Argus Clients is the companion tool suite for Argus (Audit Record Generation and Utilization System), the original network flow monitoring technology, developed since 1984. This package contains the programs that read, collect, parse, graph, store, filter, compare, archive, process, and manage the network flow data generated by the Argus sensor.
The Argus clients:
- Read, filter, and print Argus flow data from files or live network connections (
ra) - Aggregate and cluster flow records by arbitrary keys (
racluster) - Summarize and profile network behavior over time (
rabehave) - Split/stream flow-record output into time- or count-based blocks (
rastream) - Distribute flow data to multiple downstream consumers (
radium) - Archive, label, anonymize, and convert flow data between formats
- Support real-time analytic pipelines as well as historical forensic analysis
ra— print and filter Argus flow recordsracluster— aggregate/cluster flow records by configurable keysradium— flow-data distribution server (fan-out to multiple clients)radump— dump Argus records in a low-level, diagnostic formatralabel— apply labels (e.g. GeoIP, custom tags) to flow recordsranonymize— anonymize sensitive fields in flow recordsraconvert— convert between Argus record versions/formats
See man/ for the complete set of client tools and their man pages.
Prerequisites:
- A running or planned Argus sensor (to generate flow data), or existing
.arguscapture files - zlib development libraries
- flex and bison (parser generators)
- C compiler (gcc/clang)
- Optional: readline, libmaxminddb (GeoIP labeling), MySQL client libraries (
ramysql/rasql*tools), SASL (authenticatedradiumconnections)
Build from source:
# Install dependencies (Ubuntu/Debian)
sudo apt-get install build-essential zlib1g-dev libreadline-dev flex bison libmaxminddb-dev
# Install dependencies (macOS via Homebrew)
brew install zlib readline libmaxminddb
# Build Argus clients
./configure
make
sudo make installSee INSTALL for detailed installation instructions, including optional MySQL and SASL support.
# Print flow records from a file
ra -r data.argus
# Print flow records from a live radium/argus feed
ra -S host:561
# Cluster flows by 5-tuple
racluster -r data.argus -m saddr daddr proto sport dport
# Dump low-level record structure (diagnostic)
radump -r data.argus -vSee ARCHITECTURE.md for an overview of the client library's design (record parsing, I/O, and the shared common/ code used by every tool), and the man page for each individual tool (e.g. man ra) for its own command-line options and config-file support.
- ARCHITECTURE.md — client library design and code layout
- INSTALL — detailed build and installation instructions
- Man Pages — per-tool command reference
- Argus sensor repository — the companion packet-capture sensor that generates the flow data these tools consume
- argus-info@lists.andrew.cmu.edu — general discussion and support
- argus-dev@lists.andrew.cmu.edu — development discussions
Please use the ./bin/argusclientbug script to report issues:
./bin/argusclientbugThis collects system information and formats your report properly.
Important: Bug reports not generated with argusclientbug may be silently ignored. Please provide detailed information about your environment and the problem.
- OpenArgus Website
- QoSient — project homepage
Please see SECURITY.md for this project's vulnerability-reporting policy.
Argus Clients is released under the GNU General Public License v3.0 (GPL-3.0).
- See COPYING for the complete license text
- Other licensing options available through QoSient, LLC
Argus and its client tools have been supported and used by:
- US Department of Defense
- National Science Foundation (GLORIAD network)
- Carnegie Mellon University CERT
- Government and enterprise networks worldwide
- Carter Bullard — original creator and lead developer
- QoSient, LLC — current development and maintenance
For questions: argus@qosient.com
Comprehensive network transaction auditing — 40 years of innovation