RA(1)

NAME
ra - read argus(8) data.

SYNOPSIS
ra [ -bchmnEIMNORTWX ] [ -C access-file ] [ -d debug-level ]
[ -r argus-file ] [ -w output-file ] [ -P port ]
[ -F file ] [ -S argus-server ] expression

DESCRIPTION

Ra reads argus data from either stdin, an argus-file, or from a remote host running as an argus-server. Ra prints out the contents of argus transaction reports that match the policy described in the access-file and/or the boolean expression.

OPTIONS

-b  Dump the compiled transaction-matching code to standard output and stop.

-c  Print the transaction source byte and packet count, and the destination byte and packet count.

-C  Match entries against a Cisco access control list that is contained in access-file. Argus transaction reports corresponding to network traffic that should be blocked by the Cisco access control definition, are reported. The file format is that of a single Cisco extended access-list definition.

-d  Print debug information relating to -C option transaction reporting. When debug-level is 1, ra prints the access control list definition that would cause the argus datum to be rejected. With a debug-level of 2, ra also prints the access control list definition that permits argus data.

-E  Print transactions that have been established.

-F  Use file as input for the filter expression. An additional expression given on the command line is ignored.

-h  Print an explanation of all the arguments.

-I  Print extended ICMP status reports.

-m  Print ethernet or fddi (MAC) addresses.

-M  Print transactions with multiple routes involved with the transaction. This condition exists when a transaction involves more than a single source and destination MAC address pair.

-n  No not translate host and service numbers to names. -nn will suppress translation of protocol numbers, as well.

-N  Print TCP transactions that closed normally.

-O  Print transactions that involved the use of IP options.

-P  Use alternate port when accessing remote argus server. The default is port 561/tcp.

-r  Read from the specified argus-file.

-R  Print TCP transactions that encountered a RESET indication.

-S  Specify a remote argus-server.

-T  Print transactions that reported because of a TIMED_OUT condition.

-w  Write out matching data to output-file, in argus file format. An output-file of '-' directs ra to write the 'argus-file to stdout, allowing for "chaining" ra commands together.

-W  Print TCP transactions where the source or destination window was set to zero at some time during the transaction.

-X  Print TCP transactions that involved packet retransmissions.

expression
    This tcpdump(1) expression specifies which transactions will be selected. If no expression is given, all transactions are selected. Otherwise, only transactions for which expression is `true' will be printed. The syntax is identical to the expression syntax for tcpdump, however, the semantics for tcpdump's packet filter expression may be slightly different when applied to transaction selection. In particular, transaction selection based on the source or destination host may not always give the expected results, since argus cannot guarantee correct determination of the source host from the available datagrams (especially for non-TCP protocols with dropped or missing datagrams). For a complete expression format description, please refer to the tcpdump(1) man page.

EXAMPLES

To report all TCP transactions from and to host wave, reading transaction data from argus-file argus.data:
    ra -r argus.data tcp and host wave

Create the argus-file icmp.log with all ICMP events involving the host nimrod, using data from argus-file, but reading the transaction data from stdin:
    cat argus-file | ra -w icmp.log icmp and host nimrod

To review, in real-time, all the transactions to the network 198.2.3.0, that violate the Cisco access control list specified in access-list, using the remote argus server argus-host.
    ra -S argus-host -C access-list dst net 198.2.3.0

OUTPUT FORMAT

The following is a brief description of the output format of ra which reports transaction data in various levels of detail. The general format is:

      time  [mac.addr]  proto  host  dir  host  [count] status

time
    time is printed as, day of the week, month/day and hr:min:sec, using localtime(3V). Argus transaction data contains both starting and ending transaction times, with precision to the microsecond. However, ra prints out only one of these dates depending on the status of the argus server. When the argus server is running in default mode, ra reports the transaction starting time. When the server is in DETAIL mode, the transaction ending time is reported.

mac.addr
    mac.addr is an optional field, specified using the -m flag. mac.addr represents the first source and destination MAC addresses seen for a particular transaction. These addresses are paired with the host.port fields, so the direction indicator is needed to distinguish between the source and destination MAC addresses.

proto [options protocol]
    The proto indicator consists of two fields. The first is protocol specific and the designations are:

       *   -  TCP packet retransmissions
        M  -  Multiple physical layer paths
         S -  IP option Strict Source Route
         L -  IP option Loose Source Route
         T -  IP option Time Stamp
         + -  IP option Security
         R -  IP option Record Route
         N -  IP option SATNET
         ? -  multiple IP options set
    The second field indicates the upper protocol used in the transaction. This field will contain the first 4 characters of the official name for the protocol used, as defined in RFC-1700. Use of the -n option, twice (-nn), will cause the actual protocol number to be displayed.

host
    The host field is protocol dependent, and for all protocols will contain the IP address/name. For TCP and UDP, the field will also contain the port number/name, separated by a period.

dir The dir field will have the direction of the transaction, as can be best determined from the datum, and is used to indicate which hosts are transmitting. For TCP, the dir field indicates the actual source of the TCP connection, and the center character indicating the state of the transaction.

         -  - transaction was NORMAL
         |  - transaction was RESET
         o  - transaction TIMED OUT.

count
    count is an optional field, specified using the -c option. There are 4 fields that are produced. The first 2 are the packet counts and the last 2 are the byte counts for the specific transaction. The fields are paired with the previous host fields, and represent the packets transmitted by the respective host.

status
    The status field indicates the principle status for the transaction report, and is protocol dependent. For all the protocols, except ICMP, this field reports on the basic state of a transaction.

    This indicates that this is the initial status report for a transaction and is seen only when the argus-server is in DETAIL mode. For TCP connections this is REQ, indicating that a connection is being requested. For the connectionless protocols, such as UDP, this is INT.

(accepted)
    This indicates that a request/response condition has occurred, and that a transaction has been detected between two hosts. For TCP, this indicates that a connection request has been answered, and the connection will be accepted. This is only seen when the argus-server is in DETAIL mode. For the connectionless protocols, this state indicates that there has been a single packet exchange between two hosts, and could qualify as a request/response transaction.

\ST CON  (established  connected)
    This record type indicates that the reported transaction is active, and has been established or is continuing. This should be interpreted as a status report of a currently active transaction. For TCP, the EST status is only seen in DETAIL mode, and indicates that the three way handshake has been completed for a connection.

    TCP specific, this record type indicates that the TCP connection has closed normally.

TIM  (timeout)
    Activity was not seen relating to this transaction, during the argus server's timeout period for this protocol. This status is seen only when there were packets recorded since the last report for this transaction. For the ICMP protocol, the status field displays various aspects of the ICMP data. With the -I option, extended ICMP protocol data information is given. ICMP status can have the values (-I option info):
    ECO echo request
    ECR echo reply
    URF unreachable need fragmentation
    URH unreachable host (hostaddr)
    URN unreachable network (netaddr)
    URO unreachable protocol (protonum)
    URP unreachable port (protonum portnum)
    URS unreachable source failed
    SRC source quench
    RED redirect
    TIM time exceeded
    PAR parameter problem
    TST timestamp request
    TSR timestamp reply
    IRQ information request
    IRR information reply
    MAS mask request
    MSR mask reply (maskaddr)

OUTPUT EXAMPLES
These examples show typical ra output, and demonstrates a number of variations seen in argus data. This ra output was generated using the -n option to suppress number translation.
Thu 12/29 06:40:32   S tcp  132.3.31.15.6439   -> 12.23.14.77.23   CLO
This is a normal tcp transaction to the telnet port on host 12.23.14.77. The IP Option strict source route was seen.
Thu 12/29 06:40:32     tcp  132.3.31.15.6200  <|> 12.23.14.77.25   RST
This tcp transaction from the smtp port of host 12.23.14.77 was RESET, suggesting that the transaction was denied.
Thu 12/29 03:39:05  M  igmp 12.88.14.10       <-> 128.2.2.10       CON
This is an igmp transaction status report, usually seen with MBONE traffic. There was more than one source and destination MAC address pair used to support the transaction, suggesting a possible routing loop.
Thu 12/29 06:40:05 *   tcp  12.23.14.23.1043  <-> 12.23.14.27.6000 TIM
This is an X-windows transaction, that has TIMEDOUT. Packets were retransmitted during the connection.
Thu 12/29 07:42:09     udp   12.9.1.115.2262   -> 28.12.141.6.139  INT
This is an initial netbios UDP transaction status report, indicating that this is the first datagram encountered for this transaction. This status can only be seen when the argus-server is in detail mode.
Thu 12/29 06:42:09     icmp  12.9.1.115       <-  12.68.5.127      ECO
Thu 12/29 06:42:09     icmp  12.9.1.115        -> 12.68.5.127      ECR
This example represents a "ping" of host 12.9.1.115, and its response.
This next example shows the ra output of a complete TCP transaction, while reading from a remote argus-server in detail mode. The '*' in the CLO report indicates that at least one TCP packet was retransmitted during the transaction.
% ra -S argus-server tcp and host sei.cmu.edu and port smtp
ra: Trying argus-server port 561
ra: connected Argus Version 1.4 detail mode
Sat 12/03 15:29:39     tcp  i.sei.cmu.e.1543   -> sei.cmu.edu.smtp REQ
Sat 12/03 15:29:39     tcp  i.sei.cmu.e.1543  <-  sei.cmu.edu.smtp ACC
Sat 12/03 15:29:39     tcp  i.sei.cmu.e.1543  <-> sei.cmu.edu.smtp EST
Sat 12/03 15:29:39 *   tcp  i.sei.cmu.e.1543   -> sei.cmu.edu.smtp CLO

AUTHORS
Carter Bullard (cbullard@baynetworks.com).
Chas DiFatta (cd@sei.cmu.edu).
Special thanks to Mark Poepping (poepping@sei.cmu.edu).

SEE ALSO
tcpdump(1), argus(8)

Postel, Jon, Internet Protocol, RFC 791, Network Information Center, SRI International, Menlo Park, Calif., May 1981.

Postel, Jon, Internet Control Message Protocol, RFC 792, Network Information Center, SRI International, Menlo Park, Calif., May 1981.

Postel, Jon, Transmission Control Protocol, RFC 793, Network Information Center, SRI International, Menlo Park, Calif., May 1981.

Postel, Jon, User Datagram Protocol, RFC 768, Network Information Center, SRI International, Menlo Park, Calif., May 1980.

McCanne, Steven, and Van Jacobson, The BSD Packet Filter: A New Architecture for User-level Capture, Lawrwnce Berkeley Laboratory, One Cyclotron Road, Berkeley, Calif., 94720, December 1992.