Argus
Jump to navigation
Jump to search
Background
- Argus is deployed in such a way that it listens on localhost:561 and does not write to disk. This saves load on the daemon and functionality doesn't change, it just gets easier.
- This deployment was on a filtering bridge between an ineffective proprietary firewall and a sizable LAN during the course of redeployment of the firewall.
- All commands run inside screen(1) for usability's sake.
rasplit
- argus(8) will write to a file directly, but we need something that will do it more intelligently; rasplit(1) does the job.
- Using radium(8), you can use the srcid field to your advantage. The following writes out each srcid to its own flow file, so you can easily aggregate multiple argus(8) sources on one storage machine.
rasplit -d -S localhost:561 -M time 10m -w /argus/archive/%Y-%m/%d/\$srcid--%Y.%m.%d-%H.%M.%s
- That script writes everything to its own year-month/day/srcid--year.month.day-hour.minute.second file cycled every 10mins but keeping sessions in their proper place historically.
- It is important to backslash-escape the "srcid" variable, or it'll get shell-replaced with whatever equals $srcid in your environment (probably nothing.)
ratop
- ratop(1) is in use for a reasonably real-time view of running sessions. To facilitate its use, we needed to slim down known-good traffic to make the display reasonable to read. This LAN gets a lot of in/outbound traffic and it just isn't feasible to watch it all.
- So, in keeping with the scenario, a script called "rattop" was written:
#!/bin/sh ratop -n -S localhost - `/usr/local/argus/bin/subrules.rb` exit
subrules
File:Argus-multitail.png
Argus Multitail colorscheme
- This script is standalone and uses a ruby script that "parses" a list of BPF syntax filters from a file.
- The ruby script is as such (subrules.rb):
#!/usr/bin/env ruby
#
# 2007-01-25 -- jontow@
#
f = File.open('/usr/local/argus/etc/bpf.rules', 'r')
outrules = ''
f.each do |line|
if line =~ /^#/
# comment, skip it
elsif line =~ /^$/
# blank line, skip it
else
outrules += line.gsub(/\n$/, ' ')
end
end
puts outrules
exit
- The ruleset will be detailed below in the ra(1) section.
- "rattop" runs without any arguments. To define the ruleset, modify the File.open line above.
ra
- The final (but most important piece) is the script called "rattail" that is used for real-time display of session data:
#!/bin/sh multitail -cS ra -ev llc -l 'ra -n -S localhost - `cat /usr/local/argus/etc/bpf.rules`' exit
- It (rattail) is used with Multitail(1) to have a colored display of traffic based upon its categorization.
The Ruleset(tm)
- The ruleset is simply the same filter syntax that one uses on the command line with argus clients, but split so that it is readable on a line basis.
- Example ruleset (bpf.rules):
not arp and not rtp and not rtcp and not port 22 and not host 192.168.1.10 and not ((dst port 80 or dst port 443) and (dst host 192.168.1.152 or dst host 192.168.1.160))
- The ruleset is simply a means of visually ignoring traffic that we KNOW is supposed to / can be there. It shows simply what is leftover after accounting for everything valid, therefor showing only questionable traffic.