Argus Clients - Network Flow Analysis Tools

Argus Clients is the companion tool suite for Argus (Audit Record Generation and Utilization System), the original network flow monitoring technology, developed since 1984. This package contains the programs that read, collect, parse, graph, store, filter, compare, archive, process, and manage the network flow data generated by the Argus sensor.

Overview

The Argus clients:

• Read, filter, and print Argus flow data from files or live network connections (ra)
• Aggregate and cluster flow records by arbitrary keys (racluster)
• Summarize and profile network behavior over time (rabehave)
• Split/stream flow-record output into time- or count-based blocks (rastream)
• Distribute flow data to multiple downstream consumers (radium)
• Archive, label, anonymize, and convert flow data between formats
• Support real-time analytic pipelines as well as historical forensic analysis

Key Tools

• ra — print and filter Argus flow records
• racluster — aggregate/cluster flow records by configurable keys
• radium — flow-data distribution server (fan-out to multiple clients)
• radump — dump Argus records in a low-level, diagnostic format
• ralabel — apply labels (e.g. GeoIP, custom tags) to flow records
• ranonymize — anonymize sensitive fields in flow records
• raconvert — convert between Argus record versions/formats

See man/ for the complete set of client tools and their man pages.

Quick Start

Installation

Prerequisites:

• A running or planned Argus sensor (to generate flow data), or existing .argus capture files
• zlib development libraries
• flex and bison (parser generators)
• C compiler (gcc/clang)
• Optional: readline, libmaxminddb (GeoIP labeling), MySQL client libraries (ramysql/rasql* tools), SASL (authenticated radium connections)

Build from source:

# Install dependencies (Ubuntu/Debian)
sudo apt-get install build-essential zlib1g-dev libreadline-dev flex bison libmaxminddb-dev

# Install dependencies (macOS via Homebrew)
brew install zlib readline libmaxminddb

# Build Argus clients
./configure
make
sudo make install

See INSTALL for detailed installation instructions, including optional MySQL and SASL support.

Basic Usage

# Print flow records from a file
ra -r data.argus

# Print flow records from a live radium/argus feed
ra -S host:561

# Cluster flows by 5-tuple
racluster -r data.argus -m saddr daddr proto sport dport

# Dump low-level record structure (diagnostic)
radump -r data.argus -v

Configuration

See ARCHITECTURE.md for an overview of the client library's design (record parsing, I/O, and the shared common/ code used by every tool), and the man page for each individual tool (e.g. man ra) for its own command-line options and config-file support.

Documentation

• ARCHITECTURE.md — client library design and code layout
• INSTALL — detailed build and installation instructions
• Man Pages — per-tool command reference
• Argus sensor repository — the companion packet-capture sensor that generates the flow data these tools consume

Support

Mailing Lists

• argus-info@lists.andrew.cmu.edu — general discussion and support
• argus-dev@lists.andrew.cmu.edu — development discussions

Bug Reports

Please use the ./bin/argusclientbug script to report issues:

./bin/argusclientbug

This collects system information and formats your report properly.

Important: Bug reports not generated with argusclientbug may be silently ignored. Please provide detailed information about your environment and the problem.

Community

• OpenArgus Website
• QoSient — project homepage

Security

Please see SECURITY.md for this project's vulnerability-reporting policy.

License

Argus Clients is released under the GNU General Public License v3.0 (GPL-3.0).

• See COPYING for the complete license text
• Other licensing options available through QoSient, LLC

Acknowledgments

Argus and its client tools have been supported and used by:

• US Department of Defense
• National Science Foundation (GLORIAD network)
• Carnegie Mellon University CERT
• Government and enterprise networks worldwide

Authors

• Carter Bullard — original creator and lead developer
• QoSient, LLC — current development and maintenance

For questions: argus@qosient.com

---

Comprehensive network transaction auditing — 40 years of innovation