SERVICES(1)

NAME
services - tally TCP and UDP statistics from argus(8) data

SYNOPSIS
services [ -bhnEMNORTWX ] [ -C access-file ]
[ -d debug-level ] [ -r argus-file ]
[ -w output-file ] [ -P port ] [ -F file ]
[ -S argus-server ] expression

DESCRIPTION

Services presents a concise report of the occurrence and performance of the TCP and UDP services encountered in an argus data stream. For each unique TCP and UDP destination port number encountered, services prints the number of transactions, the mean (std dev) source and destination bytes/packet, and the mean (std dev) seconds duration for the transactions seen. Services reads argus data from either stdin, an argus-file, or from a remote host running as an argus-server, and prints network transaction statistics based the criteria described in the access-file and/or the boolean expression.

OPTIONS

-b  Dump the compiled transaction-matching code to standard output and stop.

-C  Match entries against a Cisco access control list that is contained in access-file. This can be used to verify that firewalls based on Cisco products are working as expected. Argus transaction reports corresponding to network traffic that should be blocked by the access control definition, are reported. The file format is that of a single extended access-list definition.

-d  Print debug information relating to Cisco access control list transaction reporting. When debug-level is 1, services prints the Cisco access control list definition that would cause the argus datum to be rejected. With a debug-level of 2, services also prints the Cisco access control list definition that permits argus data.

-E  Use transactions that have been established.

-F  Use file as input for the filter expression. An additional expression given on the command line is ignored.

-h  Print an explanation of all the arguments.

-M  Use transactions with multiple routes involved with the transaction. This condition exists when a transaction involves more than a single source and destination MAC address pair.

-n  No not translate host and service numbers to names. -nn will suppress translation of protocol numbers, as well.

-N  Use TCP transactions that closed normally.

-O  Use transactions that involved the use of IP options.

-P  Use alternate port when accessing remote argus server. The default is port 561/tcp.

-r  Read from the specified argus-file.

-R  Use TCP transactions that encountered a RESET indication.

-S  Specify a remote-argus-server.

-T  Use transactions that reported because of a TIMED_OUT condition.

-w  Write out matching data to output-file, in argus file format. An output-file of '-' directs services to write the 'argus-file to stdout, allowing for "chaining" services commands together.

-W  Use TCP transactions where the source or destination window was set to zero at some time during the transaction.

-X  Use TCP transactions that involved packet retransmissions.

expression
    This tcpdump(1) expression specifies which transactions will be selected. If no expression is given, all transactions are selected. Otherwise, only transactions for which expression is `true' will be dumped. For a complete expression format description, please refer to the tcpdump(1) man page.

EXAMPLES

To report all TCP services that the host electronomo provides, reading transaction data from argus-file argus.data:
    services -r argus.dataand dst host electronomo

To review the network services accessed by hosts on the network 198.257.3.0, using the remote argus server argus-host. Note, statistics are collected silently from the remote host until a SIGHUP, SIGINT, SIGQUIT or a SIGTERM is detected, then they are reported to stdout.
    services -S argus-host src net 198.2.3.0

OUTPUT FORMAT

The following is a brief description of the output format of services. The general format is:

                proto  port  cons  src_stats  dst_stats  secs

proto
    Protocol specific field that indicates either a TCP or UDP service.

port
    This field is composed of the port number through which the service was provided (for instance, 25 for smtp).

cons
    The number of transactions seen of a specific service.

src_stats
    The mean source bytes/packet of the service, and the standard deviation.

dst_stats
    The mean destination bytes/packet of the service, and the standard deviation.

secs
    The mean elapsed time of the service, and the standard deviation.

OUTPUT EXAMPLES
These examples show typical services output, and demonstrates a number of variations seen in argus data. This services output was generated to examine the performance of external services provided by the network 192.292.2.0.
Total Cons            189    90.69(99.13)    138.29(130.88)    10.11(65.96)
        port         cons      src b/pkt       dst b/pkt         secs
                               mean(sd)         mean(sd)       mean(sd)
      tcp     21        3     9.60(3.57)      30.51(5.44)       1.91(1.32)
      tcp     25       22   130.18(35.05)     26.82(7.55)       6.55(6.40)
      udp     53       53    47.87(4.98)     129.85(65.54)      0.14(0.42)
      tcp     70        4     4.55(2.30)     166.23(104.26)     1.97(1.11)
      tcp     79        1     1.00(0.00)      43.83(0.00)       0.71(0.00)
      tcp     80       52    46.76(31.90)    237.70(141.62)     6.65(6.66)
      tcp    113        1     1.86(0.00)      13.00(0.00)       7.05(0.00)
      tcp    771        1     6.46(0.00)      42.00(0.00)       0.90(0.00)
      tcp   1095        1   346.14(0.00)      73.00(0.00)       0.82(0.00)
      udp   7001        4    40.00(0.00)      40.00(6.93)       0.05(0.05)
      udp   7003        1    52.00(0.00)     512.00(0.00)       0.01(0.00)
      tcp   7999        1    87.29(0.00)      92.33(0.00)       2.29(0.00)
      tcp   8001        9    97.91(30.66)    308.29(126.46)     1.91(1.11)
This is an example of services used for reviewing the network services provided by the host 192.292.2.34
services -nnS cz host 192.292.2.34
Total Cons          94789   275.32(378.74)   295.12(411.67)     3.89(0.77)
        port         cons      src b/pkt       dst b/pkt         secs
                               mean(sd)         mean(sd)       mean(sd)
      tcp     23        1     2.17(0.00)       6.73(0.00)       1.99(0.00)
      tcp     25        1   166.83(0.00)      34.31(0.00)       0.70(0.00)
      udp     53       27   106.38(5.62)      34.31(0.67)       0.70(4.12)
      tcp     79        1    87.40(0.00)      46.00(10.23)      3.41(0.00)
      udp    111     3484    66.71(83.23)     91.00(0.87)       8.76(0.10)
      tcp    123       29    56.25(0.02)      56.33(0.34)      23.87(9.52)
      tcp    513        3   115.75(1.01)     106.00(2.92)       1.90(0.79)
      udp   2049    91243   422.47(19.77)   1084.82(1.23)       5.75(11.69)

AUTHORS
Carter Bullard (cbullard@baynetworks.com).
Chas DiFatta (cd@sei.cmu.edu).
Special thanks to Mark Poepping (poepping@sei.cmu.edu).

SEE ALSO
tcpdump(1), argus(8)

Postel, Jon, Internet Protocol, RFC 791, Network Information Center, SRI International, Menlo Park, Calif., May 1981.

Postel, Jon, Internet Control Message Protocol, RFC 792, Network Information Center, SRI International, Menlo Park, Calif., May 1981.

Postel, Jon, Transmission Control Protocol, RFC 793, Network Information Center, SRI International, Menlo Park, Calif., May 1981.

Postel, Jon, User Datagram Protocol, RFC 768, Network Information Center, SRI International, Menlo Park, Calif., May 1980.

McCanne, Steven, and Van Jacobson, The BSD Packet Filter: A New Architecture for User-level Capture, Lawrwnce Berkeley Laboratory, One Cyclotron Road, Berkeley, Calif., 94720, December 1992.