argus - audit record generation and utilization system
] [ filter expression
Copyright (c) 2000-2015 QoSient, LLC All rights reserved.
is a data network transaction auditing tool that categorizes and
tracks network packets that match the libpcap filter expression
protocol-specific network flow transaction model. Argus
reports on the
transactions that it discovers, as periodic network flow data, that is
suitable for historical and near real-time processing for forensics, trending
Designed to run as a daemon, argus
reads packets directly from a network
interface, classifies the packets into network transacations and appends the
resulting network flow data to a log file or open socket connected to an
client (such as ra(1)
can also read packet
information from tcpdump(1)
, NLANR's Moat Time
or Endaces ERF
raw packet files. Argus
also be configured to append its transaction logs to stdout.
can provide address based access control for its socket connection
facility using tcp_wrappers
, and it can provide strong authentication
and confidentiality protection using SASL2
technology. Refer to package
documentation to enable each of these services.
- Generate application byte metrics in each audit
- Dump the compiled packet-matching code to stdout and stop.
This is used to debug filter expressions.
- <addr> Specify the bind interface address for remote
access. Acceptable values are IP version 4 addresses. The default is to
bind to INADDR_ANY address.
- <dir> Specify a chroot directory to use after
privilege access is complete. Must be super user to use this option.
- Run argus in control plane capture mode. This sets the
interface packet snap length to capture full packets, and to enable
detailed flow tracking for supported control plane protocols.
- Run argus as a daemon. This will cause argus to do the
things that Unix daemons do and return, if there were no errors, with
argus running as a detached process.
- <level> Print debug messages to stderr. The higher
the <level> the more information printed. Acceptable levels
- <value> Specify the source identifier for this
argus. Acceptable values are numbers, strings, hostnames or ip
address. Double quotes around the parameter are used to designate the
string format. The longest supported string is 4 characeters long. Be sure
and single quote or 'escape' the double quotes so that the shell doesn't
gooble up the delimiters.
This option sets a global Source identifier that can be overriden by
specific -i options.
argus -e '"arg1"'
argus -e \"arg2\"
- When reading packets from a packet capture file, the -f
option causes argus to not stop when end of file is reached, but rather to
wait for additional packets to be appended to the input. The -f option is
ignored if the standard input is a pipe, but not if it is a FIFO.
- Use conffile as a source of configuration
information. Options set in this file override any other specification,
and so this is the last word on option values.
- <group> Specify a group name to change to after
privilege access is complete.
- Print an explanation of all the arguments.
- <interface> Specify the physical network
<interface> to be audited. The default is the first network
interface that is up and running.
The syntax for specifying the interface is the same format used in the
argus.conf.5 file. The optional source id specification can be an IPv4
address, an integer, or a string denoted using double quotes.
-i dup:en0,en1/"ap01" ( en0 and en1 are in ingress and egress interfaces )
-i bond:en0,en1/18.104.22.168 ( en0 and en1 are bonded interfaces )
-i en0 en1 ( equivalent '-i bond:en0,en1' )
-i dup:[bond:en0,en1],en2/3 ( in this case 3 is the srcid )
-i en0/"en0" -i en1/"en1" ( equivalent '-i ind:en0/srcid,en1/srcid' )
- Generate packet peformance data in each audit record.
- <secs> Specify the interval in <secs> of argus
status records. These records are used to report the internal status of
argus itself. The default is 300 seconds.
- Provide MAC addresses information in argus
- -N <packet count>|<packet range>
- Specify the number of packets to process. You can give an
absolute number, or a range with the syntax "start-stop".
-N 27 - read the first 27 packets.
-N 1034-1434 - read 100 packets starting with 1034.
- Turn off Berkeley Packet Filter optimizer. No reason to do
this unless you think the optimizer generates bad code.
- Do not set the physical network interface in promiscuous
mode. If the interface is already in promiscuous mode, this option may
have no effect. Do this to audit only the traffic coming to and from the
system argus is running on.
- <portnum> Specifies the <portnum> for
remote client connection. The default is to not support remote access.
Setting the value to zero (0) will forceably turn off the facility.
- -r <[type:]file [type:]file ... >
- Read from tcpdump(1) , snoop(1) or NLANR's
Moat Time Sequence Header (tsh) packet capture files. If the packet
capture file is a tsh format file, then the -t option must
also be used. The file "-" specifies stdin as the source of
The type provides the opportunity to specify what type of packet
source to expect and process. Supported types are '' (default) and
'cisco', where argus will process the payload of packets as netflow
records, when found.
Argus will read from only one input packet file at a time, and will open the
files in lexigraphic order. Care should be taken to ensure that the
timestamps in the packets are ordered, or unexpected behavior may result.
If the -r option is specified, argus will not put down a
listen(2) to support remote access.
- Generate argus records such that response times can be
derived from transaction data.
- <bytes> Specify the packet snaplen.
- <secs> Specify the status reporting interval in
<secs> for all traffic flows.
- Indicate that the expected packet capture input file is a
NLANR's Moat Time Sequence Header (tsh) packet capture file.
- -T timescale
- Specify a playback timescale for realtime processing of
- <user> Specify an account name to change to after
privilege access is complete.
- Specify the number of user bytes to capture.
- <file | stream ["filter"]> Append
transaction status records to output-file or write records to the
URL based stream. Supported stream URLs are 'argus-udp://host[:port]',
where the default port is 561. An output-file of '-' directs
argus to write the resulting argus-file output to
- Clear existing argus configuration. This removes any
initialization done prior to encountering this flag. Allows you to
eliminate the effects of the /etc/argus.conf file, or any
argus.conf files that may have been loaded.
- Collect packet size information. This options turns on
packet size reporting for all flows. Argus will provide the mean, max, min
and standard deviation of the packet sizes seen during the flow status
- This tcpdump(1) expression specifies which
transactions will be selected. If no expression is given, all
transactions are selected. Otherwise, only transactions for which
expression is `true' will be dumped. For a complete
expression format description, please refer to the
tcpdump(1) man page.
catches a number of signal(3)
events. The three signals
, and SIGTERM
writing TIMEDOUT status records for all currently active transactions. The
will turn on debug
reporting, and subsequent
signals, will increment the debug-level
. The signal
will cause argus
to turn off all debug
/etc/argus.conf - argus daemon configuration file
/var/run/argus.#.#.pid - PID file
as a daemon, writing all its transaction status reports to
. This is the typical mode.
argus -d -e `hostname` -w output-file
If ICMP traffic is not of interest to you, you can filter out ICMP packets on
argus -w output-file - ip and not icmp
Argus supports both input filtering and output filtering, and argus supports
multiple output streams, each with their own independant filters. Output
streams can be written to udp based sockets, to unicast or multicast
If you are interested in tracking IP traffic only (input filter) and want to
report ICMP traffic to one output stream, and all other IP traffic in another
argus -w argus-udp://22.214.171.124:561 "icmp" \
-w argus-udp://126.96.36.199:562 "not icmp" - ip
Audit the network activity that is flowing between the two gateway routers,
whose ethernet addresses are 00:08:03:2D:42:01 and 00:00:0C:18:29:F1. Without
specifying an output-file
, it is assumed that the transaction status
reports will be written to a remote client. In this case we have changed the
port that the remote client will use to port 430/tcp.
argus -P 430 ether host (0:8:3:2d:42:1 and 0:0:c:18:29:f1) &
Audit each individual ICMP ECHO transaction from data in <dir>. You would
do this to gather Round Trip Time (RTT) data within your network. Append the
output to output-file
argus -R dir -w output-file "echo" - icmp
Audit all NFS transactions involving the server fileserver
the reporting interval to 3600 seconds (to provide high data reduction).
Append the output to output-file
argus -S 3600 -w output-file - host fileserver and udp and port 2049 &
Import flow data from pcap file containing Cisco flow data packets. Write output
to stdout, to a ra.1
argus -r cisco:pcap-file -w - | ra
Carter Bullard (email@example.com)