argus-clients-3.0.0.rc.21

Wed Aug 2 00:04:32 EDT 2006

On Tue, Aug 01, 2006 at 11:28:10PM -0400, Carter Bullard wrote:
> Hey Peter,
> So I just uploaded new argus and client rc files.
> Give em a try, should fix a few things.
> Carter
> 

	Indeed much closer :-)  The fragmentation flag doesn't look like its
getting across correctly, esp has problems and igmp looks to still have 
problems but no more tos/ttl etc. problems so far :-).

sport 0
dport 0
flgs2 = F
flgs32 =

line: 63 fields in error: dport,proto,flgs,sport,
1151432428.855532,1151433529.671900,1,1100.816368,1100.816368,142.58.29.58,142.5
8.135.65,ipni,0,0,255,255,255,255,17531159,3131651,2956740,2631957,29411,12445,1
27404.78,22758.75,26.72,11.31,0.0000,0.0000,3848370891,qF,0:11:88:21:f1:80,0:11:
88:5:5d:1d,<->,28888.102963,,CON,s[16]="%...........#\..",d[16]="%.............]
.",,,8651,,,0xc087,0x027f,0x0000
1151432428.855532,1151433529.671900,1,1100.816368,1100.816406,142.58.29.58,142.5
8.135.65,ipnip,,,255,255,255,255,17531159,3131651,2956740,2631957,29411,12445,12
7404.781,22758.752,26.717,11.305,0,0,229.97.122.203, v       ,0:11:88:21:f1:80,0
:11:88:5:5d:1d,<->,28886.744474,,CON,s[16]="%...........#\..",d[16]="%..........
...].",,,8651,,,0xc087,0x027f,0x0000,0x0000

	esp too (look like bugs in both 2.0.6 and 3.0 so may be underlying 
data)

sport 0
dport 48106 2079308778

line: 203 fields in error: dport,sport,
1151432428.949492,1151433528.697986,1,1099.748494,1099.748494,142.58.213.62,208.
38.3.62,esp,0,48106,0,0,64,0,1185980,0,961248,0,5914,0,8627.28,0.00,5.38,0.00,0.
0000,0.0000,3848370891,q,0:10:db:73:dd:51,0:11:88:5:5d:1d,->,759527.000000,,INT,
s[16]="...@!.....G...K.",,,,9297,,,0x8200,,0x7bef
1151432428.949492,1151433528.697986,1,1099.748494,1099.748535,142.58.213.62,208.
38.3.62,esp,,2079308778,0,,64,,1185980,0,961248,0,5914,0,8627.281,0.000,5.378,0.
000,0,0,229.97.122.203, v       ,0:10:db:73:dd:51,0:11:88:5:5d:1d,->,759527.0000
00,,INT,s[16]="...@!.....G...K.",,,,9297,,,0x8200,,0x7bef,

	The ports look to be a 2.0.6 bug but ipid may be an endian issue.

sport 22
dport 0
state CON INT
sipid 0xd21b 0x1bd2

line: 361 fields in error: state,dport,sipid,sport,
1151432429.126443,1151432860.570563,1,431.444120,431.444120,142.58.60.61,224.0.0
.251,igmp,22,0,0,0,1,0,100,0,16,0,2,0,1.85,0.00,0.00,0.00,0.0000,0.0000,38483708
91,q,0:11:24:97:47:52,1:0:5e:0:0:fb,->,,,CON,s[8]="........",,,,8856,,,0x0280,,0
xd21b
1151432429.126443,1151432860.570563,1,431.444120,431.444122,142.58.60.61,224.0.0
.251,igmp,,,0,,1,,100,0,16,0,2,0,1.854,0.000,0.005,0.000,0,0,229.97.122.203, v
     ,0:11:24:97:47:52,1:0:5e:0:0:fb,->,,,INT,s[8]="........",,,,8856,,,0x0280,,
0x1bd2,

%./ra_test.pl rs178.2.argus | more

line: 7 fields in error: dir,
1151432428.834980,1151432968.849102,1,540.014122,540.014122,142.58.206.16,142.58
.202.108,tcp,524,1434,0,0,128,128,4270036130,91141044,4095125356,4541942,3015703
,1493083,63258140.20,1350202.38,5584.49,2764.90,0.0007,0.0000,3848370891,qs,0:f:
1f:f8:c4:c1,0:11:88:5:5d:1d,?>,1278.000000,3716.553425,CON,s[16]=".Y....&!..:KLJ
j(",d[16]="DmdT...1........",21344,17520,8541,,,0x80ce,0x80ca,0xfee9
1151432428.834980,1151432968.849102,1,540.014122,540.014099,142.58.206.16,142.58
.202.108,tcp,524,1434,0,0,128,128,4270036130,91141044,4095125356,4541942,3015703
,1493083,63258144.000,1350202.375,5584.489,2764.896,0,0,229.97.122.203, vs
,0:f:1f:f8:c4:c1,0:11:88:5:5d:1d,<?>,1278.000000,3716.47,CON,s[16]=".Y....&!..:K
LJj(",d[16]="DmdT...1........",21344,17520,8541,,,0x80ce,0x80ca,0xfee9,0xfee9

sloss 139.0000 0

line: 15 fields in error: proto,sloss,
1151432428.835508,1151432946.117999,1,517.282491,517.282491,142.58.205.8,24.85.1
38.30,rtp,16386,41238,0,0,64,0,2500442,0,1317184,0,25723,0,38670.43,0.00,49.73,0
.00,139.0000,0.0000,3848370891,q,0:16:cb:85:6b:be,0:11:88:5:5d:1d,->,16300.00000
0,,INT,s[16]="......w..0......",,,,8551,,,0x0200,,0x82df
1151432428.835508,1151432946.117999,1,517.282491,517.282471,142.58.205.8,24.85.1
38.30,udp,16386,41238,0,,64,,2500442,0,1317184,0,25723,0,38670.430,0.000,49.727,
0.000,0,0,229.97.122.203, v       ,0:16:cb:85:6b:be,0:11:88:5:5d:1d,->,16300.000
000,,INT,s[16]="......w..0......",,,,8551,,,0x0200,,0x82df,

djit 563401.875345 561892.47

line: 23 fields in error: djit,dir,
1151432428.836459,1151433529.824857,1,1100.988398,1100.988398,142.58.155.79,142.
58.167.63,tcp,1030,445,0,0,255,255,7324703,34375869,3834611,30963787,60174,58829
,53222.74,249781.88,54.65,53.43,0.0299,0.0068,3848370891,q*,0:b:db:49:f6:39,0:11
:88:5:5d:1d,?>,31.787992,563401.875345,CON,s[16]="...;.SMB........",d[16]="...<.
SMB........",17520,16766,8549,,,0x0200,0x8200,0x93ab
1151432428.836459,1151433529.824857,1,1100.988398,1100.988403,142.58.155.79,142.
58.167.63,tcp,1030,445,0,0,255,255,7324703,34375869,3834611,30963787,60174,58829
,53222.742,249781.875,54.655,53.433,0,0,229.97.122.203, v*      ,0:b:db:49:f6:39
,0:11:88:5:5d:1d,<?>,31.541513,561892.47,CON,s[16]="...;.SMB........",d[16]="...
<.SMB........",17520,16766,8549,,,0x0200,0x8200,0x93ab,0x93ab

state TIM CON

line: 31 fields in error: state,dir,
1151432428.840442,1151433509.016300,1,1080.175858,1080.175858,142.58.235.103,142
.58.103.117,tcp,1660,445,0,0,128,0,580,0,0,0,10,0,4.30,0.00,0.01,0.00,0.0000,0.0
000,3848370891,q,0:14:22:56:d6:dd,0:11:88:5:5d:1d,<?>,,,TIM,,,0,0,756,,,0x8200,,
0xbdef
1151432428.840442,1151433509.016300,1,1080.175858,1080.175903,142.58.235.103,142
.58.103.117,tcp,1660,445,0,,128,,580,0,0,0,10,0,4.296,0.000,0.009,0.000,0,0,229.
97.122.203, v       ,0:14:22:56:d6:dd,0:11:88:5:5d:1d,?>,,,CON,,,0,0,756,,,0x820
0,,0xbdef,

sport 34
dport 0
state CON INT

line: 42 fields in error: state,dport,sport,
1151432428.847329,1151432439.757887,1,10.910558,10.910558,142.58.200.252,224.0.0
.22,igmp,34,0,192,0,1,0,174,0,48,0,3,0,127.58,0.00,0.27,0.00,0.0000,0.0000,38483
70891,q,0:e0:81:20:c3:4c,1:0:5e:0:0:16,->,,,CON,s[16]=""...............",,,,8887
,,,0x0200,,0x0000
1151432428.847329,1151432439.757887,1,10.910558,10.910558,142.58.200.252,224.0.0
.22,igmp,,,192,,1,,174,0,48,0,3,0,127.583,0.000,0.275,0.000,0,0,229.97.122.203,
v       ,0:e0:81:20:c3:4c,1:0:5e:0:0:16,->,,,INT,s[16]=""...............",,,,888
7,,,0x0200,,0x0000,

line: 52 fields in error: dir,
1151432428.851530,1151433240.526740,1,811.675210,811.675210,142.58.71.99,142.58.
217.166,tcp,49152,1935,0,0,255,255,79657946,6850292,71822216,9962,111939,97719,7
85121.39,67517.57,137.91,120.39,0.0036,0.0000,3848370891,qs,0:11:24:a8:11:b2,0:1
1:88:5:5d:1d,?>,5055.000000,33915.787004,CON,s[16]="K.....h.".......",d[16]="...
...........%6",65535,34752,8586,,,0x0200,0x8288,0x8b92
1151432428.851530,1151433240.526740,1,811.675210,811.675232,142.58.71.99,142.58.
217.166,tcp,49152,1935,0,0,255,255,79657946,6850292,71822216,9962,111939,97719,7
85121.375,67517.562,137.911,120.392,0,0,229.97.122.203, vs      ,0:11:24:a8:11:b
2,0:11:88:5:5d:1d,<?>,5055.000000,33915.32,CON,s[16]="K.....h.".......",d[16]=".
.............%6",65535,34752,8586,,,0x0200,0x8288,0x8b92,0x8b92

sport 0
dport 0
flgs2 = F
flgs32 =

line: 63 fields in error: dport,proto,flgs,sport,
1151432428.855532,1151433529.671900,1,1100.816368,1100.816368,142.58.29.58,142.5
8.135.65,ipni,0,0,255,255,255,255,17531159,3131651,2956740,2631957,29411,12445,1
27404.78,22758.75,26.72,11.31,0.0000,0.0000,3848370891,qF,0:11:88:21:f1:80,0:11:
88:5:5d:1d,<->,28888.102963,,CON,s[16]="%...........#\..",d[16]="%.............]
.",,,8651,,,0xc087,0x027f,0x0000
1151432428.855532,1151433529.671900,1,1100.816368,1100.816406,142.58.29.58,142.5
8.135.65,ipnip,,,255,255,255,255,17531159,3131651,2956740,2631957,29411,12445,12
7404.781,22758.752,26.717,11.305,0,0,229.97.122.203, v       ,0:11:88:21:f1:80,0
:11:88:5:5d:1d,<->,28886.744474,,CON,s[16]="%...........#\..",d[16]="%..........
...].",,,8651,,,0xc087,0x027f,0x0000,0x0000

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada