Provided by: argus-server_3.0.8.2-1_amd64 
NAME
argus - audit record generation and utilization system
SYNOPSIS
argus [ options ] [ filter expression ]
COPYRIGHT
Copyright (c) 2000-2015 QoSient, LLC All rights reserved.
DESCRIPTION
Argus is a data network transaction auditing tool that categorizes and tracks network
packets that match the libpcap filter expression into a protocol-specific network flow
transaction model. Argus reports on the transactions that it discovers, as periodic
network flow data, that is suitable for historical and near real-time processing for
forensics, trending and alarm/alerting.
Designed to run as a daemon, argus reads packets directly from a network interface,
classifies the packets into network transacations and appends the resulting network flow
data to a log file or open socket connected to an argus client (such as ra(1)). Argus can
also read packet information from tcpdump(1) , snoop(1) , NLANR's Moat Time Sequence
Header or Endaces ERF raw packet files. Argus can also be configured to append its
transaction logs to stdout.
Argus can provide address based access control for its socket connection facility using
tcp_wrappers , and it can provide strong authentication and confidentiality protection
using SASL2 technology. Refer to package documentation to enable each of these services.
OPTIONS
-A Generate application byte metrics in each audit record.
-b Dump the compiled packet-matching code to stdout and stop. This is used to debug
filter expressions.
-B <addr> Specify the bind interface address for remote access. Acceptable values are
IP version 4 addresses. The default is to bind to INADDR_ANY address.
-c <dir> Specify a chroot directory to use after privilege access is complete. Must be
super user to use this option.
-C Run argus in control plane capture mode. This sets the interface packet snap length
to capture full packets, and to enable detailed flow tracking for supported control
plane protocols.
-d Run argus as a daemon. This will cause argus to do the things that Unix daemons do
and return, if there were no errors, with argus running as a detached process.
-D <level> Print debug messages to stderr. The higher the <level> the more information
printed. Acceptable levels are 1-8.
-e <value> Specify the source identifier for this argus. Acceptable values are numbers,
strings, hostnames or ip address. Double quotes around the parameter are used to
designate the string format. The longest supported string is 4 characeters long. Be
sure and single quote or 'escape' the double quotes so that the shell doesn't gooble
up the delimiters.
This option sets a global Source identifier that can be overriden by specific -i
options.
argus -e '"arg1"'
argus -e \"arg2\"
-f When reading packets from a packet capture file, the -f option causes argus to not
stop when end of file is reached, but rather to wait for additional packets to be
appended to the input. The -f option is ignored if the standard input is a pipe, but
not if it is a FIFO.
-F Use conffile as a source of configuration information. Options set in this file
override any other specification, and so this is the last word on option values.
-g <group> Specify a group name to change to after privilege access is complete.
-h Print an explanation of all the arguments.
-i <interface> Specify the physical network <interface> to be audited. The default is
the first network interface that is up and running.
The syntax for specifying the interface is the same format used in the argus.conf.5
file. The optional source id specification can be an IPv4 address, an integer, or a
string denoted using double quotes.
-i interface[/srcid]
-i all[/srcid]
-i dup:en0,en1/"ap01" ( en0 and en1 are in ingress and egress interfaces )
-i bond:en0,en1/2.3.4.5 ( en0 and en1 are bonded interfaces )
-i en0 en1 ( equivalent '-i bond:en0,en1' )
-i dup:[bond:en0,en1],en2/3 ( in this case 3 is the srcid )
-i en0/"en0" -i en1/"en1" ( equivalent '-i ind:en0/srcid,en1/srcid' )
-J Generate packet peformance data in each audit record.
-M <secs> Specify the interval in <secs> of argus status records. These records are
used to report the internal status of argus itself. The default is 300 seconds.
-m Provide MAC addresses information in argus records.
-N <packet count>|<packet range>
Specify the number of packets to process. You can give an absolute number, or a
range with the syntax "start-stop". Examples are:
-N 27 - read the first 27 packets.
-N 1034-1434 - read 100 packets starting with 1034.
-O Turn off Berkeley Packet Filter optimizer. No reason to do this unless you think the
optimizer generates bad code.
-p Do not set the physical network interface in promiscuous mode. If the interface is
already in promiscuous mode, this option may have no effect. Do this to audit only
the traffic coming to and from the system argus is running on.
-P <portnum> Specifies the <portnum> for remote client connection. The default is to
not support remote access. Setting the value to zero (0) will forceably turn off the
facility.
-r <[type:]file [type:]file ... >
Read from tcpdump(1) , snoop(1) or NLANR's Moat Time Sequence Header (tsh) packet
capture files. If the packet capture file is a tsh format file, then the -t option
must also be used. The file "-" specifies stdin as the source of packets.
The type provides the opportunity to specify what type of packet source to expect and
process. Supported types are '' (default) and 'cisco', where argus will process the
payload of packets as netflow records, when found.
Argus will read from only one input packet file at a time, and will open the files in
lexigraphic order. Care should be taken to ensure that the timestamps in the packets
are ordered, or unexpected behavior may result. If the -r option is specified, argus
will not put down a listen(2) to support remote access.
-R Generate argus records such that response times can be derived from transaction data.
-s <bytes> Specify the packet snaplen.
-S <secs> Specify the status reporting interval in <secs> for all traffic flows.
-t Indicate that the expected packet capture input file is a NLANR's Moat Time Sequence
Header (tsh) packet capture file.
-T timescale
Specify a playback timescale for realtime processing of input packets.
-u <user> Specify an account name to change to after privilege access is complete.
-U Specify the number of user bytes to capture.
-w <file | stream ["filter"]> Append transaction status records to output-file or write
records to the URL based stream. Supported stream URLs are 'argus-
udp://host[:port]', where the default port is 561. An output-file of '-' directs
argus to write the resulting argus-file output to stdout.
-X Clear existing argus configuration. This removes any initialization done prior to
encountering this flag. Allows you to eliminate the effects of the /etc/argus.conf
file, or any argus.conf files that may have been loaded.
-Z Collect packet size information. This options turns on packet size reporting for all
flows. Argus will provide the mean, max, min and standard deviation of the packet
sizes seen during the flow status interval.
expression
This tcpdump(1) expression specifies which transactions will be selected. If no
expression is given, all transactions are selected. Otherwise, only transactions for
which expression is `true' will be dumped. For a complete expression format
description, please refer to the tcpdump(1) man page.
SIGNALS
Argus catches a number of signal(3) events. The three signals SIGHUP, SIGINT, and SIGTERM
cause argus to exit, writing TIMEDOUT status records for all currently active
transactions. The signal SIGUSR1 will turn on debug reporting, and subsequent SIGUSR1
signals, will increment the debug-level. The signal SIGUSR2 will cause argus to turn off
all debug reporting.
FILES
/etc/argus.conf - argus daemon configuration file
/var/run/argus.#.#.pid - PID file
EXAMPLES
Run argus as a daemon, writing all its transaction status reports to output-file. This is
the typical mode.
argus -d -e `hostname` -w output-file
If ICMP traffic is not of interest to you, you can filter out ICMP packets on input.
argus -w output-file - ip and not icmp
Argus supports both input filtering and output filtering, and argus supports multiple
output streams, each with their own independant filters. Output streams can be written to
udp based sockets, to unicast or multicast addresses.
If you are interested in tracking IP traffic only (input filter) and want to report ICMP
traffic to one output stream, and all other IP traffic in another output stream.
argus -w argus-udp://224.0.20.21:561 "icmp" \
-w argus-udp://224.0.20.21:562 "not icmp" - ip
Audit the network activity that is flowing between the two gateway routers, whose ethernet
addresses are 00:08:03:2D:42:01 and 00:00:0C:18:29:F1. Without specifying an output-file,
it is assumed that the transaction status reports will be written to a remote client. In
this case we have changed the port that the remote client will use to port 430/tcp.
argus -P 430 ether host (0:8:3:2d:42:1 and 0:0:c:18:29:f1) &
Audit each individual ICMP ECHO transaction from data in <dir>. You would do this to
gather Round Trip Time (RTT) data within your network. Append the output to output-file.
argus -R dir -w output-file "echo" - icmp
Audit all NFS transactions involving the server fileserver and increase the reporting
interval to 3600 seconds (to provide high data reduction). Append the output to output-
file.
argus -S 3600 -w output-file - host fileserver and udp and port 2049 &
Import flow data from pcap file containing Cisco flow data packets. Write output to
stdout, to a ra.1 instance.
argus -r cisco:pcap-file -w - | ra
AUTHORS
Carter Bullard (carter@qosient.com)
SEE ALSO
hosts_access(5), hosts_options(5), tcpd(8), tcpdump(1)