#
#  Argus-5.0 Software
#  Copyright (c) 2000-2022 QoSient, LLC
#  All rights reserved.
#
#  Carter Bullard
#  QoSient, LLC
#
#
#  RaColor Configuration
#
#  This configuration is a ralabel(1) configuration file, extended to
#  specify color for fields per row..
#
#  Flow Filter Based Classification
#    Flow filter based classification uses the standard flow
#    filter strategies to provide a general purpose labeling scheme.
#    The concept is similar to racluster()'s fall through matching
#    scheme.  Fall through the list of filters, if it matches, paint the
#    field with the specified color.  If you want to continue through
#    the list, once there is a match,  add a "cont" to the end of
#    the matching rule.  This will paint other fields with additional
#    color specifications.
#
#    The format is:
#       filter="ra filter"  color="field[,field,...]:COLOR"  [cont]
#
#       filter can be any working ra flow record filter
#       col can be any working ra flow record filter
#

filter="tcp"                    color="saddr,daddr,dir,sport,dport,proto:WHITE"         cont
filter="udp"                    color="proto:VIOLET"      cont
filter="tcp and dst port http"  color="dport:GREEN"       cont
filter="tcp"                    color="sport:BLUE+DIM"    cont
filter="dst port domain"        color="dport:CYAN+DIM"    cont
filter="dst port imaps"         color="dport:MAGENTA+DIM" cont
filter="src pkts gt 50"         color="spkts,dpkts,sbytes,dbytess:RED+BLINK"

filter="src co CN"  color="all:RED+BLINK" cont
filter="tcp"        color="saddr,daddr,dir,sport,dport,proto:WHITE"
