ARGUS(8)

NAME
argus - IP network auditing facility

SYNOPSIS
argus [ -bhOp ] [ -d detail-interval ] [ -F file ]
[ -r tcpdump-file ] [ -w output-file ]
[ -D status-interval ] [ -I ip-timeout ] [ -P port ]
[ -U udp-timeout ] [ -T tcp-timeout ]
[ -S services-file ] [ -i interface ] expression

DESCRIPTION

Argus is an IP transaction auditing tool that categorizes IP packets which match the boolean expression into a protocol-specific network transaction model. Argus reports on the transactions that it discovers, as they occur.

Designed to run as a daemon, argus generally pulls packets directly from a network interface, and writes the transaction status information to a log file or open socket connected to an argus client (such as policy(1). Argus can also read packet information from tcpdump(1) raw packet files and/or write the transaction logs to stdout.

Argus provides access control for its socket connection facility using tcp_wrapper technology. Please refer to the tcp_wrapper distribution for a complete description.

Argus catches a number of signal(3) events. The three signals SIGHUP, SIGINT, and SIGTERM cause argus to exit, writing TIMEDOUT status records for all currently active transactions. The signal SIGUSR1 will turn on debug reporting, and subsequent SIGUSR1 signals, will increment the debug-level. The signal SIGUSR2 will cause argus to turn off all debug reporting.

OPTIONS

-b  Dump the compiled packet-matching code to stdout and stop.

-d  Place argus in detail mode, and set the reporting detail-interval, in seconds. When in detail mode, argus sends reports at all transaction state changes, and sends interim transaction status reports every detail-interval seconds.

-D  Change argus mangement status reporting interval. Status-interval is specified in seconds.

-F  Use file as input for the filter expression. An additional expression given on the command line is ignored.

-h  Print an explanation of all the arguments.

-i  Specify the physical network interface to be audited. The default is le0.

-I  Specify the ip-timeout in seconds. The default is 900 seconds.

-O  Turn off Berkeley Packet Filter optimizer.

-p  Do not set the physical network interface in promiscuous mode.

-P  Specifies an alternate port for remote client connection. The default is port 561/tcp. Setting the port to 0, completely disables remote client access.

-r  Read from tcpdump(1) raw packet file. If the -r option is specified, argus will not put down a listen(2) to support remote access.

-T  Specify the tcp-timeout in seconds. The default is 120 seconds, and corresponds to the standard TCP FIN-WAIT state timeout.

-U  Specify the udp-timeout in seconds. The default is 900 seconds.

-w  Write transaction status records to output-file. An output-file of '-' directs argus to write the resulting argus-file output to stdout.

-S  Read UDP services port definitions from services-file. This allows argus to "wildcard" the source port number for UDP transactions that are directed to this service. This should be used for high volume request/response protocols, such as DNS, to prevent argus from generating too many status records for these services. The format of the services-file uses services(5) file format. Only entries listed for udp will be recognized.

expression
    This tcpdump(1) expression specifies which transactions will be selected. If no expression is given, all transactions are selected. Otherwise, only transactions for which expression is `true' will be dumped. For a complete expression format description, please refer to the tcpdump(1) man page.

EXAMPLES

Run argus as a daemon, writing all its transaction status reports to output-file. This is the typical mode.
    argus -w output-file &

If your ICMP traffic is very high and your argus transaction status output-file gets too big, you may want to not audit icmp.
    argus -w output-file ip and not icmp &

If you are seriously concerned about telnet connections to one host on your network, you can audit the network activity involving just that host. Here is a complex example where we will be auditing destingation traffic for host crashtest in detail mode, with the reporting interval set to 30 seconds, and writing the transaction status reports to stdout, but piping its output to the argus client, policy. Policy is configured to report the telnet traffic. Each qualifying status report will be written to stdout.
    argus -d 30 -w - dst host crashtest |  policy -cn port telnet

Audit the network activity that is flowing between the two gateway routers, whose ethernet addresses are 00:08:03:2D:42:01 and 00:00:0C:18:29:F1. Without specifying an output-file, it is assumed that the transaction status reports will be written to a remote client. In this case we have changed the port that the remote client will use to port 430/tcp.
    argus -P 430 ether host (0:8:3:2d:42:1 and 0:0:c:18:29:f1) &

Audit all NFS transactions invovling the server fileserver and increase the UDP timeout to 3600 seconds (to provide high data reduction), and write the output to output-file.
    argus -U 3600 -w output-file udp and port 2049 &

AUTHORS
Carter Bullard (cbullard@baynetworks.com)
Chas DiFatta (cd@sei.cmu.edu)
Special thanks to Mark Poepping (poepping@sei.cmu.edu).

SEE ALSO
policy(1), hosts_access(5), hosts_options(5), tcpd(8), tcpdump(1)