN

How about

ra -s sas das

to print the values?

Carter

On Sep 10, 2009, at 1:02 AM, CS Lee wrote:

hey carter,

I have these two lines in my ralabel.conf

RALABEL_GEOIP_ASN=yes
RALABEL_GEOIP_ASN_FILE="/Users/geek00l/Downloads/GEOIP/GeoIPASNum.dat"

I use the command -

ralabel -f ralabel.conf -r argus.out -w - | ra -s label

But nothing shows up, the GeoIP city do works though. I'm using argus client 3.0.2.beta.12

Thanks.

--
Best Regards,

CS Lee<geek00L[at]gmail.com>

http://geek00l.blogspot.com
http://defcraft.net

Attachment (smime.p7s): application/pkcs7-signature, 3815 bytes

headers

CS Lee | 10 Sep 14:30

Re: argus ralabel geoip

hi carter,

Alright, yeah make it 3 characters standard ;)

So all features in ralabel seems to work, my next test will be on argus sql and new radium features, I will report my doing.

Thanks!

On Thu, Sep 10, 2009 at 8:13 PM, Carter Bullard <carter <at> qosient.com> wrote:

I think "lon" is the preferred way of referring to longitude, so
I'll fix the parser to match on "lon".

Carter

On Sep 10, 2009, at 2:04 AM, CS Lee wrote:

hi Carter and all,

In the ralabel.conf, you have these two lines -

#    Working examples could be:
#       RALABEL_GEOIP_CITY="saddr,daddr:lat/lon"
#       RALABEL_GEOIP_CITY="*:city,region,cname,lat,lon"

I think it is long instead of lon for longtitude or it won't work. Just point it out here in case anyone is using this and doesn't get it to work.

Cheers ;)

--
Best Regards,

CS Lee<geek00L[at]gmail.com>

http://geek00l.blogspot.com
http://defcraft.net

--
Best Regards,

CS Lee<geek00L[at]gmail.com>

http://geek00l.blogspot.com
http://defcraft.net

headers

CS Lee | 10 Sep 14:16

Re: ASN

hi carter,

I have already figured it out and email the list, anyway thanks ;)

On Thu, Sep 10, 2009 at 8:11 PM, Carter Bullard <carter <at> qosient.com> wrote:

How about
ra -s sas das

to print the values?

Carter

On Sep 10, 2009, at 1:02 AM, CS Lee wrote:

hey carter,

I have these two lines in my ralabel.conf

RALABEL_GEOIP_ASN=yes
RALABEL_GEOIP_ASN_FILE="/Users/geek00l/Downloads/GEOIP/GeoIPASNum.dat"

I use the command -

ralabel -f ralabel.conf -r argus.out -w - | ra -s label

But nothing shows up, the GeoIP city do works though. I'm using argus client 3.0.2.beta.12

Thanks.

--
Best Regards,

CS Lee<geek00L[at]gmail.com>

http://geek00l.blogspot.com
http://defcraft.net

--
Best Regards,

CS Lee<geek00L[at]gmail.com>

http://geek00l.blogspot.com
http://defcraft.net

29	February 2012
91	January 2012
52	December 2011
17	November 2011
30	October 2011
15	September 2011
39	August 2011
49	July 2011
61	June 2011
66	May 2011
82	April 2011
48	March 2011
52	February 2011
27	January 2011
42	December 2010
35	November 2010
72	October 2010
78	September 2010
48	August 2010
102	July 2010
50	June 2010
23	May 2010
61	April 2010
40	March 2010
50	February 2010
26	January 2010
32	December 2009
72	November 2009
48	October 2009
55	September 2009
115	August 2009
66	July 2009
36	June 2009
92	May 2009
122	April 2009
116	March 2009
58	February 2009
26	January 2009
15	December 2008
3	November 2008
3	October 2008
24	September 2008
38	August 2008
50	July 2008
62	June 2008
6	May 2008
61	April 2008
90	March 2008
151	February 2008
121	January 2008
67	December 2007
61	November 2007
120	October 2007
107	September 2007
143	August 2007
44	July 2007
91	June 2007
68	May 2007
82	April 2007
141	March 2007
123	February 2007
69	January 2007
50	December 2006
79	November 2006
113	October 2006
114	September 2006
131	August 2006
96	July 2006
270	June 2006
4	May 2006
4	April 2006
40	March 2006
31	February 2006
24	January 2006
14	December 2005
2	November 2005
1	October 2005
8	September 2005
25	August 2005
1	July 2005
14	June 2005
5	May 2005
25	April 2005
24	March 2005
33	February 2005
12	January 2005
41	December 2004
33	November 2004
35	October 2004
48	September 2004
95	August 2004
45	July 2004
79	June 2004
87	May 2004
84	April 2004
17	March 2004
62	February 2004
14	January 2004
28	December 2003
14	November 2003
15	October 2003
38	September 2003
60	August 2003
28	July 2003
31	June 2003
48	May 2003
24	April 2003
39	March 2003
18	February 2003
29	January 2003
26	December 2002
41	November 2002
47	October 2002
18	September 2002
14	August 2002
23	July 2002
20	June 2002
92	May 2002
29	April 2002
56	March 2002
47	February 2002
33	January 2002
18	December 2001
91	November 2001
58	October 2001
49	September 2001
15	August 2001
49	July 2001
109	June 2001
52	May 2001
39	April 2001
99	March 2001
134	February 2001
123	January 2001
26	December 2000
59	November 2000
72	October 2000
143	September 2000
44	August 2000
81	July 2000
20	June 2000
12	May 2000
11	April 2000
63	March 2000
22	February 2000
8	January 2000
1	December 1999
6	October 1999
15	September 1999
3	August 1999
9	July 1999
12	June 1999
7	May 1999
16	April 1999
28	March 1999
9	February 1999

Mon	Tue	Wed	Thu	Fri	Sat	Sun

	1	2	3	4	5	6
7	8	9	10	11	12	13
14	15	16	17	18	19	20
21	22	23	24	25	26	27
28	29	30