ARGUS(8)

📦
version 5.0.2 · 4 versions
, in debian trixie, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 ARGUS(8) — the system manager's manual, but make it make sense 💖

okay bestie, gather round, because this is the audit record generation and utilization system and it is genuinely iconic. it's argus, it lives in section 8 of the system manager's manual, and i'm about to walk you through it like we're texting at 2am. no cap. 🦋

✨ NAME ✨

argus — audit record generation and utilization system. yes that's the whole name. it's giving main character energy from the jump. 👑

🌸 SYNOPSIS 🌸

argus [ options ] [ filter expression ]

that's it. that's the vibe. options in, filter expression optionally in, audited network flows out. slay. 💅

Copyright (c) 2000-2024 QoSient, LLC All rights reserved.

(protect the intellectual property, periodt. ✨)

🦋 DESCRIPTION 🦋

okay so. Argus is a data network transaction auditing tool — and the way that it categorizes and tracks network packets that match the libpcap filter expression into a protocol-specific network flow transaction model is honestly so satisfying. it reports on the transactions it discovers as periodic network flow data, which is perfect for historical and near real-time processing: forensics, trending, and alarm/alerting. literally all the good stuff. 🔥

Designed to run as a daemon, argus reads packets directly from a network interface, classifies them into network transactions, and appends the resulting network flow data to a log file or an open socket connected to an argus client (such as ra(1)). she's connected, she's listening. 🫶

Argus can also read packet information from tcpdump(1), snoop(1), NLANR's Moat Time Sequence Header, or Endaces ERF raw packet files. and yes, she can even be configured to append her transaction logs to stdout if that's the vibe you're going for.

Argus can provide address based access control for its socket connection facility using tcp_wrappers, and it can provide strong authentication and confidentiality protection using SASL2 technology. but bestie, listen — refer to the package documentation to enable each of these services. i'm not gonna pretend the setup is automatic. 🙈

💜 OPTIONS 💜

  • -A — Generate application byte metrics in each audit record. metrics queen. 📊
  • -b — Dump the compiled packet-matching code to stdout and stop. this is the "let me see what you did there" option, used to debug filter expressions.
  • -B <addr> — Specify the bind interface address for remote access. acceptable values are IP version 4 addresses. the default is to bind to the INADDR_ANY address. she's open to everyone by default, i fear.
  • -c <dir> — Specify a chroot directory to use after privilege access is complete. ⚠️ must be super user to use this option.
  • -C — Run argus in control plane capture mode. this sets the interface packet snap length to capture full packets, and enables detailed flow tracking for supported control plane protocols.
  • -d — Run argus as a daemon. this causes argus to do the things that Unix daemons do and return, if there were no errors, with argus running as a detached process. she's independent now. 🧚
  • -D <level> — Print debug messages to stderr. the higher the <level> the more information printed. acceptable levels are 1-8. turn it up. 🔊
  • -e <value> — Specify the source identifier for this argus. acceptable values are numbers, strings, hostnames or ip address. double quotes around the parameter are used to designate the string format. the longest supported string is 4 characters long. ⚠️ be sure and single quote or 'escape' the double quotes so that the shell doesn't gooble up the delimiters.

This option sets a global Source identifier that can be overriden by specific -i options.

argus -e '"arg1"'
argus -e \"arg2\"
  • -Edays — Check out a license and cache locally for the specified number of days. any positive integer is valid but the license server may impose a limit on this value. if the value is zero (0) or the option is not specified, a floating license is requested for the duration of the process.
  • -f — When reading packets from a packet capture file, the -f option causes argus to not stop when end of file is reached, but rather to wait for additional packets to be appended to the input. the -f option is ignored if the standard input is a pipe, but not if it is a FIFO. she's patient. she'll wait. 💅
  • -F — Use conffile as a source of configuration information. options set in this file override any other specification, and so this is the last word on option values. final answer, no rebuttals. 👑
  • -g <group> — Specify a group name to change to after privilege access is complete.
  • -h — Print an explanation of all the arguments. the help button. the "bestie explain" button. 🫶
  • -i <interface> — Specify the physical network <interface> to be audited. the default is the first network interface that is up and running.

The syntax for specifying the interface is the same format used in the argus.conf.5 file. the optional source id specification can be an IPv4 address, an integer, or a string denoted using double quotes.

-i interface[/srcid]
-i all[/srcid]
-i dup:en0,en1/"ap01"               ( en0 and en1 are in ingress and egress interfaces )
-i bond:en0,en1/2.3.4.5             ( en0 and en1 are bonded interfaces )
-i en0 en1                          ( equivalent '-i bond:en0,en1' )
-i dup:[bond:en0,en1],en2/3         ( in this case 3 is the srcid )
-i en0/"en0" -i en1/"en1"           ( equivalent '-i ind:en0/srcid,en1/srcid' )
  • -J — Generate packet performance data in each audit record. 📈
  • -k <level> — Specify the log level when sending messages to the terminal. the value must be an integer in the range 0..7. these correspond to the eight syslog levels LOG_EMERG through LOG_DEBUG. the default level is LOG_WARNING.
  • -M <secs> — Specify the interval in <secs> of argus status records. these records are used to report the internal status of argus itself. the default is 300 seconds.
  • -m — Provide MAC addresses information in argus records. 🎀
  • -N <packet count>|<packet range> — Specify the number of packets to process. you can give an absolute number, or a range with the syntax "start-stop". examples are:
-N 27         - read the first 27 packets.
-N 1034-1434  - read 100 packets starting with 1034.
  • -O — Turn off the Berkeley Packet Filter optimizer. ⚠️ no reason to do this unless you think the optimizer generates bad code. (do you? do you really? 🤨)
  • -p — Do not set the physical network interface in promiscuous mode. if the interface is already in promiscuous mode, this option may have no effect. do this to audit only the traffic coming to and from the system argus is running on. she's being exclusive, and honestly? respect.
  • -P <portnum> — Specifies the <portnum> for remote client connection. the default is to not support remote access. setting the value to zero (0) will forceably turn off the facility. 🚫
  • -r <[type:]file [type:]file ... > — Read from tcpdump(1), snoop(1) or NLANR's Moat Time Sequence Header (tsh) packet capture files. if the packet capture file is a tsh format file, then the -t option must also be used. the file "-" specifies stdin as the source of packets.

The type provides the opportunity to specify what type of packet source to expect and process. supported types are '' (default) and 'cisco', where argus will process the payload of packets as netflow records, when found.

⚠️ Argus will read from only one input packet file at a time, and will open the files in lexigraphic order. care should be taken to ensure that the timestamps in the packets are ordered, or unexpected behavior may result. if the -r option is specified, argus will not put down a listen(2) to support remote access.

  • -R — Generate argus records such that response times can be derived from transaction data. ⏱️
  • -s <bytes> — Specify the packet snaplen.
  • -S <secs> — Specify the status reporting interval in <secs> for all traffic flows.
  • -t — Indicate that the expected packet capture input file is a NLANR's Moat Time Sequence Header (tsh) packet capture file.
  • -T timescale — Specify a playback timescale for realtime processing of input packets.
  • -u <user> — Specify an account name to change to after privilege access is complete.
  • -U — Specify the number of user bytes to capture.
  • -w <file | stream ["filter"]> — Append transaction status records to output-file or write records to the URL based stream. supported stream URLs are 'argus-udp://host[:port]', where the default port is 561. an output-file of '-' directs argus to write the resulting argus-file output to stdout. 🫶
  • -X — Clear existing argus configuration. this removes any initialization done prior to encountering this flag. allows you to eliminate the effects of the /etc/argus.conf file, or any argus.conf files that may have been loaded. fresh start, clean slate, new me. 🧚✨
  • -Z — Collect packet size information. this option turns on packet size reporting for all flows. argus will provide the mean, max, min and standard deviation of the packet sizes seen during the flow status interval. math girlies rise up. 📐
  • expression — This tcpdump(1) expression specifies which transactions will be selected. if no expression is given, all transactions are selected. otherwise, only transactions for which expression is true will be dumped. for a complete expression format description, please refer to the tcpdump(1) man page. iykyk. 💅

🌈 SIGNALS 🌈

Argus catches a number of signal(3) events. the three signals SIGHUP, SIGINT, and SIGTERM cause argus to exit, writing TIMEDOUT status records for all currently active transactions. she's leaving but she's leaving cleanly. 😭

The signal SIGUSR1 will turn on debug reporting, and subsequent SIGUSR1 signals will increment the debug-level. the signal SIGUSR2 will cause argus to turn off all debug reporting. volume up, volume down. 🔊🔇

🍓 FILES 🍓

  • /etc/argus.conf — argus daemon configuration file
  • /var/run/argus.#.#.pid — PID file

okay that's part 1 bestie, and there's more coming so don't go anywhere. 🦋✨

✨ EXAMPLES ✨

Okay bestie, this is where it gets fun. Real-world receipts, let's go 💅

🦋 Run argus as a daemon

Run argus as a daemon, writing all its transaction status reports to output-file. This is the typical mode, fr fr — it's the default vibe.

argus -d -e `hostname` -w output-file

🎀 Filter out the ICMP, bestie

If ICMP traffic is not of interest to you (no shade to ICMP, it's just not your era), you can filter out ICMP packets on input.

argus -w output-file - ip and not icmp

👑 Multiple output streams, main character energy

Argus supports both input filtering and output filtering, and argus supports multiple output streams, each with their own independant filters. Output streams can be written to udp based sockets, to unicast or multicast addresses. Not me being obsessed with this level of flexibility 😭

So if you are interested in tracking IP traffic only (that's the input filter) and want to report ICMP traffic to one output stream, and all other IP traffic in another output stream:

argus -w argus-udp://224.0.20.21:561 "icmp" \
      -w argus-udp://224.0.20.21:562 "not icmp" - ip

Like, two streams, two filters, one input filter. Ate. Periodt. 🔥

🌸 Auditing between two gateway routers

Audit the network activity that is flowing between the two gateway routers, whose ethernet addresses are 00:08:03:2D:42:01 and 00:00:0C:18:29:F1. Without specifying an output-file, it is assumed that the transaction status reports will be written to a remote client. In this case we have changed the port that the remote client will use to port 430/tcp.

argus -P 430 ether host (0:8:3:2d:42:1 and 0:0:c:18:29:f1) &

🧚 ICMP ECHO + RTT data, the girlies love latency

Audit each individual ICMP ECHO transaction from data in <dir>. You would do this to gather Round Trip Time (RTT) data within your network. Append the output to output-file.

argus -R dir -w output-file "echo" - icmp

RTT data?? In my network?? It's more likely than you think 💖

💜 NFS + high data reduction

Audit all NFS transactions involving the server fileserver and increase the reporting interval to 3600 seconds (to provide high data reduction). Append the output to output-file.

argus -S 3600 -w output-file - host fileserver and udp and port 2049 &

Data reduction is that girl. Highkey iconic. 🌈

🍓 Import flow data from pcap

Import flow data from pcap file containing Cisco flow data packets. Write output to stdout, to a ra.1 instance.

argus -r cisco:pcap-file -w - | ra

Piping straight into ra?? Chef's kiss. The pipeline is serving. 🫶

💖 AUTHORS 💖

Carter Bullard (carter@qosient.com)

🌟 SEE ALSO 🌟

ok that's the whole page bestie, you made it to the end, I'm so proud of you 🥹💖

argus 5.0.3.0 — 17 October 2016 — ARGUS(8)

Go read your logs, hydrate, and slay ✨💅🎀

📦 where this page comes from