rc.29 testing

Peter Van Epp vanepp at sfu.ca
Wed Sep 13 23:15:23 EDT 2006


	Rc.29 is looking good. All the directional count issues look to be gone
in the hour long test file (and the big test file output is below). There
looks to be an icmp length issue though (all 3.0.rc.29 for the v3 programs):

%argus -r count.tcp -w count3.argus

%argus_bpf -r count.tcp -w count2.argus

%ra -r count2.argus -nn
13 Sep 06 19:47:08           man  229.97.122.203  v2.0                   1 0     0        0         0            0           STA
28 Aug 06 15:30:31     I     tcp  102.177.225.49.47229  ->  142.58.222.231.54481 1        0         66           0           REQ
28 Aug 06 15:30:36          icmp     142.58.29.9        ->  102.177.225.49       1        0         94           0           URH
13 Sep 06 19:47:08           man  229.97.122.203  v2.0                   3 0     2        0         160          2           SHT

%ra3 -r count2.argus -n
    15:30:31.581086     I       tcp     102.177.225.49.47229     ->     142.58.222.231.54481         1        0           66            0   REQ
    15:30:36.583786            icmp        142.58.29.9           ->     102.177.225.49               1        0           94            0   URH
    19:47:08.206214             man           33620040      0               3228143616 838861        2        0   3228143616   3758104544   SHT

%ra3 -r count3.argus -n
    15:30:31.581086     I       tcp     102.177.225.49.47229     ->     142.58.222.231.54481         1        0           66            0   REQ
    15:30:36.583786            icmp        142.58.29.9           ->     102.177.225.49               1        0           86            0   URH
    19:46:57.630528             man                  0      0                       29      1        2        3           29      1462760   STP
%

	Note argus 3.0 is saying icmp length is 86 where 2.0.6 thinks its 94
(tcpdump reports 60, but I expect thats less headers and my sniffer machine
ate its power supply yesterday and is thus hors-de-combat for telling me whats
really going on, but I suspect 2.0.6 is correct because I verified all the 
counts there against tcpdump output :-)). Since its a harmless attack with no 
response I'll add count.tcp to this message for debugging.
	With state and direction checking supressed the large 2.0.6 file does
fine (at least all the complaints are either explained or 2.0.6 bugs :-)):

esp processing changed in 3.0 making this OK (it won't detect retransmits any
more I don't think):

flgs2 = s
flgs32 =

line: 1026 fields in error: flgs,
1151432430.055001,1151433528.697155,1,1098.642154,1098.642154,208.38.3.62,142.58
.213.62,esp,0,16248,0,0,52,0,1385072,0,1193096,0,5052,0,10085.70,0.00,4.60,0.00,
0.0000,0.0000,3848370891,qs,0:11:88:5:5d:1d,0:10:db:73:dd:51,->,841639.000000,,I
NT,s[16]="x?`X4........v$.",,,,7469,,,0x0200,,0x5b5f
1151432430.055001,1151433528.697155,1,1098.642154,1098.642212,208.38.3.62,142.58
.213.62,esp,,1532968824,0,,52,,1385072,0,1193096,0,5052,0,10085.700,0.000,4.598,
0.000,0,0,229.97.122.203, v       ,0:11:88:5:5d:1d,0:10:db:73:dd:51,->,841639.00
0000,,INT,s[16]="x?`X4........v$.",,,,7469,,,0x0200,,0x5b5f,

2.0.6 field length bug (truncates the hex)

sport 0xe 232
dport 0xe 232

line: 18705 fields in error: dport,sport,
1151432461.841994,1151432461.841994,1,0.000000,0.000000,0:9:6b:b7:9c:10,3:0:8:0:
0:0,llc,0xe,0xe,,,,,64,0,43,0,1,0,0.00,0.00,inf,0.00,0.0000,0.0000,3848370891,q,
0:9:6b:b7:9c:10,3:0:8:0:0:0,->,,,INT,s[16]="..CC............",,,,21725,,,0x8200,
,
1151432461.841994,1151432461.841994,1,0.000000,0.000000,0:9:6b:b7:9c:10,3:0:8:0:
0:0,llc,0xe8,0xe8,,,,,64,0,43,0,1,0,0.000,0.000,0.000,0.000,0,0,229.97.122.203,
v       ,0:9:6b:b7:9c:10,3:0:8:0:0:0,->,,,INT,s[16]="..CC............",,,,21725,
,,0x8200,,,

2.0.6 supressed 65535 port number (used as a flag as I recall)

sport  65535

line: 80205 fields in error: sport,
1151432633.891051,1151432633.891051,1,0.000000,0.000000,64.231.58.119,142.58.65.
252,udp,,5436,0,0,113,0,109,0,63,0,1,0,0.00,0.00,inf,0.00,0.0000,0.0000,38483708
91,q,0:11:88:5:5d:1d,0:14:51:7a:b:b1,->,,,INT,s[16]="...A...&....N.t.",,,,62171,
,,0x0286,,0x16f2
1151432633.891051,1151432633.891051,1,0.000000,0.000000,64.231.58.119,142.58.65.
252,udp,65535,5436,0,,113,,109,0,63,0,1,0,0.000,0.000,0.000,0.000,0,0,229.97.122
.203, v       ,0:11:88:5:5d:1d,0:14:51:7a:b:b1,->,,,INT,s[16]="...A...&....N.t."
,,,,62171,,,0x0286,,0x16f2,

a 3.0 sort field trade off, overwrites the E flag with the D flag. The correct
data for both is in the 3.0 argus record and another client can extract it if 
you need it.

flgs2 = E
flgs32 =

line: 111474 fields in error: flgs,
1151432739.311116,1151432742.431802,1,3.120686,3.120686,142.58.211.84,205.188.21
2.249,tcp,59972,80,0,0,255,255,1586,1467,1160,1111,7,6,4065.77,3760.71,2.24,1.92
,0.0000,0.0000,3848370891,qDE,0:f:1f:3:f5:79,0:11:88:5:5d:1d,->,,1218134.039513,
RST,s[16]="GET/17789/aim/e",,0,0,124168,,,0x00d3,0x00d3,0x0000
1151432739.311116,1151432742.431802,1,3.120686,3.120686,142.58.211.84,205.188.21
2.249,tcp,59972,80,0,0,255,255,1586,1467,1160,1111,7,6,4065.773,3760.711,2.243,1
.923,0,0,229.97.122.203, v D     ,0:f:1f:3:f5:79,0:11:88:5:5d:1d,->,,1218134.04,
RST,s[16]="GET /17789/aim/e",,0,0,124168,,,0x00d3,0x00d3,0x0000,0x0000

2.0.6 bug (ports should be supressed)

sport 0
dport 0

line: 150642 fields in error: dport,sport,
1151432860.448561,1151433389.602865,1,529.154304,529.154304,10.10.10.10,255.255.
255.255,pri-,0,0,0,0,0,0,1170,0,600,0,15,0,17.69,0.00,0.03,0.00,0.0000,0.0000,38
48370891,q,0:9:ef:1:39:c1,ff:ff:ff:ff:ff:ff,->,,,INT,s[16]="WLANforwarding",,,,1
70682,,,0x0286,,0x0000
1151432860.448561,1151433389.602865,1,529.154304,529.154297,10.10.10.10,255.255.
255.255,pri-enc,,,0,,0,,1170,0,600,0,15,0,17.689,0.000,0.028,0.000,0,0,229.97.12
2.203, v       ,0:9:ef:1:39:c1,ff:ff:ff:ff:ff:ff,->,,,INT,s[16]="WLAN forwarding
 ",,,,170682,,,0x0286,,0x0000,

int to fp roundoff errors (2.0.6 is int, 3.0 is fp)


djit 73945.757215 73827.01

line: 208131 fields in error: djit,
1151433024.339674,1151433529.078258,1,504.738584,504.738584,142.58.62.247,66.36.
75.14,tcp,50664,80,0,0,255,255,4433,6353,225,2215,60,59,70.26,100.69,0.12,0.12,0
.0000,0.0000,3848370891,q,0:d:93:ea:6:66,0:11:88:5:5d:1d,->,,73945.757215,CON,s[
16]="GET/SERVICE/SQU",,0,27,246528,,,0x0282,0x0282,0x0000
1151433024.339674,1151433529.078258,1,504.738584,504.738586,142.58.62.247,66.36.
75.14,tcp,50664,80,0,0,255,255,4433,6353,225,2215,60,59,70.262,100.694,0.119,0.1
17,0,0,229.97.122.203, v       ,0:d:93:ea:6:66,0:11:88:5:5d:1d,->,,73827.01,CON,
s[16]="GET /SERVICE/SQU",,0,27,246528,,,0x0282,0x0282,0x0000,0x0000

srate 3018666666.67 3018666496.000

line: 233600 fields in error: srate,
1151433105.350181,1151433105.350187,1,0.000006,0.000006,142.58.160.80,156.26.176
.107,udp,26635,48056,0,0,128,0,2264,0,2172,0,2,0,3018666666.67,0.00,333333.33,0.
00,0.0000,0.0000,3848370891,q,0:12:3f:98:40:82,0:11:88:5:5d:1d,->,,,INT,s[16]=".
-?.S.....!.u.6.",,,,280338,,,0x8200,,0xbb94
1151433105.350181,1151433105.350187,1,0.000006,0.000006,142.58.160.80,156.26.176
.107,udp,26635,48056,0,,128,,2264,0,2172,0,2,0,3018666496.000,0.000,333333.312,0
.000,0,0,229.97.122.203, v       ,0:12:3f:98:40:82,0:11:88:5:5d:1d,->,,,INT,s[16
]=".-?.S.....!.u.6.",,,,280338,,,0x8200,,0xbb94,

and thats it out of some 360,000 records. When we re enable state and direction
checking things are a little more exciting, but not necessarily wrong :-)
(igmp isn't connected for instance):

line: 7 fields in error: dir,
1151432428.834980,1151432968.849102,1,540.014122,540.014122,142.58.206.16,142.58
.202.108,tcp,524,1434,0,0,128,128,4270036130,91141044,4095125356,4541942,3015703
,1493083,63258140.20,1350202.38,5584.49,2764.90,0.0007,0.0000,3848370891,qs,0:f:
1f:f8:c4:c1,0:11:88:5:5d:1d,?>,1278.000000,3716.553425,CON,s[16]=".Y....&!..:KLJ
j(",d[16]="DmdT...1........",21344,17520,8541,,,0x80ce,0x80ca,0xfee9
1151432428.834980,1151432968.849102,1,540.014122,540.014099,142.58.206.16,142.58
.202.108,tcp,524,1434,0,0,128,128,4270036130,91141044,4095125356,4541942,3015703
,1493083,63258144.000,1350202.375,5584.489,2764.896,0,0,229.97.122.203, vs
,0:f:1f:f8:c4:c1,0:11:88:5:5d:1d,<?>,1278.000000,3716.47,CON,s[16]=".Y....&!..:K
LJj(",d[16]="DmdT...1........",21344,17520,8541,,,0x80ce,0x80ca,0xfee9,0xfee9


line: 23 fields in error: dir,
1151432428.836459,1151433529.824857,1,1100.988398,1100.988398,142.58.155.79,142.
58.167.63,tcp,1030,445,0,0,255,255,7324703,34375869,3834611,30963787,60174,58829
,53222.74,249781.88,54.65,53.43,0.0299,0.0068,3848370891,q*,0:b:db:49:f6:39,0:11
:88:5:5d:1d,?>,31.787992,561892.517921,CON,s[16]="...;.SMB........",d[16]="...<.
SMB........",17520,16766,8549,,,0x0200,0x8200,0x93ab
1151432428.836459,1151433529.824857,1,1100.988398,1100.988403,142.58.155.79,142.
58.167.63,tcp,1030,445,0,0,255,255,7324703,34375869,3834611,30963787,60174,58829
,53222.742,249781.875,54.655,53.433,0,0,229.97.122.203, v*      ,0:b:db:49:f6:39
,0:11:88:5:5d:1d,<?>,31.541513,561892.47,CON,s[16]="...;.SMB........",d[16]="...
<.SMB........",17520,16766,8549,,,0x0200,0x8200,0x93ab,0x93ab

state TIM CON

line: 31 fields in error: state,dir,
1151432428.840442,1151433509.016300,1,1080.175858,1080.175858,142.58.235.103,142
.58.103.117,tcp,1660,445,0,0,128,0,580,0,0,0,10,0,4.30,0.00,0.01,0.00,0.0000,0.0
000,3848370891,q,0:14:22:56:d6:dd,0:11:88:5:5d:1d,<?>,,,TIM,,,0,0,756,,,0x8200,,
0xbdef
1151432428.840442,1151433509.016300,1,1080.175858,1080.175903,142.58.235.103,142
.58.103.117,tcp,1660,445,0,,128,,580,0,0,0,10,0,4.296,0.000,0.009,0.000,0,0,229.
97.122.203, v       ,0:14:22:56:d6:dd,0:11:88:5:5d:1d,?>,,,CON,,,0,,756,,,0x8200
,,0xbdef,

state CON INT

line: 42 fields in error: state,
1151432428.847329,1151432439.757887,1,10.910558,10.910558,142.58.200.252,224.0.0
.22,igmp,34,0,192,0,1,0,174,0,48,0,3,0,127.58,0.00,0.27,0.00,0.0000,0.0000,38483
70891,q,0:e0:81:20:c3:4c,1:0:5e:0:0:16,->,,,CON,s[16]=""...............",,,,8887
,,,0x0200,,0x0000
1151432428.847329,1151432439.757887,1,10.910558,10.910558,142.58.200.252,224.0.0
.22,igmp,,,192,,1,,174,0,48,0,3,0,127.583,0.000,0.275,0.000,0,0,229.97.122.203,
v       ,0:e0:81:20:c3:4c,1:0:5e:0:0:16,->,,,INT,s[16]=""...............",,,,888
7,,,0x0200,,0x0000,


line: 52 fields in error: dir,
1151432428.851530,1151433240.526740,1,811.675210,811.675210,142.58.71.99,142.58.
217.166,tcp,49152,1935,0,0,255,255,79657946,6850292,71822216,9962,111939,97719,7
85121.39,67517.57,137.91,120.39,0.0036,0.0000,3848370891,qs,0:11:24:a8:11:b2,0:1
1:88:5:5d:1d,?>,5055.000000,33915.787004,CON,s[16]="K.....h.".......",d[16]="...
...........%6",65535,34752,8586,,,0x0200,0x8288,0x8b92
1151432428.851530,1151433240.526740,1,811.675210,811.675232,142.58.71.99,142.58.
217.166,tcp,49152,1935,0,0,255,255,79657946,6850292,71822216,9962,111939,97719,7
85121.375,67517.562,137.911,120.392,0,0,229.97.122.203, vs      ,0:11:24:a8:11:b
2,0:11:88:5:5d:1d,<?>,5055.000000,33915.32,CON,s[16]="K.....h.".......",d[16]=".
.............%6",65535,34752,8586,,,0x0200,0x8288,0x8b92,0x8b92


Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada
-------------- next part --------------
A non-text attachment was scrubbed...
Name: count.tcp
Type: application/octet-stream
Size: 216 bytes
Desc: not available
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20060913/4ff8e23e/attachment.obj>


More information about the argus mailing list