Argus

Background

• In the following setup, Argus is deployed in such a way that it listens on localhost:1561 and does not write to disk. Additional instances of argus (for additional capture interfaces, etc) follow the same scheme, but listening on the next available port (ie. 1562). This saves load on the daemon and functionality doesn't change, it just gets easier.
• This deployment was on a high-powered SMP-enabled machine with 8GB of RAM and a 1TB ZFS pool to play with.
• It is used at an ISP with gigabit speed links everywhere, and a substantial amount of internet-bound traffic. Most common use here is at the internet edge for troubleshooting and statistics-gathering.

rasplit

• argus(8) will write to a file directly, but we need something that will do it more intelligently; rasplit(1) does the job.
• Using radium(8), you can use the srcid field to your advantage. The following writes out each srcid to its own flow file, so you can easily aggregate multiple argus(8) sources on one storage machine.

 rasplit -d -S localhost:561 -M time 10m -w /argus/archive/%Y-%m/%d/\$srcid--%Y.%m.%d-%H.%M.%s

• That script writes everything to its own year-month/day/srcid--year.month.day-hour.minute.second file cycled every 10mins but keeping sessions in their proper place historically.
• It is important to backslash-escape the "srcid" variable, or it'll get shell-replaced with whatever equals $srcid in your environment (probably nothing.)

ratop

• ratop(1) is in use for a reasonably real-time view of running sessions. To facilitate its use, we needed to slim down known-good traffic to make the display reasonable to read. This network gets a lot of in/outbound traffic and it just isn't feasible to watch it all.

 ratop -n -S localhost - `xargs </path/to/filterfile`

ra

• The final (but most important piece) is the script called "rattail" that is used for real-time display of session data:

 #!/bin/sh

 multitail -cS ra -ev llc -l 'ra -n -S localhost - `cat /usr/local/argus/etc/bpf.rules`'
 exit

• It (rattail) is used with Multitail(1) to have a colored display of traffic based upon its categorization.

The Ruleset(tm)

• The ruleset is simply the same filter syntax that one uses on the command line with argus clients, but split so that it is readable on a line basis.
• Example ruleset (bpf.rules):

 not arp and
 not rtp and
 not rtcp and
 not port 22 and
 not host 192.168.1.10 and
 not ((dst port 80 or dst port 443) and (dst host 192.168.1.152 or dst host 192.168.1.160))

• The ruleset is simply a means of visually ignoring traffic that we KNOW is supposed to / can be there. It shows simply what is leftover after accounting for everything valid, therefor showing only questionable traffic.

External Links

• Argus Homepage
• Argus on the NSM wiki