.\"
.\" Copyright (c) 2000-2004 QoSient, LLC
.\" All rights reserved.
.\"
.\" This program is free software; you can redistribute it and/or modify
.\" it under the terms of the GNU General Public License as published by
.\" the Free Software Foundation; either version 2, or (at your option)
.\" any later version.
.\"
.\" This program is distributed in the hope that it will be useful,
.\" but WITHOUT ANY WARRANTY; without even the implied warranty of
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
.\" GNU General Public License for more details.
.\"
.\" You should have received a copy of the GNU General Public License
.\" along with this program; if not, write to the Free Software
.\" Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.  */
.\"
.\"
.\"
.TH ARGUS 8 "10 November 2000"
.SH NAME
argus \- audit record generation and utilization system
.SH SYNOPSIS
.B argus
[
.B options
] [
.B filter expression
]
.SH COPYRIGHT
Copyright (c) 2000-2004 QoSient, LLC All rights reserved.
.SH DESCRIPTION
.IX  "argus command"  ""  "\fLargus\fP \(em Internet audit facility"
.IX  servers  argus  ""  "\fLargus\fP \(em Internet audit facility"
.LP
.B Argus
is an IP transaction auditing tool that categorizes
IP packets which match the boolean
.I expression
into a protocol-specific network transaction model.
.B Argus
reports on the transactions that it discovers, as they occur.
.LP
Designed to run as a daemon,
.B argus
generally reads packets directly from a network interface, and writes the
transaction status information to a log file or open socket connected to an
.B argus
client (such as
.BR ra(1) ).
.B Argus
can also read packet information from
.B tcpdump(1) ,
.B snoop(1)
or
.B NLANR's Moat Time Sequence Header
raw packet files.  \fBArgus\fP can also be configured to write its
transaction logs to stdout.
.LP
.B Argus
provides access control for its socket connection facility using
.B tcp_wrapper
technology.  Please refer to the \fBtcp_wrapper\fP distribution
for a complete description.
.SH OPTIONS
.TP 5 5
.B \-b
Dump the compiled packet-matching code to stdout and stop.  This is
used to debug filter expressions.
.TP 5 5
.B \-B
Only bind to the specified IP address (remote access must be enabled by
a non-zero port).
.TP 5 5
.BI \-c
Generate system pid file.  This will cause argus to create a pid file
that can be used to control the number of argi running on a system.
The default pid file directory is /var/run, and $ARGUSHOME, when the
OS does not suppor /var/run.
.TP 5 5
.BI \-d
Run argus as a daemon.  This will cause argus to do the things that
Unix daemons do and return, if there were no errors, with argus
running as a detached process.
.TP 5 5
.BI \-D
<level>
Print debug messages to stderr.  The higher the \fB<level>\fP the more
information printed.  Acceptable levels are 1-8.
.TP 5 5
.BI \-e
<value>
Specify the source identifier for this \fBargus\fP.  Acceptable values are
numbers, hostnames or ip address.
.TP 5 5
.B \-h
Print an explanation of all the arguments.
.TP 5 5
.B \-F
Use \fIconffile\fP as a source of configuration information.
Options set in this file override any other specification, and so 
this is the last word on option values.
.TP 5 5
.BI \-I
<number>
Specify the \fB<number>\fP of instances that are concurrently
allowed.  The default is 1.  This is impacts the pid file strategy
for argus.
.TP 5 5
.BI \-i
<interface>
Specify the physical network \fB<interface>\fP to be audited.
The default is the first network interface that is up and running.
.TP 5 5
.BI \-J\ 
Generate packet peformance data in each audit record.
.TP 5 5
.B \-M
<secs>
Specify the interval in <secs> of argus status records.  These records
are used to report the internal status of argus itself.  The default is
300 seconds.
.TP 5 5
.B \-m
Don't provide MAC addresses information in \fBargus\fP records.
.TP 5 5
.B \-n
<directory>
Specify the pid file directory.  This overrides the default directory
location, which is /var/run, or $ARGUSHOME if /var/run is not available.
This switch implies the -c switch.
.TP 5 5
.B \-O
Turn off Berkeley Packet Filter optimizer.  No reason to do this unless
you think the optimizer generates bad code.
.TP 5 5
.B \-p
Do not set the physical network interface in promiscuous mode.  If the
interface is already in promiscuous mode, this option may have no effect.
Do this to audit only the traffic coming to and from the system argus
is running on.
.TP 5 5
.BI \-P
<portnum>
Specifies the \fB<portnum>\fP for remote client connection.
The default is to not support remote access.
Setting the value to zero (0) will forceably turn off the
facility.
.TP 5 5
.B \-r
Read from
.B tcpdump(1) ,
.B snoop(1)
or
.B NLANR's Moat Time Sequence Header
(tsh) packet capture files.  If the packet capture file is a \fBtsh\fP
format file, then the \fB-t\fP option must also be used.  Argus will read
from only one input packet file at a time.
If the
.B \-r
option is specified,
.B argus
will not put down a
.B listen(2)
to support remote access.
.TP 5 5
.BI \-R
Generate argus records such that response times can be derived from
transaction data.
.TP 5 5
.B \-S
<secs>
Specify the status reporting interval in <secs> for all traffic flows.
.TP 5 5
.B \-t
Indicate that the expected packet capture input file is a
.B NLANR's Moat Time Sequence Header
(tsh) packet capture file.
.TP 5 5
.B \-U
Specify the number of user bytes to capture.
.TP 5 5
.B \-w
<file ["filter"]
Write transaction status records to \fIoutput-file\fP.  An \fIoutput-file\fP
of '-' directs \fBargus\fP to write the resulting \fIargus-file\fP output
to \fIstdout\fP.
.TP 5 5
.B \-X
Clear existing argus configuration.  This removes any initialization done prior
to encountering this flag.  Allows you to eliminate the effects of the
\fI/etc/argus.conf\fP file, or any argus.conf files that may have been loaded.
.TP 5 5
.B \fIexpression\fP
This
.B tcpdump(1)
expression
specifies which transactions will be selected.  If no \fIexpression\fP
is given, all transactions are selected.  Otherwise,
only transactions for which \fIexpression\fP is `true' will be dumped.
For a complete \fIexpression\fP format description, please refer to the
.B tcpdump(1)
man page.

.SH SIGNALS
\fBArgus\fP catches a number of \fBsignal(3)\fP events.
The three signals \fBSIGHUP\fP, \fBSIGINT\fP, and \fBSIGTERM\fP
cause \fBargus\fP to exit, writing TIMEDOUT status records for
all currently active transactions.  The signal \fBSIGUSR1\fP
will turn on \fBdebug\fP reporting, and subsequent \fBSIGUSR1\fP
signals, will increment the \fBdebug-level\fP. The signal \fBSIGUSR2\fP
will cause \fBargus\fP to turn off all \fBdebug\fP reporting.

.SH ENVIRONMENT
.nf
$ARGUSHOME - Argus Root directory
.fi

.SH FILES
.nf
/etc/argus.conf        - argus daemon configuration file 
/var/run/argus_os.pid  - default PID file nameing convention
.fi

.SH EXAMPLES
.LP
Run \fBargus\fP as a daemon, writing all its transaction status reports to
\fIoutput-file\fP.  This is the typical mode.
.RS
.nf
\fBargus -d -e `hostname` -w \fIoutput-file\fP
.fi
.RE
.LP
If ICMP traffic is not of interest to you, you can filter out ICMP
packets on input.
.RS
.nf
\fBargus -w \fIoutput-file\fP - ip and not icmp
.fi
.RE
.LP
Argus supports both input filtering and output filtering,
and argus supports multiple output streams, each with their
own independant filters.

If you are interested in tracking IP traffic only (input
filter) and want to report ICMP traffic in one output file,
and all other IP traffic in another file.
.RS
.nf
\fBargus -w \fIoutfile1\fP "icmp" -w \fIoutfile2\fP "not icmp" - ip
.fi
.RE
.LP
Audit the network activity that is flowing between the two
gateway routers, whose ethernet addresses are 00:08:03:2D:42:01 and
00:00:0C:18:29:F1.  Without specifying an \fIoutput-file\fP, it is
assumed that the transaction status reports will be written to a 
remote client.  In this case we have changed the port that the
remote client will use to port 430/tcp.
.RS
.nf
\fBargus -P 430 ether host (0:8:3:2d:42:1 and 0:0:c:18:29:f1)\fP &
.fi
.RE
.LP
Audit each individual ICMP ECHO transaction.  You would do this
gather Round Trip Time data within your network.  Write the output to
\fIoutput-file\fP.
.RS
.nf
\fBargus -R -w \fIoutput-file\fP "echo" - icmp
.fi
.RE
.LP
Audit all NFS transactions involving the server \fIfileserver\fP
and increase the reporting interval to 3600 seconds (to provide high
data reduction).  Write the output to \fIoutput-file\fP.
.RS
.nf
\fBargus -S 3600 -w \fIoutput-file\fP udp and port 2049\fP &
.fi
.RE
.SH AUTHORS
.nf
Carter Bullard (carter@qosient.com)
.SH SEE ALSO
.BR argus.conf (5),
.BR hosts_access (5),
.BR hosts_options (5),
.BR tcpd (8),
.BR tcpdump (1)