port numbers missing from argus records
r.fulton at auckland.ac.nz
Tue Apr 19 19:10:02 EDT 2005
I am seeing records from argus that appear to be missing the source
port number for TCP flows. The errant flows are detected by two
different copies of ra which take feeds from the meter.
ra is run with the following config file:
RA_FIELD_SPECIFIER="startime ind proto saddr sport dir daddr dport
and the perl script (watcher) changes the "\t"s to commas before writing
out the record.
As one can see we get the saddr followed immediately by the dir with no
This happens for a very small proportion of the records, I'm seeing a
few of these an hour on a 100Mbps link.
here are the versions:
drwxr-xr-x 13 rful011 argus 512 Feb 4 16:07 argus-2.0.6.fixes.1
drwxr-xr-x 15 rful011 argus 1024 Feb 4 16:15 argus-clients-2.0.6.fixes.1
I think this started when I installed argus-2.0.6.fixes.1 back in Feb.
Russell Fulton, Information Security Officer, The University of Auckland
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 2201 bytes
Desc: not available
More information about the argus