Argus Development mailing list - Real Time Flow Monitor (RTFM) for comprehensive IP network traffic auditing

Carter Bullard | 1 Dec 2001 15:40

RE: [RE: problem with datafile size (argus 2.0.3)]

Hey Oleg,
   Yes, an argus record of length 3 is not good.
Each argus record has a detectable signature, and so
finding the next valid argus record is possible,
but the code to do this hasn't been written yet.

   The logic to find the correct argus record framing
would have to go into ./common/argus_parse.c.  Is this
datafile so very important that you need to recover
the data from it?  I can add the routines to auto recover
framing boundaries, but it will have to wait for a week
or two.

   If you're interested in writing the C routines
yourself, I can talk you through the logic, if that would
be helpful.

Carter

Carter Bullard
QoSient, LLC
300 E. 56th Street, Suite 18K
New York, New York  10022

carter <at> qosient.com
Phone +1 212 588-9133
Fax   +1 212 588-9134
http://qosient.com

> -----Original Message-----

(Continue reading)

Carter Bullard | 1 Dec 2001 16:07

RE: ragator config question

Hey Wozz,
   No, support for ranges is not there.  Can be, not hard.
Would you like ranges with CIDR addresses as well?

   1.2.3.4:30-2.3.4.0:24

This could be very interesting, but also very confusing.
I'll look into it.

Carter

Carter Bullard
QoSient, LLC
300 E. 56th Street, Suite 18K
New York, New York  10022

carter <at> qosient.com
Phone +1 212 588-9133
Fax   +1 212 588-9134
http://qosient.com

> -----Original Message-----
> From: owner-argus-info <at> lists.andrew.cmu.edu 
> [mailto:owner-argus-info <at> lists.andrew.cmu.edu] On Behalf Of Wozz
> Sent: Thursday, November 29, 2001 9:21 PM
> To: argus-info <at> lists.andrew.cmu.edu
> Subject: ragator config question
> 
> 
> Is there a way to specify a range of addresses in an ragator

(Continue reading)

Carter Bullard | 1 Dec 2001 16:16

RE: Question

Hello Ricardo,
   Yes this is very easy to do, and programs like ra()
are designed to support this exact scenario.

   host1  argus running, listening on port 561
   host2  argus running, listening on port 561

   ra -w ra.out -S host1 -S host2 - host host1 and host2 

will collect the records that involve only host1 and
host2 from both argus probes, in realtime and output the
records to the outputfile ra.out, so that you can compare.

Carter

Carter Bullard
QoSient, LLC
300 E. 56th Street, Suite 18K
New York, New York  10022

carter <at> qosient.com
Phone +1 212 588-9133
Fax   +1 212 588-9134
http://qosient.com

> -----Original Message-----
> From: Ricardo J Castaneda [mailto:rcasta <at> tyr.mty.itesm.mx] 
> Sent: Wednesday, November 28, 2001 6:56 PM
> To: carter <at> qosient.com
> Subject: Question

(Continue reading)

Wozz | 2 Dec 2001 09:29

Re: ragator config question

On Sat, Dec 01, 2001 at 10:07:16AM -0500, Carter Bullard wrote:
> Hey Wozz,
>    No, support for ranges is not there.  Can be, not hard.
> Would you like ranges with CIDR addresses as well?
>  
>    1.2.3.4:30-2.3.4.0:24
> 
> This could be very interesting, but also very confusing.
> I'll look into it.
> 

I'm not sure it would be neccesary to have ranges of cidr blocks, since you
could specify that with a range of beginning and ending addresses, but there
may be some use for it I've missed.

Wozz | 11 Dec 2001 05:52

Re: Argus Flow Timeout Issues

On Thu, Nov 15, 2001 at 09:31:56AM -0500, Carter Bullard wrote:
> 
>           IP fragments -   5 seconds
> 
>             IGMP flows - 300 seconds
>              ARP flows - 300 seconds
>       Unknown protocol - 300 seconds
> 
>      Initial TCP flows -  15 seconds
>      Initial UDP flows -  15 seconds
>      Initial ESP flows -  15 seconds
>     Initial ICMP flows -  15 seconds
> 
>  All established flows - 300 seconds
> 
>             TCP closed -  10 seconds
> 
> 

I've been thinking about this more.  These values work great for
short lived connections (HTTP, POP, etc) but not so well for longer
lived connections (ssh, and several other applications on my
networks).  It might be useful to make these tweakable on a per-port
basis.  IE, I can set the default for established flows to be 300,
but I could define that flows going to port 22 last 3600 seconds.
I suppose this will result in higher memory usage, but if you only
define those flows that you know are going to be longer lived, it
shouldn't be too significant.  Any thoughts?

(Continue reading)

Carter Bullard | 18 Dec 2001 20:04

argus-2.0.4 eminent release

Gentle people,
   I'm about to release argus-2.0.4 and am trying to decide
if I should include the new raxml().  In order to support
changes in the XML way of things, and to better support
Microsoft .Net code, we have new XML schema files and 
I've had to modify raxml() to printout a few fields with
different formats, especially the time fields.

   If this doesn't break anyone's stuff, I'll go ahead and
include the new raxml() and its schema, in 2.0.4.

Carter

Carter Bullard
QoSient, LLC
300 E. 56th Street, Suite 18K
New York, New York  10022

carter <at> qosient.com
Phone +1 212 588-9133
Fax   +1 212 588-9134
http://qosient.com

Carter Bullard | 18 Dec 2001 23:28

argus-2.0.4.tar.gz available

Gentle people,
   argus-2.0.4 is available in the dev section.
This is going to be the one, if we don't get any complaints.
This fixes a number of problems relating to opening unnumbered
interfaces, better timeout performance, modified ./configure,
fixed some issues with TcpWrapper based access control, fixed
DLT_RAW decoder for Linux PPP and SLIP, added LFS checking
in ./configure, update raxml(), and last but not at all least
we added Russell's perl scripts and modules for scan detection.

The only outstanding bug that this release does not address
is a problem with Cisco Netflow record reading off the wire.
Still working on that bug.

ftp://qosient.com/dev/argus-2.0/argus-2.0.4.tar.gz

Do give this a go, and if there are no problems, I'll
release it on Thursday.

I've tested it on RH 2.2-2.4 and Solaris.

Carter

Carter Bullard
QoSient, LLC
300 E. 56th Street, Suite 18K
New York, New York  10022

carter <at> qosient.com
Phone +1 212 588-9133

(Continue reading)

Carter Bullard | 20 Dec 2001 15:24

RE: Argus Flow Timeout Issues

Hey Wozz,
   Sorry, I missed replying to your mail!!
ragator() is the tool for you, it was designed
to extend the timeouts on a port basis, and
just about any basis that seems reasonable.

  In my low speed environments, I have argus
generate records every second, and the I use
ragator to zip up the long records the next
day, or at the end of the week, when I archive
the data files.

Carter

Carter Bullard
QoSient, LLC
300 E. 56th Street, Suite 18K
New York, New York  10022

carter <at> qosient.com
Phone +1 212 588-9133
Fax   +1 212 588-9134
http://qosient.com

> -----Original Message-----
> From: owner-argus-info <at> lists.andrew.cmu.edu 
> [mailto:owner-argus-info <at> lists.andrew.cmu.edu] On Behalf Of Wozz
> Sent: Monday, December 10, 2001 11:52 PM
> To: Carter Bullard
> Cc: argus-info <at> lists.andrew.cmu.edu

(Continue reading)

Peter Van Epp | 20 Dec 2001 22:26

Picon

Picon

Usenix Login: security issue available online

	A check just now indicates the Usenix Login: Security issue of November
2001 is now available on line at:

http://www.usenix.org/publications/login/2001-11/index.html

	While the entire issue is worth reading there is also my article on 
using argus in 

http://www.usenix.org/publications/login/2001-11/pdfs/epp.pdf

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada

Peter Van Epp | 20 Dec 2001 22:33

Picon

Picon

MD5 on 2.0.4?

	It looks like the MD5 file didn't get updated (which is presumably 
why it doesn't match) and the asc file (which did get updated) isn't permitted 
read: 

-rw-r--r--   1 ftpuser  ftpusers    444624 Dec 18 17:16 argus-2.0.4.tar.gz
-rw-------   1 ftpuser  ftpusers    602305 Dec 18 17:17 argus-2.0.4.tar.gz.asc
-rw-r--r--   1 ftpuser  ftpusers        60 Dec 18 15:58 argus-2.0.4.tar.gz.md5

	At the moment I'll assume the file is fine and start testing.

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada

Group

gmane.network.argus.

Project Web Page

Argus Development mailing list - Real Time Flow Monitor (RTFM) for comprehensive IP network traffic auditing

Search Archive

Page

1 | 2

Articles in period: 18

December 2001

Language

Change language

Options

Current view: Threads only / Showing only 20 lines / Not hiding cited text.
Change to All messages, whole messages, or hide cited text.

Post a message
NNTP Newsgroup
Classic Gmane web interface
XML

XML

RSS Feed
List Information

About Gmane

Recent entries

argus-clients-3.0.7.10 on the dev server (21 May 2013)
Rastream doesn't rotate properly when daemonied? (20 May 2013)
Ra - filter syntax error (20 May 2013)
Anomaly detection (16 May 2013)
raservices crashes when processing (15 May 2013)
rastream 3.0.7.8, no suser duser (14 May 2013)
Additional rasqlinsert information (14 May 2013)
RA_CIDR_ADDRESS_FORMAT="yes" and rasqlinsert -S [radium source] may be (10 May 2013)
Quick questions about rasort output (9 May 2013)
rastream and %T in -w (9 May 2013)
rastream and %T in -w (8 May 2013)
normalized appbyte ratio for producer/consumer relationship (8 May 2013)
filter syntax error (7 May 2013)
argus configuration with upstream router (7 May 2013)
Best way to grab summary data from last generated file by rastream (7 May 2013)
normalized appbyte ratio for producer/consumer relationship (7 May 2013)
Argus-info Digest, Vol 93, Issue 16 (7 May 2013)
normalized appbyte ratio for producer/consumer relationship (6 May 2013)
Shifting ragraph X-axis (5 May 2013)
normalized appbyte ratio (4 May 2013)
normalized appbyte ratio (4 May 2013)

Archives

85	May 2013
38	April 2013
75	March 2013
50	February 2013
113	January 2013
42	December 2012
49	November 2012
155	October 2012
63	September 2012
50	August 2012
30	July 2012
122	June 2012
22	May 2012
37	April 2012
53	March 2012
58	February 2012
91	January 2012
52	December 2011
17	November 2011
30	October 2011
15	September 2011
39	August 2011
49	July 2011
61	June 2011
66	May 2011
82	April 2011
48	March 2011
52	February 2011
27	January 2011
42	December 2010
35	November 2010
72	October 2010
78	September 2010
48	August 2010
102	July 2010
50	June 2010
23	May 2010
61	April 2010
40	March 2010
50	February 2010
26	January 2010
32	December 2009
72	November 2009
48	October 2009
55	September 2009
115	August 2009
66	July 2009
36	June 2009
92	May 2009
122	April 2009
116	March 2009
58	February 2009
26	January 2009
15	December 2008
3	November 2008
3	October 2008
24	September 2008
38	August 2008
50	July 2008
62	June 2008
6	May 2008
61	April 2008
90	March 2008
151	February 2008
121	January 2008
67	December 2007
61	November 2007
120	October 2007
107	September 2007
143	August 2007
44	July 2007
91	June 2007
68	May 2007
82	April 2007
141	March 2007
123	February 2007
69	January 2007
50	December 2006
79	November 2006
113	October 2006
114	September 2006
131	August 2006
96	July 2006
270	June 2006
4	May 2006
4	April 2006
40	March 2006
31	February 2006
24	January 2006
14	December 2005
2	November 2005
1	October 2005
8	September 2005
25	August 2005
1	July 2005
14	June 2005
5	May 2005
25	April 2005
24	March 2005
33	February 2005
12	January 2005
41	December 2004
33	November 2004
35	October 2004
48	September 2004
95	August 2004
45	July 2004
79	June 2004
87	May 2004
84	April 2004
17	March 2004
62	February 2004
14	January 2004
28	December 2003
14	November 2003
15	October 2003
38	September 2003
60	August 2003
28	July 2003
31	June 2003
48	May 2003
24	April 2003
39	March 2003
18	February 2003
29	January 2003
26	December 2002
41	November 2002
47	October 2002
18	September 2002
14	August 2002
23	July 2002
20	June 2002
92	May 2002
29	April 2002
56	March 2002
47	February 2002
33	January 2002
18	December 2001
91	November 2001
58	October 2001
49	September 2001
15	August 2001
49	July 2001
109	June 2001
52	May 2001
39	April 2001
99	March 2001
134	February 2001
123	January 2001
26	December 2000
59	November 2000
72	October 2000
143	September 2000
44	August 2000
81	July 2000
20	June 2000
12	May 2000
11	April 2000
63	March 2000
22	February 2000
8	January 2000
1	December 1999
6	October 1999
15	September 1999
3	August 1999
9	July 1999
12	June 1999
7	May 1999
16	April 1999
28	March 1999
9	February 1999

Design

Zawodny | Right Menu | Left Menu

Your Own Design

Paste the URL of your CSS below. Download CSS template