Use ralabel() and its extensive configuration support to specify what geolocation data will be inserted into each argus record that it encounters. Geolocation data, such as country codes, lat/lon values and AS numbers, have structured storage support, so that you can filter on it, aggregate using the data as aggregation keys, and you can anonymize the information. Geolocation data maybe relevant for only a short time, and so getting the data into the argus data records is an important support feature. Argus clients support the use of two free Internet information systems the InterNic databases, which provide Country Codes, and MaxMind's Opensource GeoIP database, which can provide geolocation for the registered administrator of the domain.Ĭountry codes are fairly reliable, and some IP address location from GeoIP are well mapped, so these free systems are very useful. To provide geolocation, such as country codes, or latitude/longitude (lat/lon) information, argus clients use third party databases to provide the mapping between Layer 3 addresses and some geo-relevant information. Layer 2 and 3 network address information doesn't provide any sense of where they are, but because Layer 2 and 3 addresses are suppose to be globally unique, at any given moment, there should be a single physical location for each of these objects. Additional data that is used to provide relative geolocation are TTL (hops), Round Trip Times, and One-Way Delay metrics. For argus data derived from Netflow data, AS numbers can be used to provide a form of netlocation. For pure argus data, the Layer 2 and Layer 3 network addresses that are contained in the flow data records provide the basis for geographically placing the data. There are a lot of definitions for geolocation, but for argus data, geolocation is the use of argus object values for geo-relevant positioning.

Argus monitor for beginners