What is Argus?
Argus is an IP audit tool, by that I mean a tool for recording and analyzing IP traffic at some point in the network. It has a client server architecture where the server runs on a box that in normally listening to the network in promiscuous mode. The server produces a compact audit trail of the traffic it observes on the network, this may be written to disk and/or to a socket. Argus uses the concept of flows where a flow is a collection of traffic between two end points. eg tcp session, udp traffic between two addresses and ports (delimited by timeout), ping stream, etc. What does Argus record? Short answer is lots of stuff 🙂 Address data, start and end time of flows, bytes and packets, window sizes, TTLs etc. Here is an xml representation of a argus record of a tcp session:
