Re: Misc problems with argus-clients v. 3.0.5.34

Hi,

2012/2/29 Carter Bullard <carter <at> qosient.com>:
> I think the problems you're getting from rabins.1 may not be bugs, but
> its definitely not the right results.   When processing time based bins,
> rabins.1 will reject data if its not within its working time range.  If you
> don't tell rabins.1 what time range to use, with the -t option, rabins.1 will
> have to figure out what the time range is.  It does this when reading
> from a file by reading the file twice.  Once to figure out the time ranges,
> then another run to process the data into its preallocated bins.
>
> When you pipe data into rabins.1, it has to guess what the time range
> is going to be, and so there is potential to throw data away if its all over
> the calendar, so to speak.    This doesn't solve your problem, but it just
> explains why I think you're getting unpredicted results.

Actually on my original script where I noticed this problem, I already
was using -t option. It doesn't affect to the results. But thanks for
pointing out that rabins will read the data twice without it.

Related to this problem, rabins also seems to generate new records.
Look at the port 0 (and 3074) below.

This is what the data looks like:
# racluster -m proto dport -r test.arg.gz -w - - udp | rasort -m pkts
-s proto dport pkts -n  | head -5
   udp 161      353877
   udp 137      133430
   udp 3074     108009
   udp 53        89020

Re: argus-clients failing to listen using argus-udp after 3.0.5.11

Argus doesn't collect packet data - only session data

I'm setting up a new server, and I've run into a problem with argus.  No 
matter what I do, I can't seem to get it to collect user data.  It works 
fine on the old server.

This is on FreeBSD 8.2.  Argus was built from ports and is version 3.0.4 
without SASL.

Here's the argus.conf file:

ARGUS_DAEMON=yes
ARGUS_INTERFACE="bce1"
ARGUS_OUTPUT_FILE=/var/data/nsm/argus/argus.log
ARGUS_SET_PID=yes
ARGUS_GO_PROMISCUOUS=yes
ARGUS_GENERATE_RESPONSE_TIME_DATA=yes
ARGUS_GENERATE_MAC_DATA=yes
ARGUS_FILTER="ip and not icmp"
ARGUS_CAPTURE_DATA_LEN=800

And here's the process running:

root    94930 18.1  1.1 210416 189484  ??  Rs    8:48PM   0:41.79 
/usr/local/sbin/argus -F /usr/local/etc/argus.conf -F 
/usr/local/etc/argus.conf

No matter what CAPTURE_DATA_LEN I use, this is what I get in the log:

20:53:03.717210  e         udp         10.21.1.49.59178    <-> 
74.200.191.77.domain        2        408   CON
   20:53:03.718211  e         tcp     10.110.143.147.64634    <?> 
205.203.132.65.http         13      10133   CON
   20:53:03.718618  e         tcp     10.160.122.248.55405     -> 
69.116.12.102.28550         3        213   CON
   20:53:03.722132  e         tcp       10.21.21.177.56017     -> 
218.6.12.180.http          3        180   RST
   20:53:03.720056  e         tcp       71.71.229.73.12283     -> 
129.110.94.160.http         11       1633   FIN
   20:53:03.720769  e d       tcp       10.21.17.168.58421     -> 
121.11.151.47.http        351     380622   CON
   20:53:03.721078  e i       tcp       10.40.128.53.55652    <?> 
10.110.47.178.ssh         171     108674   CON

As you can see, no packet data at all.

I've even tried using -U 800 on the commandline, but same results. Googling 
didn't help.

--

-- 
Paul Schmehl (pauls <at> utdallas.edu)

Re: Argus doesn't collect packet data - only session data

Re: Argus doesn't collect packet data - only session data

Arghh..knew there was something I was missing.....thanks, Carter.

--On March 5, 2012 5:29:17 PM -0500 Carter Bullard <carter <at> qosient.com> 
wrote:

> Hey Paul,
>
> You need to specify the "suser" and/or "duser" fields to print using the
> command line option "-s +suser +duser"
> or add these fields to your .rarc file in the RA_FIELD_SPECIFIER variable
> definition.
> Many options changed in the 3.x releases. Check out the man page, if in
> doubt.
>
>
> You may find that the newest code, argus-clients-3.0.5.34 works as well:
>    http://qosient.com/argus/dev/argus-clients-latest-tar.gz
>
>
> Hope this helps,
> Carter
>
>
>
>
>
>
>
> On Mar 5, 2012, at 4:55 PM, Paul Schmehl wrote:
>
>
> I'm setting up a new server, and I've run into a problem with argus.  No
> matter what I do, I can't seem to get it to collect user data.  It works
> fine on the old server.
>
> This is on FreeBSD 8.2.  Argus was built from ports and is version 3.0.4
> without SASL.
>
> Here's the argus.conf file:
>
> ARGUS_DAEMON=yes
> ARGUS_INTERFACE="bce1"
> ARGUS_OUTPUT_FILE=/var/data/nsm/argus/argus.log
> ARGUS_SET_PID=yes
> ARGUS_GO_PROMISCUOUS=yes
> ARGUS_GENERATE_RESPONSE_TIME_DATA=yes
> ARGUS_GENERATE_MAC_DATA=yes
> ARGUS_FILTER="ip and not icmp"
> ARGUS_CAPTURE_DATA_LEN=800
>
> And here's the process running:
>
> root    94930 18.1  1.1 210416 189484  ??  Rs    8:48PM   0:41.79
> /usr/local/sbin/argus -F /usr/local/etc/argus.conf -F
> /usr/local/etc/argus.conf
>
> No matter what CAPTURE_DATA_LEN I use, this is what I get in the log:
>
> 20:53:03.717210  e         udp         10.21.1.49.59178    <->
> 74.200.191.77.domain        2        408   CON
>   20:53:03.718211  e         tcp     10.110.143.147.64634    <?>
> 205.203.132.65.http         13      10133   CON
>   20:53:03.718618  e         tcp     10.160.122.248.55405     ->
> 69.116.12.102.28550         3        213   CON
>   20:53:03.722132  e         tcp       10.21.21.177.56017     ->
> 218.6.12.180.http          3        180   RST
>   20:53:03.720056  e         tcp       71.71.229.73.12283     ->
> 129.110.94.160.http         11       1633   FIN
>   20:53:03.720769  e d       tcp       10.21.17.168.58421     ->
> 121.11.151.47.http        351     380622   CON
>   20:53:03.721078  e i       tcp       10.40.128.53.55652    <?>
> 10.110.47.178.ssh         171     108674   CON
>
> As you can see, no packet data at all.
>
> I've even tried using -U 800 on the commandline, but same results.
> Googling didn't help.

--

-- 
Paul Schmehl, Senior Infosec Analyst
As if it wasn't already obvious, my opinions
are my own and not those of my employer.
*******************************************
"It is as useless to argue with those who have
renounced the use of reason as to administer
medication to the dead." Thomas Jefferson
"There are some ideas so wrong that only a very
intelligent person could believe in them." George Orwell

debian packages for argus 3.0.x

Hi Folks

i am moving to use puppet to manage my sensors and it really want to deal with binary packages (in my case .deb
for Debian).  The debian packages support seems to have stopped at 2.0.6.

If need be I'll do the packaging myself but I'd rather not reinvent the wheel.

Anyone doing anything or have anything to get me started?

Russell

Time Filters

Re: Time Filters

Re: Misc problems with argus-clients v. 3.0.5.34

new argus and clients on dev server