[ARGUS] ARGUS_INTERFACE aliases?

[Nathan Hardy]

Carter,

Thanks, I'll try using ind in the future.

With "bond", I can run ra and see both interfaces at once, is that possible
with "ind"?

Nathan

On Thu, Sep 12, 2024 at 7:42 AM Carter Bullard <carter at qosient.com> wrote:

> Hey Nathan,
> OK, so a few things …
>
> With the bond directive, there is only one “srcid” that is assigned to the
> bonded interface.
> The bond directive is designed to tell argus how multiple interfaces
> should be processed to create a single bonded interface.
> You do this when you’ve striped a link into multiple physical links, and
> you want to track them like they were a single interface.
> There is a lot of this in core networks, for redundancy, load balancing
> and bandwidth extension, etc ...
>
> So, the syntax for the bond: directive is:
>    ARGUS_INTERFACE=bond:eno1,eno2/srcid
>
> Looks to me, based on your alias names, that you would want something like
> this:
>    ARGUS_INTERFACE=ind:eno1/“WAN"
>    ARGUS_INTERFACE=ind:eno2/“LAN”
>
> Here you have something like interface eno1 “sees" the outward facing
> full-duplex (ingress+egress) packets, and argus would label all those flows
> “WAN”, and eno2 is the inward facing full-duplex interface.  If this is the
> case, give the 2 definition strategy a try to see how it’s working … if
> not, let’s discuss what you’re trying to do with the bond assignment.
>
> If eno1 receives the outbound packet mirror from a switch or router
> interface, and eno2 receives the inbound mirrored packets, you should use
> bond, but with a single srcid, maybe “ROU” …
> Internally argus tracks which interface packets come from as ‘in’ and
> ‘out', so we could keep track of the in and out status but it gets
> confusing when trying to stack these conditions when putting bi-directional
> flows together.  That is another conversation that we can have.
>
> I’m going through the code today, to make sure that all the interface
> configuration variations are working.
>
> Hope all is most excellent,
>
> Carter
>
>
> > On Sep 11, 2024, at 1:35 PM, Nathan Hardy <nathan.hardy at imsar.com>
> wrote:
> >
> > Hello,
> >
> > How can I create aliases (in /etc/argus.conf) for interfaces (it doesn't
> seem possible in the new version of argus)?
> >
> > For example (this doesn't work):
> >
> > ARGUS_INTERFACE=bond:eno1/"WAN",eno2/"LAN"
> >
> > Is there a new syntax? I prefer to see srcid/alias instead of srcid/inf.
> >
> > Thanks,
> >
> > Nathan
> > _______________________________________________
> > argus mailing list
> > argus at qosient.com
> >
> https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fpairlist1.pair.net%2fmailman%2flistinfo%2fargus&c=E,1,7Zt5BAt4O0nCXuQtNJMHuMyKWdAkKRZWEpsFnZLtGMEdQADGaVLXxNzV4mHx5jnYxojvUKAcm8-dz5OF7_VxcORhNOU1RWb0H_ByX-qNtg,,&typo=1
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20240912/0f7f72ae/attachment.htm>