RADUMP(1)

📦
version 5.0.2+git20250321.41f65e2 · 2 versions
, in debian trixie, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 RADUMP(1) 💖

okay bestie, gather round — this is the manual page for radump, living in the General Commands Manual section. Yes we're doing manual pages now, and yes it's giving iconic. 💅

✨ NAME ✨

radump — tcpdump processing of the user data buffers from an argus(8) data file/stream.

Like, it takes the user data buffers out of an argus file and does the tcpdump thing to them. That's the whole gig. 🎀

🌸 SYNOPSIS 🌸

radump -r argus-file [raoptions] [-- filter-expression]

🦋 DESCRIPTION 🦋

So here's the tea. Radump reads argus data from an argus data stream or file, and prints out tcpdump style decoding of the user data buffers.

That's it. That's the vibe. You point it at argus data, it goes "oh bestie let me decode those user data buffers for you" and prints them in that tcpdump-ass format. 🔥

✨ OPTIONS ✨

Radump, like all ra based clients, supports a number of ra options — including filtering of input argus records through a terminating filter expression.

fr fr, go read ra(1) for a complete description of ra options, because this page is not about to re-explain all of them. iykyk. 🫶

👑 EXAMPLE INVOCATION 👑

🌈 Example 1 — arp traffic

This one dumps the user capture buffers of arp traffic seen in the file. Heads up bestie: when there is no user buffer, or if the decoder can't decode it, the length will be 0.

% radump -r argus.file -s suser:64 duser:64 -N 5 - arp
                           srcUdata                                          dstUdata
  s[38]="who-has 192.168.0.66 tell 192.168.0.68"        d[36]="192.168.0.68 is-at c8:2a:14:58:7a:55"
  s[37]="who-has 192.168.0.1 tell 192.168.0.68"         d[36]="192.168.0.68 is-at 80:71:1f:3c:c3:88"
  s[37]="who-has 192.168.0.1 tell 192.168.0.66"          d[0]=""
  s[37]="who-has 192.168.0.1 tell 192.168.0.78"          d[0]=""
  s[38]="who-has 192.168.0.34 tell 192.168.0.66"         d[0]=""

🌈 Example 2 — DNS traffic

This one decodes the user capture buffers of DNS traffic seen in the file. 🧚

% radump -s stime pkts suser:64 duser:64 -r ~/argus/data/argus*00.out.gz - port domain
      StartTime  TotPkts                                 srcUdata                                         dstUdata
17:48:36.589949        2  s[37]="48936+ [_] A? www.cylab.cmu.edu. (35)"          d[32]="48936 1/3/0 A 128.2.129.188 (64)"
17:48:36.590557        2  s[30]="3018+ [_] A? qosient.com. (29)"                 d[31]="3018 1/2/0 A 216.92.14.146 (64)"
17:48:36.708172        2  s[39]="27243+ [_] A? ajax.googleapis.com. (37)"        d[26]="27243 2/4/4 CNAME[|domain]"
17:48:36.776033        2  s[31]="45149+ [_] A? nsmwiki.org. (29)"                d[33]="45149 1/3/0 A 69.163.152.168 (64)"
17:48:36.776501        2  s[40]="51781+ [_] A? www.surveymonkey.com. (38)"       d[31]="51781 1/13/0 A 75.98.93.51 (64)"
17:48:36.776655        2  s[31]="38953+ [_] A? www.cmu.edu. (29)"                d[51]="38953 3/2/1 CNAME WWW-CMU.ANDREW.cmu.edu.,[|domain]"
17:48:36.777014        2  s[32]="64748+ [_] A? www.cert.org. (30)"               d[33]="64748 1/2/0 A 192.88.209.244 (64)"
17:48:36.978293        2  s[44]="53009+ [_] A? www.google-analytics.com. (42)"   d[27]="53009 17/4/4 CNAME[|domain]"

🌈 Example 3 — HTTP traffic

And this one decodes the user capture buffers of HTTP traffic seen in the file. ⭐

radump -s stime proto dport pkts suser:32 duser:32 -r ~/argus/data/argus*00.out.gz -L0 -N5 - port http
      StartTime  Proto Dport  TotPkts                 srcUdata                            dstUdata
17:48:36.592155    tcp  http       27  s[32]="GET /research/cydat.html"  d[32]="HTTP/1.1 200 OK..Date: M"
17:48:36.632662    tcp  http       24  s[32]="GET /argus/ HTTP/1.1..Ho"  d[32]="HTTP/1.1 200 OK..Date: M"
17:48:36.705481    tcp  http       23  s[32]="GET /files/css/public.cs"  d[32]="HTTP/1.1 200 OK..Date: M"
17:48:36.705669    tcp  http       11  s[32]="GET /files/css/public_1c"  d[32]="HTTP/1.1 200 OK..Date: M"
17:48:36.705987    tcp  http       15  s[32]="GET /files/js/home.js HT"  d[32]="HTTP/1.1 200 OK..Date: M"

Copyright (c) 2000-2024 QoSient. All rights reserved.

yes bestie, that's the actual legal line, don't touch it, it's protected. 🙈

💜 AUTHORS 💜

Carter Bullard (carter@qosient.com).

the literal king, the main character, the one who wrote this. 👑

🌟 SEE ALSO 🌟

and that's the whole page, bestie!! 💖✨🦋🌸

cute little sign-off: this was radump 5.0.3, dated 12 August 2023, and the page itself is RADUMP(1). slay. periodt. 💅🫶

📦 where this page comes from