NAME

       argus - audit record generation and utilization system

SYNOPSIS

       argus [ options ] [ filter expression ]

COPYRIGHT

       Copyright (c) 2000-2004 QoSient, LLC All rights reserved.

DESCRIPTION

       Argus  is  an  IP  transaction  auditing  tool that categorizes IP packets which match the
       boolean expression into a protocol-specific network transaction model.  Argus  reports  on
       the transactions that it discovers, as they occur.

       Designed  to  run  as  a  daemon,  argus  generally  reads packets directly from a network
       interface, and writes the transaction status information to a  log  file  or  open  socket
       connected to an argus client (such as ra(1)).  Argus can also read packet information from
       tcpdump(1) , snoop(1) or NLANR's Moat Time Sequence Header raw packet  files.   Argus  can
       also be configured to write its transaction logs to stdout.

       Argus  provides  access  control  for  its  socket  connection  facility using tcp_wrapper
       technology.  Please refer to the tcp_wrapper distribution for a complete description.

OPTIONS

       -b   Dump the compiled packet-matching code to stdout and stop.  This  is  used  to  debug
            filter expressions.

       -B   Only  bind  to  the specified IP address (remote access must be enabled by a non-zero
            port).

       -c   Generate system pid file.  This will cause argus to create a pid  file  that  can  be
            used  to  control  the  number  of  argi  running  on a system.  The default pid file
            directory is /var/run, and $ARGUSHOME, when the OS does not suppor /var/run.

       -d   Run argus as a daemon.  This will cause argus to do the things that Unix  daemons  do
            and return, if there were no errors, with argus running as a detached process.

       -D   <level>  Print debug messages to stderr.  The higher the <level> the more information
            printed.  Acceptable levels are 1-8.

       -e   <value> Specify the source identifier for this argus.  Acceptable values are numbers,
            hostnames or ip address.

       -h   Print an explanation of all the arguments.

       -F   Use  conffile  as  a  source  of configuration information.  Options set in this file
            override any other specification, and so this is the last word on option values.

       -I   <number> Specify the <number>  of  instances  that  are  concurrently  allowed.   The
            default is 1.  This is impacts the pid file strategy for argus.

       -i   <interface>  Specify  the physical network <interface> to be audited.  The default is
            the first network interface that is up and running.

       -J   Generate packet peformance data in each audit record.

       -M   <secs> Specify the interval in <secs> of argus status  records.   These  records  are
            used to report the internal status of argus itself.  The default is 300 seconds.

       -m   Don't provide MAC addresses information in argus records.

       -n   <directory>  Specify  the  pid  file directory.  This overrides the default directory
            location, which is /var/run, or $ARGUSHOME if /var/run is not available.  This switch
            implies the -c switch.

       -O   Turn off Berkeley Packet Filter optimizer.  No reason to do this unless you think the
            optimizer generates bad code.

       -p   Do not set the physical network interface in promiscuous mode.  If the  interface  is
            already  in  promiscuous mode, this option may have no effect.  Do this to audit only
            the traffic coming to and from the system argus is running on.

       -P   <portnum> Specifies the <portnum> for remote client connection.  The  default  is  to
            not support remote access.  Setting the value to zero (0) will forceably turn off the
            facility.

       -r   Read from tcpdump(1) , snoop(1) or NLANR's Moat Time  Sequence  Header  (tsh)  packet
            capture  files.   If the packet capture file is a tsh format file, then the -t option
            must also be used.  Argus will read from only one input packet file at  a  time.   If
            the  -r  option  is  specified, argus will not put down a listen(2) to support remote
            access.

       -R   Generate argus records such that response times can be derived from transaction data.

       -S   <secs> Specify the status reporting interval in <secs> for all traffic flows.

       -t   Indicate that the expected packet capture input file is a NLANR's Moat Time  Sequence
            Header (tsh) packet capture file.

       -U   Specify the number of user bytes to capture.

       -w   <file  ["filter"] Write transaction status records to output-file.  An output-file of
            '-' directs argus to write the resulting argus-file output to stdout.

       -X   Clear existing argus configuration.  This removes any initialization  done  prior  to
            encountering  this  flag.  Allows you to eliminate the effects of the /etc/argus.conf
            file, or any argus.conf files that may have been loaded.

       expression
            This tcpdump(1) expression specifies which transactions  will  be  selected.   If  no
            expression is given, all transactions are selected.  Otherwise, only transactions for
            which expression is  `true'  will  be  dumped.   For  a  complete  expression  format
            description, please refer to the tcpdump(1) man page.

SIGNALS

       Argus catches a number of signal(3) events.  The three signals SIGHUP, SIGINT, and SIGTERM
       cause  argus  to  exit,  writing  TIMEDOUT  status  records  for  all   currently   active
       transactions.   The  signal  SIGUSR1  will turn on debug reporting, and subsequent SIGUSR1
       signals, will increment the debug-level. The signal SIGUSR2 will cause argus to  turn  off
       all debug reporting.

ENVIRONMENT

       $ARGUSHOME - Argus Root directory

FILES

       /etc/argus.conf        - argus daemon configuration file
       /var/run/argus_os.pid  - default PID file nameing convention

EXAMPLES

       Run argus as a daemon, writing all its transaction status reports to output-file.  This is
       the typical mode.
              argus -d -e `hostname` -w output-file

       If ICMP traffic is not of interest to you, you can filter out ICMP packets on input.
              argus -w output-file - ip and not icmp

       Argus supports both input filtering and output  filtering,  and  argus  supports  multiple
       output streams, each with their own independant filters.

       If  you  are interested in tracking IP traffic only (input filter) and want to report ICMP
       traffic in one output file, and all other IP traffic in another file.
              argus -w outfile1 "icmp" -w outfile2 "not icmp" - ip

       Audit the network activity that is flowing between the two gateway routers, whose ethernet
       addresses are 00:08:03:2D:42:01 and 00:00:0C:18:29:F1.  Without specifying an output-file,
       it is assumed that the transaction status reports will be written to a remote client.   In
       this case we have changed the port that the remote client will use to port 430/tcp.
              argus -P 430 ether host (0:8:3:2d:42:1 and 0:0:c:18:29:f1) &

       Audit  each  individual  ICMP  ECHO transaction.  You would do this gather Round Trip Time
       data within your network.  Write the output to output-file.
              argus -R -w output-file "echo" - icmp

       Audit all NFS transactions involving the server  fileserver  and  increase  the  reporting
       interval  to  3600  seconds (to provide high data reduction).  Write the output to output-
       file.
              argus -S 3600 -w output-file udp and port 2049 &

AUTHORS

       Carter Bullard (carter@qosient.com)

SEE ALSO

       argus.conf(5), hosts_access(5), hosts_options(5), tcpd(8), tcpdump(1)

                                         10 November 2000                                ARGUS(8)