argus

Argus - Network Flow Monitoring System

Argus (Audit Record Generation and Utilization System) is the original network flow monitoring technology, developed since 1984. It generates comprehensive network flow data from raw packet captures for network operations, security analysis, performance monitoring, and forensics.

Overview

Argus is a comprehensive network transaction auditing tool that:

• Processes raw packet data from network interfaces or capture files
• Generates detailed network flow records with extensive metrics
• Supports bi-directional and uni-directional flow tracking
• Accounts for all network activity (not just IP traffic)
• Provides data suitable for real-time analysis and historical forensics
• Enables AI/ML-based network analysis with rich feature sets

Key Features

• Comprehensive Protocol Support: Layer 2-7 protocol analysis including IPv4/IPv6, TCP, UDP, ICMP, ARP, routing protocols (ISIS), and encapsulation protocols (VXLAN, GRE, Geneve, MPLS, VLAN)
• Advanced Metrics: Packet dynamics, jitter, throughput, application byte metrics, keystroke detection
• Flexible Flow Keys: Configurable flow aggregation strategies (5-tuple, Layer 2 matrix, custom keys)
• Scalable Deployment: Proven at scale from 1G to 100G+ networks
• Cross-Platform: Ported to Linux, macOS, BSD, Solaris, AIX, HPUX, VxWorks, and more
• Secure: Supports SASL authentication and TCP wrappers for access control

Quick Start

Installation

Prerequisites:

• libpcap (packet capture library)
• flex and bison (parser generators)
• C compiler (gcc/clang)
• zlib development libraries

Build from source:

# Install dependencies (Ubuntu/Debian)
sudo apt-get install build-essential libpcap-dev flex bison zlib1g-dev

# Install dependencies (Fedora/RHEL)
sudo dnf install gcc make libpcap-devel flex bison zlib-devel

# Build Argus
./configure
make
sudo make install

See INSTALL for detailed installation instructions.

Basic Usage

# Monitor a network interface
sudo argus -i eth0 -w /var/log/argus/data.argus

# Read from pcap file
argus -r capture.pcap -w output.argus

# View flow data with ra (from argus-clients package)
ra -r /var/log/argus/data.argus | head

# Filter specific traffic
argus -i eth0 proto tcp -w tcp.flow.argus

Configuration

Create /etc/argus.conf: