 |
|
| |
ARGUS(8) |
FreeBSD System Manager's Manual |
ARGUS(8) |
argus - audit record generation and utilization system
argus [ options ] [ filter expression ]
Copyright (c) 2000-2015 QoSient, LLC All rights reserved.
Argus is a data network transaction auditing tool that categorizes and
tracks network packets that match the libpcap filter expression into a
protocol-specific network flow transaction model. Argus reports on the
transactions that it discovers, as periodic network flow data, that is
suitable for historical and near real-time processing for forensics, trending
and alarm/alerting.
Designed to run as a daemon, argus reads packets directly
from a network interface, classifies the packets into network transacations
and appends the resulting network flow data to a log file or open socket
connected to an argus client (such as ra(1)). Argus can
also read packet information from tcpdump(1) , snoop(1) ,
NLANR's Moat Time Sequence Header or Endaces ERF raw packet
files. Argus can also be configured to append its transaction logs to
stdout.
Argus can provide address based access control for its
socket connection facility using tcp_wrappers , and it can provide
strong authentication and confidentiality protection using SASL2
technology. Refer to package documentation to enable each of these
services.
- -A
- Generate application byte metrics in each audit record.
- -b
- Dump the compiled packet-matching code to stdout and stop. This is used to
debug filter expressions.
- -B
- <addr> Specify the bind interface address for remote access.
Acceptable values are IP version 4 addresses. The default is to bind to
INADDR_ANY address.
- -c
- <dir> Specify a chroot directory to use after privilege access is
complete. Must be super user to use this option.
- -C
- Run argus in control plane capture mode. This sets the interface packet
snap length to capture full packets, and to enable detailed flow tracking
for supported control plane protocols.
- -d
- Run argus as a daemon. This will cause argus to do the things that Unix
daemons do and return, if there were no errors, with argus running as a
detached process.
- -D
- <level> Print debug messages to stderr. The higher the
<level> the more information printed. Acceptable levels are
1-8.
- -e
- <value> Specify the source identifier for this argus.
Acceptable values are numbers, strings, hostnames or ip address. Double
quotes around the parameter are used to designate the string format. The
longest supported string is 4 characeters long. Be sure and single quote
or 'escape' the double quotes so that the shell doesn't gooble up the
delimiters.
This option sets a global Source identifier that can be
overriden by specific -i options.
argus -e '"arg1"'
argus -e \"arg2\"
- -f
- When reading packets from a packet capture file, the -f option causes
argus to not stop when end of file is reached, but rather to wait for
additional packets to be appended to the input. The -f option is ignored
if the standard input is a pipe, but not if it is a FIFO.
- -F
- Use conffile as a source of configuration information. Options set
in this file override any other specification, and so this is the last
word on option values.
- -g
- <group> Specify a group name to change to after privilege access is
complete.
- -h
- Print an explanation of all the arguments.
- -i
- <interface> Specify the physical network <interface> to
be audited. The default is the first network interface that is up and
running.
The syntax for specifying the interface is the same format
used in the argus.conf.5 file. The optional source id specification can
be an IPv4 address, an integer, or a string denoted using double
quotes.
-i interface[/srcid]
-i all[/srcid]
-i dup:en0,en1/"ap01" ( en0 and en1 are in ingress and egress interfaces )
-i bond:en0,en1/2.3.4.5 ( en0 and en1 are bonded interfaces )
-i en0 en1 ( equivalent '-i bond:en0,en1' )
-i dup:[bond:en0,en1],en2/3 ( in this case 3 is the srcid )
-i en0/"en0" -i en1/"en1" ( equivalent '-i ind:en0/srcid,en1/srcid' )
- -J
- Generate packet peformance data in each audit record.
- -M
- <secs> Specify the interval in <secs> of argus status records.
These records are used to report the internal status of argus itself. The
default is 300 seconds.
- -m
- Provide MAC addresses information in argus records.
- -N <packet count>|<packet range>
- Specify the number of packets to process. You can give an absolute number,
or a range with the syntax "start-stop". Examples are:
-N 27 - read the first 27 packets.
-N 1034-1434 - read 100 packets starting with 1034.
- -O
- Turn off Berkeley Packet Filter optimizer. No reason to do this unless you
think the optimizer generates bad code.
- -p
- Do not set the physical network interface in promiscuous mode. If the
interface is already in promiscuous mode, this option may have no effect.
Do this to audit only the traffic coming to and from the system argus is
running on.
- -P
- <portnum> Specifies the <portnum> for remote client
connection. The default is to not support remote access. Setting the value
to zero (0) will forceably turn off the facility.
- -r <[type:]file [type:]file ... >
- Read from tcpdump(1) , snoop(1) or NLANR's Moat Time
Sequence Header (tsh) packet capture files. If the packet capture file
is a tsh format file, then the -t option must also be used.
The file "-" specifies stdin as the source of packets.
The type provides the opportunity to specify what type
of packet source to expect and process. Supported types are '' (default)
and 'cisco', where argus will process the payload of packets as netflow
records, when found.
Argus will read from only one input packet file at a time, and
will open the files in lexigraphic order. Care should be taken to ensure
that the timestamps in the packets are ordered, or unexpected behavior
may result. If the -r option is specified, argus will not
put down a listen(2) to support remote access.
- -R
- Generate argus records such that response times can be derived from
transaction data.
- -s
- <bytes> Specify the packet snaplen.
- -S
- <secs> Specify the status reporting interval in <secs> for all
traffic flows.
- -t
- Indicate that the expected packet capture input file is a NLANR's Moat
Time Sequence Header (tsh) packet capture file.
- -T timescale
- Specify a playback timescale for realtime processing of input
packets.
- -u
- <user> Specify an account name to change to after privilege access
is complete.
- -U
- Specify the number of user bytes to capture.
- -w
- <file | stream ["filter"]> Append transaction status
records to output-file or write records to the URL based stream.
Supported stream URLs are 'argus-udp://host[:port]', where the default
port is 561. An output-file of '-' directs argus to write
the resulting argus-file output to stdout.
- -X
- Clear existing argus configuration. This removes any initialization done
prior to encountering this flag. Allows you to eliminate the effects of
the /etc/argus.conf file, or any argus.conf files that may have
been loaded.
- -Z
- Collect packet size information. This options turns on packet size
reporting for all flows. Argus will provide the mean, max, min and
standard deviation of the packet sizes seen during the flow status
interval.
- expression
- This tcpdump(1) expression specifies which transactions will be
selected. If no expression is given, all transactions are selected.
Otherwise, only transactions for which expression is `true' will be
dumped. For a complete expression format description, please refer
to the tcpdump(1) man page.
Argus catches a number of signal(3) events. The three signals
SIGHUP, SIGINT, and SIGTERM cause argus to exit,
writing TIMEDOUT status records for all currently active transactions. The
signal SIGUSR1 will turn on debug reporting, and subsequent
SIGUSR1 signals, will increment the debug-level. The signal
SIGUSR2 will cause argus to turn off all debug reporting.
/etc/argus.conf - argus daemon configuration file
/var/run/argus.#.#.pid - PID file
Run argus as a daemon, writing all its transaction status reports to
output-file. This is the typical mode.
argus -d -e `hostname` -w output-file
If ICMP traffic is not of interest to you, you can filter out ICMP
packets on input.
argus -w output-file - ip and not icmp
Argus supports both input filtering and output filtering, and
argus supports multiple output streams, each with their own independant
filters. Output streams can be written to udp based sockets, to unicast or
multicast addresses.
If you are interested in tracking IP traffic only (input filter)
and want to report ICMP traffic to one output stream, and all other IP
traffic in another output stream.
argus -w argus-udp://224.0.20.21:561 "icmp" \
-w argus-udp://224.0.20.21:562 "not icmp" - ip
Audit the network activity that is flowing between the two gateway
routers, whose ethernet addresses are 00:08:03:2D:42:01 and
00:00:0C:18:29:F1. Without specifying an output-file, it is assumed
that the transaction status reports will be written to a remote client. In
this case we have changed the port that the remote client will use to port
430/tcp.
argus -P 430 ether host (0:8:3:2d:42:1 and 0:0:c:18:29:f1) &
Audit each individual ICMP ECHO transaction from data in
<dir>. You would do this to gather Round Trip Time (RTT) data within
your network. Append the output to output-file.
argus -R dir -w output-file "echo" - icmp
Audit all NFS transactions involving the server fileserver
and increase the reporting interval to 3600 seconds (to provide high data
reduction). Append the output to output-file.
argus -S 3600 -w output-file - host fileserver and udp and port 2049 &
Import flow data from pcap file containing Cisco flow data
packets. Write output to stdout, to a ra.1 instance.
argus -r cisco:pcap-file -w - | ra
Carter Bullard (carter@qosient.com)
hosts_access(5), hosts_options(5), tcpd(8),
tcpdump(1)
Visit the GSP FreeBSD Man Page Interface. Output converted with ManDoc.
|