ARGUS(5)

NAME
argus - IP Network Auditing Facility

SYNOPSIS
#include <[argus_dir]/include/cons_def.h>
#include <[argus_dir]/include/cons_out.h>

DESCRIPTION
The format of the argus(8) data stream is most succinctly described through the structures defined in the header file, but the general format is as follows:

    Argus File Format:
       Argus_Datum Initial_Management_Record
       Argus_Datum
            .
            .
       Argus_Datum Management_Statistics
       Argus_Datum
            .
            .

where the individual data fields are defined as follows:

    struct ArgusDatum {
       unsigned int status;
       union {
          struct    ipWriteStruct ip;
          struct   manInitStruct man_init;
          struct   manStatStruct man_stat;
       } ws_trans_union;
    };
Argus Status Field Note: one tick mark represents one bit position.
Argus Management Status Report
0                   1                   2                   3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|1|  Operation  |                   Data                        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Argus Network Traffic Status Report
0                   1                   2                   3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0|  Protocol   |   |  IP Opt   |  Exp  |         State         |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
struct manInitStruct {
   struct timeval now, uptime;
   char initString[20];
   unsigned long localnet, netmask;
};
struct manStatStruct {
   struct timeval startime, now;
   unsigned short reportInterval;
   unsigned char  interfaceType, interfaceStatus;
   unsigned long  pktsRcvd, bytesRcvd, pktsDrop;
   unsigned short rollpktsRcvd, rollbytesRcvd, rollpktsDrop;
   unsigned short actTCPcons, watTCPcons, cloTCPcons;
   unsigned short actUDPcons, cloUDPcons;
   unsigned short actIPcons,  cloIPcons;
   unsigned char  connAccess, denyAccess;
};
struct  ipWriteStruct {
   struct timeval startime, lasttime;
   struct physWriteStruct ws_phys;
   struct in_addr src, dst;
   union {
      struct  tcpWriteStruct  tcp;
      struct  udpWriteStruct  udp;
      struct icmpWriteStruct icmp;
   } ipws_trans_union;
};
struct tcpWriteStruct {
   unsigned short srcport, dstport;
   int src_count, dst_count;
   int src_bytes, dst_bytes;
};
struct udpWriteStruct {
   unsigned short srcport, dstport;
   int src_count, dst_count;
   int src_bytes, dst_bytes;
};
struct ipWriteStruct {
   unsigned int protocol;
   int src_count, dst_count;
   int src_bytes, dst_bytes;
};
struct icmpWriteStruct {
   int unused;
   unsigned char type, code;
   unsigned short data;
   struct in_addr srcaddr;
   struct in_addr dstaddr;
   struct in_addr gwaddr;
};

SEE ALSO
argus(8), policy(1),