NAME

       argus - IP Network Auditing Facility

COPYRIGHT

       Copyright (c) 2000-2004 QoSient. All rights reserved.

SYNOPSIS

       #include <[argus_dir]/include/argus_def.h>
       #include <[argus_dir]/include/argus_out.h>

DESCRIPTION

       The format of the argus(8) data stream is most succinctly described through the structures
       defined in the header file, but the general format is as follows:

              Argus File Format:
                 Argus_Datum Initial_Management_Record
                 Argus_Datum
                      .
                      .
                 Argus_Datum Management_Statistics
                 Argus_Datum
                      .
                      .

       where the individual data fields are defined as follows:

              struct ArgusRecord {
                 unsigned char type, cause;
                 unsigned short length;
                 unsigned int status;
                 unsigned int argusid;
                 unsigned int seqNumber;

                 union {
                    struct ArgusMarStruct  mar;
                    struct ArgusFarStruct  far;
                 } ar_union;
              };

              struct ArgusMarStruct {
                 struct timeval startime, now;
                 unsigned char  major_version, minor_version;
                 unsigned char interfaceType, interfaceStatus;
                 unsigned short reportInterval, argusMrInterval;
                 unsigned int argusid, localnet, netmask, nextMrSequenceNum;
                 unsigned long long pktsRcvd, bytesRcvd;
                 unsigned int  pktsDrop, flows, flowsClosed;
                 unsigned int actIPcons,  cloIPcons;
                 unsigned int actICMPcons,  cloICMPcons;
                 unsigned int actIGMPcons,  cloIGMPcons;
                 unsigned int actFRAGcons,  cloFRAGcons;
                 unsigned int actSECcons,  cloSECcons;
                 int record_len;
              };

              struct ArgusFarStruct {
                 unsigned char type, length;
                 unsigned short status;

                 unsigned int ArgusTransRefNum;
                 struct ArgusTimeDesc time;
                 struct ArgusFlow flow;
                 struct ArgusAttributes attr;
                 struct ArgusMeter src, dst;
              };

              struct ArgusTimeDesc {
                 struct timeval start;
                 struct timeval last;
              };

              struct ArgusFlow {
                 union {
                    struct ArgusIPFlow     ip;
                    struct ArgusICMPFlow icmp;
                    struct ArgusMACFlow   mac;
                    struct ArgusArpFlow   arp;
                    struct ArgusRarpFlow rarp;
                    struct ArgusESPFlow   esp;
                } flow_union;
              };

              struct ArgusIPAttributes {
                 unsigned short soptions, doptions;
                 unsigned char sttl, dttl;
                 unsigned char stos, dtos;
              };

              struct ArgusARPAttributes {
                 unsigned char response[8];
              };

              struct ArgusAttributes {
                 union {
                    struct ArgusIPAttributes   ip;
                    struct ArgusARPAttributes arp;
                 } attr_union;
              };

              struct ArgusMeter {
                 unsigned int count, bytes, appbytes;
              };

              struct ArgusIPFlow {
                 unsigned int ip_src, ip_dst;
                 unsigned char ip_p, tp_p;
                 unsigned short sport, dport;
                 unsigned short ip_id;
              };

              struct ArgusICMPFlow {
                 unsigned int ip_src, ip_dst;
                 unsigned char ip_p, tp_p;
                 unsigned char type, code;
                 unsigned short id, ip_id;
              };

              struct ArgusMACFlow {
                 struct ether_header ehdr;
                 unsigned char dsap, ssap;
              };

              struct ArgusArpFlow {
                 unsigned int arp_spa;
                 unsigned int arp_tpa;
                 unsigned char etheraddr[6];
                 unsigned short pad;
              };

              struct ArgusRarpFlow {
                 unsigned int arp_tpa;
                 unsigned char srceaddr[6];
                 unsigned char tareaddr[6];
              };

              struct ArgusESPFlow {
                 unsigned int ip_src, ip_dst;
                 unsigned char ip_p, tp_p;
                 unsigned short pad;
                 unsigned int spi;
              };

SEE ALSO

       argus(8),

                                           23 June 2000                                  ARGUS(5)