Difference between revisions of "Argus"
Jump to navigation
Jump to search
(break out subrules into its own section, fix formatting, add comment-parsing) |
m (12 revisions) |
||
| (9 intermediate revisions by 2 users not shown) | |||
| Line 1: | Line 1: | ||
== Background == | == Background == | ||
| − | * [http://www.qosient.com/argus/ Argus] is deployed in such a way that it listens on localhost: | + | * In the following setup, [http://www.qosient.com/argus/ Argus] is deployed in such a way that it listens on localhost:1561 and does not write to disk. Additional instances of argus (for additional capture interfaces, etc) follow the same scheme, but listening on the next available port (ie. 1562). This saves load on the daemon and functionality doesn't change, it just gets easier. |
| − | * This deployment was on a | + | * This deployment was on a high-powered SMP-enabled machine with 8GB of RAM and a 1TB ZFS pool to play with. |
| − | + | * It is used at an ISP with gigabit speed links everywhere, and a substantial amount of internet-bound traffic. Most common use here is at the internet edge for troubleshooting and statistics-gathering. | |
| + | == Commands == | ||
| + | === rasplit === | ||
| − | + | * argus(8) will write to a file directly, but we need something that will do it more intelligently; rasplit(1) does the job. | |
| − | + | * Using radium(8), you can use the srcid field to your advantage. The following writes out each srcid to its own flow file, so you can easily aggregate multiple argus(8) sources on one storage machine. | |
| − | |||
| − | * | ||
| − | * | ||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | + | rasplit -d -S localhost:561 -M time 10m -w /argus/archive/%Y-%m/%d/\$srcid--%Y.%m.%d-%H.%M.%s | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | + | * That script writes everything to its own year-month/day/srcid--year.month.day-hour.minute.second file cycled every 10mins but keeping sessions in their proper place historically. | |
| − | + | * It is important to backslash-escape the "srcid" variable, or it'll get shell-replaced with whatever equals $srcid in your environment (probably nothing.) | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | + | === ratop === | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | * | + | * ratop(1) is in use for a reasonably real-time view of running sessions. To facilitate its use, we needed to slim down known-good traffic to make the display reasonable to read. This network gets a lot of in/outbound traffic and it just isn't feasible to watch it all. |
| − | |||
| + | ratop -n -S localhost - `xargs </path/to/filterfile.txt` | ||
| − | == ra == | + | === ra === |
| − | * | + | * ra(1) can be used as a shim between other commands for filtering, display, whatever |
| + | * ra(1) is most often used for ~realtime monitoring of the data | ||
| + | * When combined with [[multitail|Multitail]](1), you can have a colored display of traffic based upon its categorization. | ||
#!/bin/sh | #!/bin/sh | ||
| − | multitail -cS ra -ev llc -l 'ra -n -S localhost - `cat / | + | multitail -cS ra -ev llc -l 'ra -n -S localhost - `cat /path/to/filterfile.txt`' |
exit | exit | ||
| − | + | == Configuration == | |
| − | + | === The Ruleset(tm) (filterfile.txt) === | |
| − | |||
| − | |||
| − | == The Ruleset(tm) == | ||
* The ruleset is simply the same filter syntax that one uses on the command line with argus clients, but split so that it is readable on a line basis. | * The ruleset is simply the same filter syntax that one uses on the command line with argus clients, but split so that it is readable on a line basis. | ||
| − | * Example ruleset ( | + | * Example ruleset (filterfile.txt): |
not arp and | not arp and | ||
| Line 85: | Line 44: | ||
not ((dst port 80 or dst port 443) and (dst host 192.168.1.152 or dst host 192.168.1.160)) | not ((dst port 80 or dst port 443) and (dst host 192.168.1.152 or dst host 192.168.1.160)) | ||
| − | * The ruleset is simply a means of visually | + | * The ruleset is simply a means of visually filtering traffic that we KNOW is supposed to / can be there. If used as above in the negated manner ("not ..."), it shows simply what is leftover after accounting for everything valid, therefor showing only questionable traffic. |
== External Links == | == External Links == | ||
Latest revision as of 21:47, 4 January 2013
Background
- In the following setup, Argus is deployed in such a way that it listens on localhost:1561 and does not write to disk. Additional instances of argus (for additional capture interfaces, etc) follow the same scheme, but listening on the next available port (ie. 1562). This saves load on the daemon and functionality doesn't change, it just gets easier.
- This deployment was on a high-powered SMP-enabled machine with 8GB of RAM and a 1TB ZFS pool to play with.
- It is used at an ISP with gigabit speed links everywhere, and a substantial amount of internet-bound traffic. Most common use here is at the internet edge for troubleshooting and statistics-gathering.
Commands
rasplit
- argus(8) will write to a file directly, but we need something that will do it more intelligently; rasplit(1) does the job.
- Using radium(8), you can use the srcid field to your advantage. The following writes out each srcid to its own flow file, so you can easily aggregate multiple argus(8) sources on one storage machine.
rasplit -d -S localhost:561 -M time 10m -w /argus/archive/%Y-%m/%d/\$srcid--%Y.%m.%d-%H.%M.%s
- That script writes everything to its own year-month/day/srcid--year.month.day-hour.minute.second file cycled every 10mins but keeping sessions in their proper place historically.
- It is important to backslash-escape the "srcid" variable, or it'll get shell-replaced with whatever equals $srcid in your environment (probably nothing.)
ratop
- ratop(1) is in use for a reasonably real-time view of running sessions. To facilitate its use, we needed to slim down known-good traffic to make the display reasonable to read. This network gets a lot of in/outbound traffic and it just isn't feasible to watch it all.
ratop -n -S localhost - `xargs </path/to/filterfile.txt`
ra
- ra(1) can be used as a shim between other commands for filtering, display, whatever
- ra(1) is most often used for ~realtime monitoring of the data
- When combined with Multitail(1), you can have a colored display of traffic based upon its categorization.
#!/bin/sh multitail -cS ra -ev llc -l 'ra -n -S localhost - `cat /path/to/filterfile.txt`' exit
Configuration
The Ruleset(tm) (filterfile.txt)
- The ruleset is simply the same filter syntax that one uses on the command line with argus clients, but split so that it is readable on a line basis.
- Example ruleset (filterfile.txt):
not arp and not rtp and not rtcp and not port 22 and not host 192.168.1.10 and not ((dst port 80 or dst port 443) and (dst host 192.168.1.152 or dst host 192.168.1.160))
- The ruleset is simply a means of visually filtering traffic that we KNOW is supposed to / can be there. If used as above in the negated manner ("not ..."), it shows simply what is leftover after accounting for everything valid, therefor showing only questionable traffic.