argus-3.0.7.5 and argus-clients-3.0.7.18 on the server

Jesper Skou Jensen jesper.skou.jensen at uni-c.dk
Tue Nov 26 09:18:47 EST 2013


Hi,

MAYBE my Argus wasn't compiled right?

I took a copy of the build from this morning and compared with a "make 
clean; configure; make" fresh build and the the bin/argus file hasn't 
got the same md5sum. Though a "make clean; make" produces the same sum 
as the one from this morning.

The only difference I've made, is to install that zlib-dev package to 
get the argus-clients to compile right.

Regards
Jesper


On 26-11-2013 15:09, Jesper Skou Jensen wrote:
> Hi again,
>
> I'm running Argus on a Ubuntu 12.04 64bit box.
>
> I have made a few more tests.
>
> :~# rabins -m proto -M hard 1s -r new.ra_tcp -w new.ra.rabins
>
> :~# ra -c, -r new.ra.rabins
> StartTime,Proto,SrcAddr,Sport,Dir,DstAddr,Dport,TotPkts,TotBytes,State
> 2013-11-26 08:59:56.000000,tcp,0.0.0.0,*, ->,0.0.0.0,*,42,17092,RST
> 2013-11-26 08:59:57.000000,tcp,0.0.0.0,*, ->,0.0.0.0,*,13069,7146344,RST
> 2013-11-26 08:59:58.000000,tcp,0.0.0.0,*, ->,0.0.0.0,*,22153,13783222,RST
> 2013-11-26 08:59:59.000000,tcp,0.0.0.0,*, ->,0.0.0.0,*,22915,14183156,RST
> 2013-11-26 09:00:00.000000,tcp,0.0.0.0,*, ->,0.0.0.0,*,31132,24033624,RST
> 2013-11-26 09:00:01.000000,tcp,0.0.0.0,*, ->,0.0.0.0,*,39863,31041200,RST
> 2013-11-26 09:00:02.000000,tcp,0.0.0.0,*, ->,0.0.0.0,*,39192,29982877,RST
> 2013-11-26 09:00:03.000000,tcp,0.0.0.0,*, ->,0.0.0.0,*,41933,32736196,RST
> 2013-11-26 09:00:04.000000,tcp,0.0.0.0,*, 
> ->,0.0.0.0,*,1425771,27906492,RST
> 2013-11-26 09:00:05.000000,tcp,0.0.0.0,*, 
> ->,0.0.0.0,*,1506384,29238753,RST
> 2013-11-26 09:00:06.000000,tcp,0.0.0.0,*, 
> ->,0.0.0.0,*,1507208,30738591,RST
> [and so on until the counter goes completely haywire]
> 2013-11-26 09:12:48.000000,tcp,0.0.0.0,*, 
> ->,0.0.0.0,*,797794923,60552173,RST
> 2013-11-26 09:12:49.000000,tcp,0.0.0.0,*, 
> ->,0.0.0.0,*,524708445,57910501,RST
> 2013-11-26 09:12:50.000000,tcp,0.0.0.0,*, 
> ->,0.0.0.0,*,481074976,56542127,RST
> 2013-11-26 09:12:51.000000,tcp,0.0.0.0,*, 
> ->,0.0.0.0,*,468298779,59030688,RST
> 2013-11-26 09:12:52.000000,tcp,0.0.0.0,*, 
> ->,0.0.0.0,*,468296156,55605938,RST
> 2013-11-26 09:12:53.000000,tcp,0.0.0.0,*, 
> ->,0.0.0.0,*,468296374,56253772,RST
> 2013-11-26 09:12:54.000000,tcp,0.0.0.0,*, 
> ->,0.0.0.0,*,1865562720437464,1127008872225385,RST
> 2013-11-26 09:12:55.000000,tcp,0.0.0.0,*, 
> ->,0.0.0.0,*,441135061,59037550,RST
> 2013-11-26 09:12:56.000000,tcp,0.0.0.0,*, 
> ->,0.0.0.0,*,2661123791534017,3460172017613613187,RST
> 2013-11-26 09:12:57.000000,tcp,0.0.0.0,*, 
> ->,0.0.0.0,*,441134997,58596098,RST
> 2013-11-26 09:12:58.000000,tcp,0.0.0.0,*, 
> ->,0.0.0.0,*,2656678500379720,101051059395042031,RST
> 2013-11-26 09:12:59.000000,tcp,0.0.0.0,*, 
> ->,0.0.0.0,*,441137631,59840956,RST
> 2013-11-26 09:13:00.000000,tcp,0.0.0.0,*, 
> ->,0.0.0.0,*,1188814894848872,182960092986404660,RST
> 2013-11-26 09:13:01.000000,tcp,0.0.0.0,*, 
> ->,0.0.0.0,*,431265690,58555620,RST
> 2013-11-26 09:13:02.000000,tcp,0.0.0.0,*, 
> ->,0.0.0.0,*,424319640,58103639,RST
> 2013-11-26 09:13:03.000000,tcp,0.0.0.0,*, 
> ->,0.0.0.0,*,421342441,58419207,RST
> [and towards the end of the file]
> 2013-11-26 09:14:49.000000,tcp,0.0.0.0,*, 
> ->,0.0.0.0,*,8444761242380627,292738444997133411,RST
> 2013-11-26 09:14:50.000000,tcp,0.0.0.0,*, 
> ->,0.0.0.0,*,644919965942377,187465359791945283,RST
> 2013-11-26 09:14:51.000000,tcp,0.0.0.0,*, 
> ->,0.0.0.0,*,2977851434645235,101051059372919085,RST
> 2013-11-26 09:14:52.000000,tcp,0.0.0.0,*, 
> ->,0.0.0.0,*,578738536163405,94014215023230728,RST
> 2013-11-26 09:14:53.000000,tcp,0.0.0.0,*, 
> ->,0.0.0.0,*,1642641127088000,288798147512237978,RST
> 2013-11-26 09:14:54.000000,tcp,0.0.0.0,*, 
> ->,0.0.0.0,*,473597999054701,195629066118682560,RST
> 2013-11-26 09:14:55.000000,tcp,0.0.0.0,*, 
> ->,0.0.0.0,*,4261291262971956,289923927150221213,RST
> 2013-11-26 09:14:56.000000,tcp,0.0.0.0,*, 
> ->,0.0.0.0,*,3977501532263536,100491747284477729,RST
> 2013-11-26 09:14:57.000000,tcp,0.0.0.0,*, 
> ->,0.0.0.0,*,2533043399182272,193657959585547021,RST
> 2013-11-26 09:14:58.000000,tcp,0.0.0.0,*, 
> ->,0.0.0.0,*,2735894436062247,565715921474337,RST
> 2013-11-26 09:14:59.000000,tcp,0.0.0.0,*, 
> ->,0.0.0.0,*,3900865928893536,198161408877067769,RST
>
> It looks like it's never resetting the bytes/packet counter?
>
> When looking at the new.ra Argus log file, everything appears to be 
> just fine.
>
>
> PS. I'm running Argus with fairly standard options, but maybe -S 
> option is what confuses the new Argus?
> argus -i eth1 -P 561 -S 5 -e 1 -w /var/log/argus.log
>
>
> Regards
> Jesper
>
>
> On 26-11-2013 14:49, Carter Bullard wrote:
>> Hey Chris,
>> I've been running many combinations of  old vs new and I'm not seeing 
>> anything a miss, but all you need is one.
>>
>> Carter
>>
>>> On Nov 26, 2013, at 8:43 AM, Chris Wakelin 
>>> <c.d.wakelin at reading.ac.uk> wrote:
>>>
>>> I've been running 3.0.7.5 / 3.0.7.18 (replacing 3.0.7.4 / 3.0.7.16) on
>>> the student network for about an hour. Seems OK to me, with
>>> racount/ratop behaving as expected.
>>>
>>> Best Wishes,
>>> Chris
>>>
>>>> On 26/11/13 13:22, Carter Bullard wrote:
>>>> Hey Jesper,
>>>> This is why we have to test and test and test :O(
>>>> Something must have crept into the code, as other bizarreness is 
>>>> being reported. However, I am not seeing anything odd.  What 
>>>> machine type and OS are you using ???
>>>>
>>>> Did you print out any records to see if all were corrupt, or only 
>>>> one ??
>>>>
>>>> Can you send a sample argus-3.0.5 output file with the bad TCP 
>>>> data??  If you have a packet file that generates the corrupt data, 
>>>> can you share ???
>>>>
>>>> Sorry, shouldn't be hard to fix.
>>>>
>>>> Carter
>>>>
>>>>
>>>>> On Nov 26, 2013, at 7:13 AM, Jesper Skou Jensen 
>>>>> <jesper.skou.jensen at uni-c.dk> wrote:
>>>>>
>>>>> Now that my compiling issues are fixed, I've moved on to testing 
>>>>> the new Argus and clients.
>>>>>
>>>>> I'm getting some funky results with eg. racount, but ragraph is 
>>>>> weird too I think and maybe more ra-clients that I haven't tested 
>>>>> with. It looks like an issue with the Argus server and TCP packets.
>>>>>
>>>>> Test with argus file written earlier today with Argus version 3.0.7.3
>>>>> :~# racount -r old.ra
>>>>> racount   records     total_pkts     src_pkts dst_pkts 
>>>>> total_bytes        src_bytes          dst_bytes
>>>>>    sum   4039147     58347562       36023110 22324452 
>>>>> 38558018790        8629875276         29928143514
>>>>>
>>>>> Test with argus file written just now with Argus version 3.0.7.5
>>>>> :~# racount -r new
>>>>> racount   records     total_pkts     src_pkts dst_pkts 
>>>>> total_bytes        src_bytes          dst_bytes
>>>>>    sum   4784540     228845934958855649 218118303098026684 
>>>>> 10727631860828965 -6720755720319015608 -7008709186520164355 
>>>>> 287953466201148747
>>>>>
>>>>> :~# racount -r new - not tcp
>>>>> racount   records     total_pkts     src_pkts dst_pkts 
>>>>> total_bytes        src_bytes          dst_bytes
>>>>>    sum   2852715     23749856       19396421       4353435 
>>>>> 4238739977         3599987646         638752331
>>>>>
>>>>> :~# racount -r new - tcp
>>>>> racount   records     total_pkts     src_pkts dst_pkts 
>>>>> total_bytes        src_bytes          dst_bytes
>>>>>    sum   1931826     228845934935105793 218118303078630263 
>>>>> 10727631856475530 -6720755724557755585 -7008709190120152001 
>>>>> 287953465562396416
>>>>>
>>>>>
>>>>> Regards
>>>>> Jesper
>>>>>
>>>>>> On 25-11-2013 18:46, Carter Bullard wrote:
>>>>>> Gentle people,
>>>>>> New software is available on the developers site.  This is a big 
>>>>>> push
>>>>>> to release, and the packages fix all bugs reported to the mailing 
>>>>>> list.
>>>>>> Argus fixes some direction issues with ARP transactions, and the 
>>>>>> clients
>>>>>> fix a number of issues with filters, radium management records, and
>>>>>> adds xz decompression for argus data files.  Many changes to 
>>>>>> manpages,
>>>>>> and there should be new scripts for updating IANA RIR data fetching,
>>>>>> to maintain the delegated ip address tables.   There is 
>>>>>> improvement in
>>>>>> GeoIP database use, with some extensions added based on changes in
>>>>>> the API.  The code is in the standard places:
>>>>>>
>>>>>>    http://qosient.com/argus/dev/argus-latest.tar.gz
>>>>>> http://qosient.com/argus/dev/argus-clients-latest.tar.gz
>>>>>>
>>>>>> Please give these a run, and if there are any problems, get those
>>>>>> complaints in there, so we can release 3.0.8 by the end of the year.
>>>>>>
>>>>>> Hope all is most excellent,
>>>>>>
>>>>>> Carter
>>>
>>> -- 
>>> --+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+- 
>>>
>>> Christopher Wakelin, c.d.wakelin at reading.ac.uk
>>> IT Services Centre, The University of Reading,  Tel: +44 (0)118 378 
>>> 2908
>>> Whiteknights, Reading, RG6 6AF, UK              Fax: +44 (0)118 975 
>>> 3094
>>>
>




More information about the argus mailing list