# 
#  Argus Software
#  Copyright (c) 2000-2024 QoSient, LLC
#  All rights reserved.
# 
#  This program is free software; you can redistribute it and/or modify
#  it under the terms of the GNU General Public License as published by
#  the Free Software Foundation; either version 2, or (at your option)
#  any later version.
#
#  This program is distributed in the hope that it will be useful,
#  but WITHOUT ANY WARRANTY; without even the implied warranty of
#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#  GNU General Public License for more details.
#
#  You should have received a copy of the GNU General Public License
#  along with this program; if not, write to the Free Software
#  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
#
# Racluster Aggregation Policy Configuration
#
# Carter Bullard
# QoSient, LLC
#
#   This configuration is a racluster(1) flow model configuration file.
#
#   The concept is to bind a traditional ra* filter with an
#   aggregation model.  Records are tested against the filter
#   specifications in "fall down" order, when they match, the
#   aggregation model is used to merge records together.  The model
#   supports hold and idle timers in order to control the holding
#   merging strategies.  If reading from a file, the times are
#   determined from timestamps in the input stream.  The system
#   works best if the input stream is somewhat sorted in time.
#
#   Here is a valid and simple configuration file.   It doesn't do
#   anything spectacular, or special, but it is one that has been
#    used at some sites.
#   
#

#RACLUSTER_MODEL_NAME=Test Configuration
#RACLUSTER_PRESERVE_FIELDS=yes
#RACLUSTER_REPORT_AGGREGATION=no
#RACLUSTER_AUTO_CORRECTION=yes
#RACLUSTER_AGG_METRIC="dur"

filter="icmp"          model="saddr daddr proto dport sport "      status=60  idle=30   label="Icmp Traffic"
filter="arp"           model="saddr daddr proto dport sport "      status=120 idle=60   label="Arp Traffic"
filter="tcp or udp"    model="saddr daddr proto dport"             status=120 idle=3600 label="Tcp Traffic" cont
grep="Class-Video"     model="srcid saddr daddr proto dport sport" status=5   idle=10   label="video"
filter="tcp or udp"    model="saddr daddr proto dport"             status=30  idle=120  label="not video"
filter=""              model="saddr daddr proto"                   status=300 idle=3600 label="Other Traffic" 
