# 
#  Argus Software
#  Copyright (c) 2000-2014 QoSient, LLC
#  All rights reserved.
# 
#  This program is free software; you can redistribute it and/or modify
#  it under the terms of the GNU General Public License as published by
#  the Free Software Foundation; either version 2, or (at your option)
#  any later version.
# 
#  This program is distributed in the hope that it will be useful,
#  but WITHOUT ANY WARRANTY; without even the implied warranty of
#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#  GNU General Public License for more details.
#    
#  You should have received a copy of the GNU General Public License
#  along with this program; if not, write to the Free Software
#  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
#    
#  Carter Bullard
#  QoSient, LLC  
#
#
#  RaColor Configuration
#
#  This configuration is a ralabel(1) configuration file, extended to
#  specify color for fields per row..
#
#  Flow Filter Based Classification
#    Flow filter based classification uses the standard flow
#    filter strategies to provide a general purpose labeling scheme.
#    The concept is similar to racluster()'s fall through matching
#    scheme.  Fall through the list of filters, if it matches, paint the
#    field with the specified color.  If you want to continue through
#    the list, once there is a match,  add a "cont" to the end of
#    the matching rule.  This will paint other fields with additional
#    color specifications.
#
#    The format is:
#       filter="ra filter"  color="field[,field,...]:COLOR"  [cont]
#
#       filter can be any working ra flow record filter
#       col can be any working ra flow record filter
#

#filter="udp"                    color="proto:VIOLET"      cont
#filter="tcp"                    color="saddr,daddr,dir,sport,dport,proto:WHITE"         cont
#filter="tcp and dst port http"  color="dport:GREEN"       cont
#filter="tcp"                    color="sport:BLUE+DIM"    cont
#filter="dst port domain"        color="dport:CYAN+DIM"    cont
#filter="dst port imaps"         color="dport:MAGENTA+DIM" cont
#filter="src pkts gt 50"         color="spkts,dpkts,sbytes,dbytes:RED+BLINK"

filter="src co CN"  color="all:RED+BLINK" cont
filter="tcp"        color="saddr,daddr,dir,sport,dport,proto:WHITE"
