Content-type: text/html <HTML><HEAD><TITLE>Manpage of ARGUS</TITLE> </HEAD><BODY> <H1>ARGUS</H1> Section: Maintenance Commands (8)<BR>Updated: 10 November 2000<BR><A HREF="#index">Index</A> <A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR> <A NAME="lbAB"> </A> <H2>NAME</H2> argus - audit record generation and utilization system <A NAME="lbAC"> </A> <H2>SYNOPSIS</H2> <B>argus</B> [ <B>options</B> ] [ <B>filter expression</B> ] <A NAME="lbAD"> </A> <H2>COPYRIGHT</H2> Copyright (c) 2000 QoSient, LLC All rights reserved. <A NAME="lbAE"> </A> <H2>DESCRIPTION</H2> <A NAME="ixAAB"></A> <A NAME="ixAAC"></A> <P> <B>Argus</B> is an IP transaction auditing tool that categorizes IP packets which match the boolean <I>expression</I> into a protocol-specific network transaction model. <B>Argus</B> reports on the transactions that it discovers, as they occur. <P> Designed to run as a daemon, <B>argus</B> generally reads packets directly from a network interface, and writes the transaction status information to a log file or open socket connected to an <B>argus</B> client (such as <B><A HREF="http://localhost/cgi-bin/man/man2html?1+ra">ra</A>(1)</B>). <B>Argus</B> can also read packet information from <B><A HREF="http://localhost/cgi-bin/man/man2html?1+tcpdump">tcpdump</A>(1) ,</B> <B><A HREF="http://localhost/cgi-bin/man/man2html?1+snoop">snoop</A>(1)</B> or <B>NLANR's Moat Time Sequence Header</B> raw packet files. <B>Argus</B> can also be configured to write its transaction logs to stdout. <P> <B>Argus</B> provides access control for its socket connection facility using <B>tcp_wrapper</B> technology. Please refer to the <B>tcp_wrapper</B> distribution for a complete description. <A NAME="lbAF"> </A> <H2>OPTIONS</H2> <DL COMPACT> <DT><B>-b</B> <DD> Dump the compiled packet-matching code to stdout and stop. This is used to debug filter expressions. <DT><B>-d</B> <DD> Run argus as a daemon. This will cause argus to do the things that Unix daemons do and return, if there were no errors, with argus running as a detached process. <DT><B>-D</B> <DD> <level> Print debug messages to stderr. The higher the <B><level></B> the more information printed. Acceptable levels are 1-8. <DT><B>-e</B> <DD> <value> Specify the source identifier for this <B>argus</B>. Acceptable values are numbers, hostnames or ip address. <DT><B>-h</B> <DD> Print an explanation of all the arguments. <DT><B>-F</B> <DD> Use <I>conffile</I> as a source of configuration information. Options set in this file override any other specification, and so this is the last word on option values. <DT><B>-i</B> <DD> <interface> Specify the physical network <B><interface></B> to be audited. The default is the first network interface that is up and running. <DT><B>-J </B> <DD> Generate packet peformance data in each audit record. <DT><B>-M</B> <DD> <secs> Specify the interval in <secs> of argus status records. These records are used to report the internal status of argus itself. The default is 300 seconds. <DT><B>-m</B> <DD> Don't provide MAC addresses information in <B>argus</B> records. <DT><B>-O</B> <DD> Turn off Berkeley Packet Filter optimizer. No reason to do this unless you think the optimizer generates bad code. <DT><B>-p</B> <DD> Do not set the physical network interface in promiscuous mode. If the interface is already in promiscuous mode, this option may have no effect. Do this to audit only the traffic coming to and from the system argus is running on. <DT><B>-P</B> <DD> <portnum> Specifies the <B><portnum></B> for remote client connection. The default is to not support remote access. Setting the value to zero (0) will forceably turn off the facility. <DT><B>-r</B> <DD> Read from <B><A HREF="http://localhost/cgi-bin/man/man2html?1+tcpdump">tcpdump</A>(1) ,</B> <B><A HREF="http://localhost/cgi-bin/man/man2html?1+snoop">snoop</A>(1)</B> or <B>NLANR's Moat Time Sequence Header</B> (tsh) packet capture files. If the packet capture file is a <B>tsh</B> format file, then the <B>-t</B> option must also be used. Argus will read from only one input packet file at a time. If the <B>-r</B> option is specified, <B>argus</B> will not put down a <B><A HREF="http://localhost/cgi-bin/man/man2html?2+listen">listen</A>(2)</B> to support remote access. <DT><B>-R</B> <DD> Generate argus records such that response times can be derived from transaction data. <DT><B>-S</B> <DD> <secs> Specify the status reporting interval in <secs> for all traffic flows. <DT><B>-t</B> <DD> Indicate that the expected packet capture input file is a <B>NLANR's Moat Time Sequence Header</B> (tsh) packet capture file. <DT><B>-U</B> <DD> Specify the number of user bytes to capture. <DT><B>-w</B> <DD> <file ["filter"] Write transaction status records to <I>output-file</I>. An <I>output-file</I> of '-' directs <B>argus</B> to write the resulting <I>argus-file</I> output to <I>stdout</I>. <DT><B>-X</B> <DD> Clear existing argus configuration. This removes any initialization done prior to encountering this flag. Allows you to eliminate the effects of the <I>/etc/argus.conf</I> file, or any argus.conf files that may have been loaded. <DT><B></B><I>expression</I> <DD> This <B><A HREF="http://localhost/cgi-bin/man/man2html?1+tcpdump">tcpdump</A>(1)</B> expression specifies which transactions will be selected. If no <I>expression</I> is given, all transactions are selected. Otherwise, only transactions for which <I>expression</I> is `true' will be dumped. For a complete <I>expression</I> format description, please refer to the <B><A HREF="http://localhost/cgi-bin/man/man2html?1+tcpdump">tcpdump</A>(1)</B> man page. <P> </DL> <A NAME="lbAG"> </A> <H2>SIGNALS</H2> <B>Argus</B> catches a number of <B><A HREF="http://localhost/cgi-bin/man/man2html?3+signal">signal</A>(3)</B> events. The three signals <B>SIGHUP</B>, <B>SIGINT</B>, and <B>SIGTERM</B> cause <B>argus</B> to exit, writing TIMEDOUT status records for all currently active transactions. The signal <B>SIGUSR1</B> will turn on <B>debug</B> reporting, and subsequent <B>SIGUSR1</B> signals, will increment the <B>debug-level</B>. The signal <B>SIGUSR2</B> will cause <B>argus</B> to turn off all <B>debug</B> reporting. <P> <A NAME="lbAH"> </A> <H2>ENVIRONMENT</H2> <PRE> $ARGUSHOME - Argus Root directory $ARGUSPATH - Argus.conf search path (/etc:$ARGUSHOME:$HOME) </PRE> <P> <A NAME="lbAI"> </A> <H2>FILES</H2> <PRE> /etc/argus.conf - argus daemon configuration file /var/run/argus.#.#.pid - PID file </PRE> <P> <A NAME="lbAJ"> </A> <H2>EXAMPLES</H2> <P> Run <B>argus</B> as a daemon, writing all its transaction status reports to <I>output-file</I>. This is the typical mode. <DL COMPACT><DT><DD> <PRE> <B>argus -d -e `hostname` -w </B><I>output-file</I> </PRE> </DL> <P> If ICMP traffic is not of interest to you, you can filter out ICMP packets on input. <DL COMPACT><DT><DD> <PRE> <B>argus -w </B><I>output-file</I> - ip and not icmp </PRE> </DL> <P> Argus supports both input filtering and output filtering, and argus supports multiple output streams, each with their own independant filters. <P> If you are interested in tracking IP traffic only (input filter) and want to report ICMP traffic in one output file, and all other IP traffic in another file. <DL COMPACT><DT><DD> <PRE> <B>argus -w </B><I>outfile1</I> "icmp" -w <I>outfile2</I> "not icmp" - ip </PRE> </DL> <P> Audit the network activity that is flowing between the two gateway routers, whose ethernet addresses are 00:08:03:2D:42:01 and 00:00:0C:18:29:F1. Without specifying an <I>output-file</I>, it is assumed that the transaction status reports will be written to a remote client. In this case we have changed the port that the remote client will use to port 430/tcp. <DL COMPACT><DT><DD> <PRE> <B>argus -P 430 ether host (0:8:3:2d:42:1 and 0:0:c:18:29:f1)</B> & </PRE> </DL> <P> Audit each individual ICMP ECHO transaction. You would do this gather Round Trip Time data within your network. Write the output to <I>output-file</I>. <DL COMPACT><DT><DD> <PRE> <B>argus -R -w </B><I>output-file</I> "echo" - icmp </PRE> </DL> <P> Audit all NFS transactions involving the server <I>fileserver</I> and increase the reporting interval to 3600 seconds (to provide high data reduction). Write the output to <I>output-file</I>. <DL COMPACT><DT><DD> <PRE> <B>argus -S 3600 -w </B><I>output-file</I> udp and port 2049 & </PRE> </DL> <A NAME="lbAK"> </A> <H2>AUTHORS</H2> <PRE> Carter Bullard (<A HREF="mailto:carter@qosient.com">carter@qosient.com</A>) </PRE><A NAME="lbAL"> </A> <H2>SEE ALSO</H2> <B><A HREF="http://localhost/cgi-bin/man/man2html?5+hosts_access">hosts_access</A></B>(5), <B><A HREF="http://localhost/cgi-bin/man/man2html?5+hosts_options">hosts_options</A></B>(5), <B><A HREF="http://localhost/cgi-bin/man/man2html?8+tcpd">tcpd</A></B>(8), <B><A HREF="http://localhost/cgi-bin/man/man2html?1+tcpdump">tcpdump</A></B>(1) <P> <HR> <A NAME="index"> </A><H2>Index</H2> <DL> <DT><A HREF="#lbAB">NAME</A><DD> <DT><A HREF="#lbAC">SYNOPSIS</A><DD> <DT><A HREF="#lbAD">COPYRIGHT</A><DD> <DT><A HREF="#lbAE">DESCRIPTION</A><DD> <DT><A HREF="#lbAF">OPTIONS</A><DD> <DT><A HREF="#lbAG">SIGNALS</A><DD> <DT><A HREF="#lbAH">ENVIRONMENT</A><DD> <DT><A HREF="#lbAI">FILES</A><DD> <DT><A HREF="#lbAJ">EXAMPLES</A><DD> <DT><A HREF="#lbAK">AUTHORS</A><DD> <DT><A HREF="#lbAL">SEE ALSO</A><DD> </DL> <HR> This document was created by <A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>, using the manual pages.<BR> Time: 23:41:27 GMT, March 15, 2001 </BODY> </HTML>
distrib
>
Mandriva
>
2010.0
>
i586
>
media
>
contrib-release
>
by-pkgid
>
dc2800a8ec9b3e4a05b103066b15d559
>
files
>
38
