argus-clients

Argus Clients - Network Flow Analysis Tools

Argus Clients is the companion tool suite for Argus (Audit Record Generation and Utilization System), the original network flow monitoring technology, developed since 1984. This package contains the programs that read, collect, parse, graph, store, filter, compare, archive, process, and manage the network flow data generated by the Argus sensor.

Overview

The Argus clients:

• Read, filter, and print Argus flow data from files or live network connections (ra)
• Aggregate and cluster flow records by arbitrary keys (racluster)
• Summarize and profile network behavior over time (rabehave)
• Split/stream flow-record output into time- or count-based blocks (rastream)
• Distribute flow data to multiple downstream consumers (radium)
• Archive, label, anonymize, and convert flow data between formats

• Support real-time analytic pipelines as well as historical forensic analysis

Key Tools

• ra — print and filter Argus flow records
• racluster — aggregate/cluster flow records by configurable keys
• radium — flow-data distribution server (fan-out to multiple clients)
• radump — dump Argus records in a low-level, diagnostic format
• ralabel — apply labels (e.g. GeoIP, custom tags) to flow records
• ranonymize — anonymize sensitive fields in flow records

• raconvert — convert between Argus record versions/formats

See man/ for the complete set of client tools and their man pages.

Quick Start

Installation

Prerequisites:

• A running or planned Argus sensor (to generate flow data), or existing .argus capture files
• zlib development libraries
• flex and bison (parser generators)
• C compiler (gcc/clang)
• Optional: readline, libmaxminddb (GeoIP labeling), MySQL client libraries (ramysql/rasql tools), SASL (authenticated radium connections)

Build from source:

# Install dependencies (Ubuntu/Debian)
sudo apt-get install build-essential zlib1g-dev libreadline-dev flex bison libmaxminddb-dev

# Install dependencies (macOS via Homebrew)
brew install zlib readline libmaxminddb

# Build Argus clients
./configure
make
sudo make install

See INSTALL for detailed installation instructions, including optional MySQL and SASL support.

Basic Usage