Argus Development mailing list - Real Time Flow Monitor (RTFM) for comprehensive IP network traffic auditing

Tim Lavoie | 3 Jan 2006 00:27

"man" protocol?


Hi all,

I've just started looking at Argus in earnest, so I'm new, but
generally familiar with other networking tools.

Most of the traffic that I've looked at so far seems pretty normal, at
least in that I understand what it is, and the reporting of it from
tools like "ra". Some of it appears to highlight some gaps in what I know.

The ones which are strangest are those like the following. I'm fine
with tcp, udp, arp etc., but haven't found what the "man" protocol
means. Naturally, googling gives me countless links to man pages. In
any case, the format of these is slightly different from the rest, and
all apparently from a single IP (6000+ records, from December 12 to
present).

12-12-05 15:26:52.669222           man               229.97.122.203  v2.0                                     1 0          0        0         0            0           STA
12-12-05 15:26:52.670329           man               229.97.122.203  v2.0                                    16 7          233      0         49530        4           CON
12-12-05 15:31:52.183189           man               229.97.122.203  v2.0                                    36 6          65       0         4419         5           CON
12-12-05 15:36:52.035605           man               229.97.122.203  v2.0                                    53 5          60       0         3772         1           CON

Any ideas?

    Thanks,
    Tim

Peter Van Epp | 3 Jan 2006 01:21

Picon

Picon

Re: "man" protocol?

On Mon, Jan 02, 2006 at 05:27:48PM -0600, Tim Lavoie wrote:
> 
> Hi all,
> 
> I've just started looking at Argus in earnest, so I'm new, but
> generally familiar with other networking tools.
> 
> Most of the traffic that I've looked at so far seems pretty normal, at
> least in that I understand what it is, and the reporting of it from
> tools like "ra". Some of it appears to highlight some gaps in what I know.
> 
> The ones which are strangest are those like the following. I'm fine
> with tcp, udp, arp etc., but haven't found what the "man" protocol
> means. Naturally, googling gives me countless links to man pages. In
> any case, the format of these is slightly different from the rest, and
> all apparently from a single IP (6000+ records, from December 12 to
> present).
> 
> 12-12-05 15:26:52.669222           man               229.97.122.203  v2.0                                     1 0          0        0         0            0           STA
> 12-12-05 15:26:52.670329           man               229.97.122.203  v2.0                                    16 7          233      0         49530        4           CON
> 12-12-05 15:31:52.183189           man               229.97.122.203  v2.0                                    36 6          65       0         4419         5           CON
> 12-12-05 15:36:52.035605           man               229.97.122.203  v2.0                                    53 5          60       0         3772         1           CON
> 
> Any ideas?
> 
>     Thanks,
>     Tim

	Yep, management records about the argus process. Luckily last I had
to figure it out I dumped the fields from the source (I was fixing some

(Continue reading)

Richard Bejtlich | 3 Jan 2006 03:11

Picon

Reading Argus records on FreeBSD i386 or amd64

Hello,

Issue 1:

Should data generated from Argus reading a Libpcap trace on FreeBSD
amd64 be readable using the ra client on FreeBSD i386?

(I would hope so?)

On each platform, the ra client can read records generated on that platform.

Issue 2:

On FreeBSD amd64 (sensor01) I get 0 records when passing a filter on
Argus data generated on that platform.

sensor01$ ra -nn -r trace.lpc.ip.1800-2000.argus.ragator - net 10 | head -n 3
[nothing]

On FreeBSD i386 (janney) I get records as expected when passing a
filter on Argus data generated on that platform.

janney$ ra -nn -r trace.lpc.ip.1800-2000.argus - net 10 | head -n 3
27 Dec 05 18:00:25           tcp    192.168.1.38.2765  <?>    
10.100.5.22.1720  1        1         54           54          TIM
27 Dec 05 18:00:33           tcp     192.168.1.5.445   <?>      
10.0.0.41.1094  1        1         55           54          TIM
27 Dec 05 18:00:01          igrp      10.100.5.1        ->     
224.0.0.10       14       0         1036         0           CON

(Continue reading)

Richard Johnson | 3 Jan 2006 04:09

Re: Reading Argus records on FreeBSD i386 or amd64

At 21:11 -0500 on 2006-01-02, Richard Bejtlich wrote:
> Hello,
>
> Issue 1:
>
> Should data generated from Argus reading a Libpcap trace on FreeBSD
> amd64 be readable using the ra client on FreeBSD i386?

They should, but as a practical matter they likely won't be.  Argus is not
yet 64bit clean.

> On each platform, the ra client can read records generated on that platform.
> ...
> On FreeBSD amd64 (sensor01) I get 0 records when passing a filter on
> Argus data generated on that platform.

That matches fairly well with my experience.  Attempting to send records to
an amd64 system, whether from an amd64 system or an i386 system, didn't
work.

I've switched back to using high-end i386 systems, as I was fairly sure
that we wouldn't get anything useful to (or from) an amd64 box without some
significant code tweaks.

Richard

Mike Iglesias | 3 Jan 2006 04:47

Picon

Re: Reading Argus records on FreeBSD i386 or amd64

> Hello,
> 
> Issue 1:
> 
> Should data generated from Argus reading a Libpcap trace on FreeBSD
> amd64 be readable using the ra client on FreeBSD i386?
> 
> (I would hope so?)

You would, but it's not 64-bit clean yet.

Try using the i386 binaries on the amd64 system, or if FreeBSD can do
it, compile in 32 bit mode on the amd64 system.  I use Fedora for my
argus system, and use a copy of argus compiled on a i386 system so I can
read the files on other systems if necessary.

Mike Iglesias                          Email:       iglesias <at> uci.edu
University of California, Irvine       phone:       949-824-6926
Network & Academic Computing Services  FAX:         949-824-2069

Tim Lavoie | 3 Jan 2006 07:06

Re: "man" protocol?

On Mon, Jan 02, 2006 at 04:21:16PM -0800, Peter Van Epp wrote:

> 	Yep, management records about the argus process. Luckily last I had
> to figure it out I dumped the fields from the source (I was fixing some 
> formatting problems at the time) because as far as I know they aren't 
> documented except in the source:
> 
> 
> startime: mar.start 
> lasttime: mar.now 
> proto: man 
> saddr: argusid 
> sport: version# 
> daddr: nextseq# 
> dport: #flows 
> spkts: RcvdPackets 
> dpkts: droppedpackets 
> sbytes: rcvdbytes 
> dbytes: flows_closed 
> status: man_status 
> 
> 	The first line is fairly obvious (looks like you too don't have an IP
> assigned to the interface so the sensor IP is whatever happens to be there).
> The next line of numbers starts with the # of flows, then packets received,
> packets dropped (by pcap, there are other sources of drop as well), bytes
> received, number of flows closed and status (which I think is always con)

Hi Peter,

Thanks for the info. That does help, though it does lead to a bit of a

(Continue reading)

Tim Lavoie | 3 Jan 2006 17:12

Re: "man" protocol?

Just to update...

Mike Slifcak pointed out that I could set the ARGUS_MONITOR_ID flag
directly, instead of the `hostname` version which is the default. It
turns out that the ARGUS_MONITOR_ID flag didn't exist, or rather, it
was called ARGUS_MONITOR_DATA instead. On the system at work, the
config file used the _ID form, and worked appropriately. I will likely
file a Debian bug report to this effect, though the `hostname` form
may work if the variable is named correctly.  :)

	    Cheers,
	    Tim

eric | 3 Jan 2006 23:06

Re: "man" protocol?

On Tue, 2006-01-03 at 10:12:58 -0600, Tim Lavoie proclaimed...

> Mike Slifcak pointed out that I could set the ARGUS_MONITOR_ID flag
> directly, instead of the `hostname` version which is the default. It
> turns out that the ARGUS_MONITOR_ID flag didn't exist, or rather, it
> was called ARGUS_MONITOR_DATA instead. On the system at work, the
> config file used the _ID form, and worked appropriately. I will likely
> file a Debian bug report to this effect, though the `hostname` form
> may work if the variable is named correctly.  :)

It's a problem in the source code and has been a problem for a while.

Carter, I don't suppose you can put up a new .fixes for this?

Thanks.

Patrick Green | 9 Jan 2006 12:59

Picon

Picon

Argus and MTP

Hi,

Has anyone had any experience of running Argus on top of Metanetworks  
MTP cards?

We have been running some tests, on Fedora (customised kernel 2.6.11)  
with Argus Version 2.0.6, and an MTP card (www.metanetworks.org).

If we run an nmap against a machine on the network, I can see the  
traffic using TCPdump (so the card is picking it up and forwarding it  
to the OS), but argus doesnt seem to pick the traffic up - at best it  
sees about four packets ... has anyone else seen this / something  
obvious I should try?

Patrick
------------------------------------------------------------------------ 
--
Patrick Green -  Computing Services, Oxford University
http://users.ox.ac.uk/~patrick
Mobile: +44 (0)7812215375
PGP keyID 0x34E49221

poncenby smythe | 10 Jan 2006 00:11

Listening on tun interface...

List,

I am running openbsd 3.8 GENERIC and using argus-2.0.6.
I am using a THOMSON Speed Touch 330, rev 1.10/4.00 ADSL modem with  
an interface of tun0.
When trying to execute argus on this interface with the command ./ 
argus -i tun0 it just exits immediately.
I haven't compiled it with debugging enabled so I cannot tell what is  
happening any further (by the way how would you do this?).

When i run tcpdump on it says the link type is LOOP, any significance?

Thanks for your time

poncenby

Group

gmane.network.argus.

Project Web Page

Argus Development mailing list - Real Time Flow Monitor (RTFM) for comprehensive IP network traffic auditing

Search Archive

Page

1 | 2 | 3

Articles in period: 24

January 2006

Language

Change language

Options

Current view: Threads only / Showing only 20 lines / Not hiding cited text.
Change to All messages, whole messages, or hide cited text.

Post a message
NNTP Newsgroup
Classic Gmane web interface
XML

XML

RSS Feed
List Information

About Gmane

Recent entries

argus-clients-3.0.7.10 on the dev server (21 May 2013)
Rastream doesn't rotate properly when daemonied? (20 May 2013)
Ra - filter syntax error (20 May 2013)
Anomaly detection (16 May 2013)
raservices crashes when processing (15 May 2013)
rastream 3.0.7.8, no suser duser (14 May 2013)
Additional rasqlinsert information (14 May 2013)
RA_CIDR_ADDRESS_FORMAT="yes" and rasqlinsert -S [radium source] may be (10 May 2013)
Quick questions about rasort output (9 May 2013)
rastream and %T in -w (9 May 2013)
rastream and %T in -w (8 May 2013)
normalized appbyte ratio for producer/consumer relationship (8 May 2013)
filter syntax error (7 May 2013)
argus configuration with upstream router (7 May 2013)
Best way to grab summary data from last generated file by rastream (7 May 2013)
normalized appbyte ratio for producer/consumer relationship (7 May 2013)
Argus-info Digest, Vol 93, Issue 16 (7 May 2013)
normalized appbyte ratio for producer/consumer relationship (6 May 2013)
Shifting ragraph X-axis (5 May 2013)
normalized appbyte ratio (4 May 2013)
normalized appbyte ratio (4 May 2013)

Archives

93	May 2013
38	April 2013
75	March 2013
50	February 2013
113	January 2013
42	December 2012
49	November 2012
155	October 2012
63	September 2012
50	August 2012
30	July 2012
122	June 2012
22	May 2012
37	April 2012
53	March 2012
58	February 2012
91	January 2012
52	December 2011
17	November 2011
30	October 2011
15	September 2011
39	August 2011
49	July 2011
61	June 2011
66	May 2011
82	April 2011
48	March 2011
52	February 2011
27	January 2011
42	December 2010
35	November 2010
72	October 2010
78	September 2010
48	August 2010
102	July 2010
50	June 2010
23	May 2010
61	April 2010
40	March 2010
50	February 2010
26	January 2010
32	December 2009
72	November 2009
48	October 2009
55	September 2009
115	August 2009
66	July 2009
36	June 2009
92	May 2009
122	April 2009
116	March 2009
58	February 2009
26	January 2009
15	December 2008
3	November 2008
3	October 2008
24	September 2008
38	August 2008
50	July 2008
62	June 2008
6	May 2008
61	April 2008
90	March 2008
151	February 2008
121	January 2008
67	December 2007
61	November 2007
120	October 2007
107	September 2007
143	August 2007
44	July 2007
91	June 2007
68	May 2007
82	April 2007
141	March 2007
123	February 2007
69	January 2007
50	December 2006
79	November 2006
113	October 2006
114	September 2006
131	August 2006
96	July 2006
270	June 2006
4	May 2006
4	April 2006
40	March 2006
31	February 2006
24	January 2006
14	December 2005
2	November 2005
1	October 2005
8	September 2005
25	August 2005
1	July 2005
14	June 2005
5	May 2005
25	April 2005
24	March 2005
33	February 2005
12	January 2005
41	December 2004
33	November 2004
35	October 2004
48	September 2004
95	August 2004
45	July 2004
79	June 2004
87	May 2004
84	April 2004
17	March 2004
62	February 2004
14	January 2004
28	December 2003
14	November 2003
15	October 2003
38	September 2003
60	August 2003
28	July 2003
31	June 2003
48	May 2003
24	April 2003
39	March 2003
18	February 2003
29	January 2003
26	December 2002
41	November 2002
47	October 2002
18	September 2002
14	August 2002
23	July 2002
20	June 2002
92	May 2002
29	April 2002
56	March 2002
47	February 2002
33	January 2002
18	December 2001
91	November 2001
58	October 2001
49	September 2001
15	August 2001
49	July 2001
109	June 2001
52	May 2001
39	April 2001
99	March 2001
134	February 2001
123	January 2001
26	December 2000
59	November 2000
72	October 2000
143	September 2000
44	August 2000
81	July 2000
20	June 2000
12	May 2000
11	April 2000
63	March 2000
22	February 2000
8	January 2000
1	December 1999
6	October 1999
15	September 1999
3	August 1999
9	July 1999
12	June 1999
7	May 1999
16	April 1999
28	March 1999
9	February 1999

Design

Zawodny | Right Menu | Left Menu

Your Own Design

Paste the URL of your CSS below. Download CSS template