[ARGUS] Peculiar cross platform argus/ra non-interoperability

[Peter Van Epp]

	Nothing springs to mind as likely wrong. I'd guess the best bet is to
touch .devel and .debug in the linux argus source directory, re run configure 
and make clean; make to get a debug copy of ra. Then start the ra with a -D8 
or so (which dumps debug messages to the console) to see where it dies which 
should give a clue as to why.

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada


On Sun, Aug 08, 2004 at 10:37:21AM -0700, Joe Christy wrote:
> After an upgrade to a FreeBSD gateway, I've started seeing the following 
> weird problem.
> 
> Gateway: FreeBSD-4-STABLE (4.10 w/ rolling updates as of 2004-08-04), 
> argus{,-clients}-2.0.6.fixes.1, runs argus w/ ARGUS_ACCESS_PORT=561 & 
> ARGUS_BIND_IP=172.24.4.1
> 
> Monitoring Station: Fedora Core 2 Linux, argus{,-clients}-2.0.6.fixes.1, 
> built from source.
> 
> On the Gateway, argus is happily writing to /var/log/argus/argus.out, 
> and ra -a -S 172.24.4.1:561 tracks traffic in real time, as it should. 
> So, it looks like the argus server is OK
> 
> For the past two years, through earlier versions of FreeBSD, Linux, and 
> argus{,-clients}, I've successfully been running ra -S 172.24.4.1:561 
> -w/var/log/argus/gateway-argus.out to capture the argus data securely on 
> an Internet-inaccessable Monitoring Station. Since upgrading FreeBSD 
> last week, this always returns immediately:
> moby(joe) ra -a -S 172.24.4.1
> 
> No data seen.
> 
> Now, I can run argus on the Monitoring Station and use ra there to 
> connect to its own bound IP and track traffic successfully, and I can 
> read a copy of the Gateway's locally written /var/log/argus/argus.out, 
> so it looks like the ra client is OK. I can even connect to the 
> Gateway's port 561 from the monitoring station with nc, and receive a 
> stream of unintelligble (to me at least) binary data, so the network 
> connection between the Monitoring Station and the Gateway's port 561 is 
> passing data. Nonetheless, the ra client on the Monitoring Station 
> steadfastly refuses to admit that it is seeing any data from argus on 
> the Gateway. Sigh.
> 
> Has anyone else seen this sort of behavior? Any ideas on a fix?
> 
> 	Joe