[ARGUS] ARGUS_INTERFACE aliases?

[Carter Bullard]

Hey Nathan,
OK, so a few things …

With the bond directive, there is only one “srcid” that is assigned to the bonded interface.
The bond directive is designed to tell argus how multiple interfaces should be processed to create a single bonded interface.
You do this when you’ve striped a link into multiple physical links, and you want to track them like they were a single interface.
There is a lot of this in core networks, for redundancy, load balancing and bandwidth extension, etc ...

So, the syntax for the bond: directive is:
   ARGUS_INTERFACE=bond:eno1,eno2/srcid

Looks to me, based on your alias names, that you would want something like this:
   ARGUS_INTERFACE=ind:eno1/“WAN"
   ARGUS_INTERFACE=ind:eno2/“LAN”

Here you have something like interface eno1 “sees" the outward facing full-duplex (ingress+egress) packets, and argus would label all those flows “WAN”, and eno2 is the inward facing full-duplex interface.  If this is the case, give the 2 definition strategy a try to see how it’s working … if not, let’s discuss what you’re trying to do with the bond assignment.

If eno1 receives the outbound packet mirror from a switch or router interface, and eno2 receives the inbound mirrored packets, you should use bond, but with a single srcid, maybe “ROU” …
Internally argus tracks which interface packets come from as ‘in’ and ‘out', so we could keep track of the in and out status but it gets confusing when trying to stack these conditions when putting bi-directional flows together.  That is another conversation that we can have.

I’m going through the code today, to make sure that all the interface configuration variations are working.

Hope all is most excellent,

Carter


> On Sep 11, 2024, at 1:35 PM, Nathan Hardy <nathan.hardy at imsar.com> wrote:
> 
> Hello,
> 
> How can I create aliases (in /etc/argus.conf) for interfaces (it doesn't seem possible in the new version of argus)?
> 
> For example (this doesn't work):
> 
> ARGUS_INTERFACE=bond:eno1/"WAN",eno2/"LAN"
> 
> Is there a new syntax? I prefer to see srcid/alias instead of srcid/inf.
> 
> Thanks,
> 
> Nathan
> _______________________________________________
> argus mailing list
> argus at qosient.com
> https://pairlist1.pair.net/mailman/listinfo/argus

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 1385 bytes
Desc: not available
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20240912/778cc391/attachment.bin>