NAME¶
argus - audit record generation and utilization system
SYNOPSIS¶
argus [
options ] [
filter expression ]
COPYRIGHT¶
Copyright (c) 2000-2004 QoSient, LLC All rights reserved.
DESCRIPTION¶
Argus is an IP transaction auditing tool that categorizes IP packets
which match the boolean
expression into a protocol-specific network
transaction model.
Argus reports on the transactions that it discovers,
as they occur.
Designed to run as a daemon,
argus generally reads packets directly from
a network interface, and writes the transaction status information to a log
file or open socket connected to an
argus client (such as
ra(1)).
Argus can also read packet information from
tcpdump(1) , snoop(1) or
NLANR's Moat Time Sequence
Header raw packet files.
Argus can also be configured to write its
transaction logs to stdout.
Argus provides access control for its socket connection facility using
tcp_wrapper technology. Please refer to the
tcp_wrapper
distribution for a complete description.
OPTIONS¶
- -b
- Dump the compiled packet-matching code to stdout and stop.
This is used to debug filter expressions.
- -B
- Only bind to the specified IP address (remote access must
be enabled by a non-zero port).
- -c
- Generate system pid file. This will cause argus to create a
pid file that can be used to control the number of argi running on a
system. The default pid file directory is /var/run, and $ARGUSHOME, when
the OS does not suppor /var/run.
- -d
- Run argus as a daemon. This will cause argus to do the
things that Unix daemons do and return, if there were no errors, with
argus running as a detached process.
- -D
- <level> Print debug messages to stderr. The higher
the <level> the more information printed. Acceptable levels
are 1-8.
- -e
- <value> Specify the source identifier for this
argus. Acceptable values are numbers, hostnames or ip address.
- -h
- Print an explanation of all the arguments.
- -F
- Use conffile as a source of configuration
information. Options set in this file override any other specification,
and so this is the last word on option values.
- -I
- <number> Specify the <number> of
instances that are concurrently allowed. The default is 1. This is impacts
the pid file strategy for argus.
- -i
- <interface> Specify the physical network
<interface> to be audited. The default is the first network
interface that is up and running.
- -J
- Generate packet peformance data in each audit record.
- -M
- <secs> Specify the interval in <secs> of argus
status records. These records are used to report the internal status of
argus itself. The default is 300 seconds.
- -m
- Don't provide MAC addresses information in argus
records.
- -n
- <directory> Specify the pid file directory. This
overrides the default directory location, which is /var/run, or $ARGUSHOME
if /var/run is not available. This switch implies the -c switch.
- -O
- Turn off Berkeley Packet Filter optimizer. No reason to do
this unless you think the optimizer generates bad code.
- -p
- Do not set the physical network interface in promiscuous
mode. If the interface is already in promiscuous mode, this option may
have no effect. Do this to audit only the traffic coming to and from the
system argus is running on.
- -P
- <portnum> Specifies the <portnum> for
remote client connection. The default is to not support remote access.
Setting the value to zero (0) will forceably turn off the facility.
- -r
- Read from tcpdump(1) , snoop(1) or NLANR's
Moat Time Sequence Header (tsh) packet capture files. If the packet
capture file is a tsh format file, then the -t option must
also be used. Argus will read from only one input packet file at a time.
If the -r option is specified, argus will not put down a
listen(2) to support remote access.
- -R
- Generate argus records such that response times can be
derived from transaction data.
- -S
- <secs> Specify the status reporting interval in
<secs> for all traffic flows.
- -t
- Indicate that the expected packet capture input file is a
NLANR's Moat Time Sequence Header (tsh) packet capture file.
- -U
- Specify the number of user bytes to capture.
- -w
- <file ["filter"] Write transaction status
records to output-file. An output-file of '-' directs
argus to write the resulting argus-file output to
stdout.
- -X
- Clear existing argus configuration. This removes any
initialization done prior to encountering this flag. Allows you to
eliminate the effects of the /etc/argus.conf file, or any
argus.conf files that may have been loaded.
- expression
- This tcpdump(1) expression specifies which
transactions will be selected. If no expression is given, all
transactions are selected. Otherwise, only transactions for which
expression is `true' will be dumped. For a complete
expression format description, please refer to the
tcpdump(1) man page.
SIGNALS¶
Argus catches a number of
signal(3) events. The three signals
SIGHUP,
SIGINT, and
SIGTERM cause
argus to exit,
writing TIMEDOUT status records for all currently active transactions. The
signal
SIGUSR1 will turn on
debug reporting, and subsequent
SIGUSR1 signals, will increment the
debug-level. The signal
SIGUSR2 will cause
argus to turn off all
debug reporting.
ENVIRONMENT¶
$ARGUSHOME - Argus Root directory
FILES¶
/etc/argus.conf - argus daemon configuration file
/var/run/argus_os.pid - default PID file nameing convention
EXAMPLES¶
Run
argus as a daemon, writing all its transaction status reports to
output-file. This is the typical mode.
argus -d -e `hostname` -w output-file
If ICMP traffic is not of interest to you, you can filter out ICMP packets on
input.
argus -w output-file - ip and not icmp
Argus supports both input filtering and output filtering, and argus supports
multiple output streams, each with their own independant filters.
If you are interested in tracking IP traffic only (input filter) and want to
report ICMP traffic in one output file, and all other IP traffic in another
file.
argus -w outfile1 "icmp" -w outfile2 "not icmp" - ip
Audit the network activity that is flowing between the two gateway routers,
whose ethernet addresses are 00:08:03:2D:42:01 and 00:00:0C:18:29:F1. Without
specifying an
output-file, it is assumed that the transaction status
reports will be written to a remote client. In this case we have changed the
port that the remote client will use to port 430/tcp.
argus -P 430 ether host (0:8:3:2d:42:1 and 0:0:c:18:29:f1) &
Audit each individual ICMP ECHO transaction. You would do this gather Round Trip
Time data within your network. Write the output to
output-file.
argus -R -w output-file "echo" - icmp
Audit all NFS transactions involving the server
fileserver and increase
the reporting interval to 3600 seconds (to provide high data reduction). Write
the output to
output-file.
argus -S 3600 -w output-file udp and port 2049 &
AUTHORS¶
Carter Bullard (carter@qosient.com)
SEE ALSO¶
argus.conf(5),
hosts_access(5),
hosts_options(5),
tcpd(8),
tcpdump(1)
