Comments on: argus - Auditing Network Activity - Performance & Status Monitoring

By: eM3rC

eM3rC — Thu, 07 Feb 2008 07:56:26 +0000

Really helpful stuff for an admin.

Could this be somehow remotely installed into a server so you can monitor everything going over a network?

By: mumble

mumble — Tue, 29 Jan 2008 14:53:28 +0000

In general, as a systems admin, I’m used to being in charge of the availability part. In the real world (of not penetration testing) the causes of downtime are normally things like dead PSUs, bad switches, dead NICs, bad software updates, database corruption, bad juju, phase of the moon, upstream routing BS…..

This is a very useful tool for looking at bandwidth, flows, traffic/responsiveness, etc. I usually see that work as being mora a sysad’s job that a SA’s job. Given where I’m coming from, that’s reasonably sane…..

By: Bogwitch

Bogwitch — Tue, 29 Jan 2008 13:59:39 +0000

From a security POV, there are three main aspects for security, Confidentiality, Integrity and Availability. This tool can help with all but particularly the latter two.
Security is not all about penetration testing!

By: Darknet

Darknet — Sun, 27 Jan 2008 18:48:56 +0000

Well as a sys admin you should know if someone untoward goes down it’s you they are gonna ask to prove/disprove it from a technical standpoint.

If you don’t have records you are screwed That’s why this is in forensics category.

And networking is a fundamental part of security anyway especially from an understand point of view, on top of that from a monitoring point - you can find anomalies which can point to deeper problems, and from a intrusion response angle - records are golden. Thats why we advocate the use of syslog-ng on a separate server

By: Pantagruel

Pantagruel — Sun, 27 Jan 2008 17:21:49 +0000

@mumble, indeed the security edge seems to be missing but rumble gives ample reply to the use of Argus. We use it to map network flow and use the logs to analyze why and when network congestion occurs. The fact that it is modest regarding record size while generating extensive data is definitely a plus.

By: rumble

rumble — Sun, 27 Jan 2008 01:14:26 +0000

argus records are cheap to store, and they can be used for a lot of security-related things: building flow records between servers, mining flows for unusual communication patterns, mining historical traffic patterns, etc. We can cram about a year’s worth of all activity on our 20Mbps internet perimeter into about 20 gig or so worth of uncompressed argus logs. makes for some interesting hunting. Argus records are good for answering rate/direction/historical context questions. Ie.g. have you ever seen this host initiate a tcp connection to that host (or any host in that network), and has there ever been more data transferred out than in?

By: mumble

mumble — Sat, 26 Jan 2008 23:33:44 +0000

Someone tell me what I’m missing here. As a systems administrator, I can see a lot of value in tracking the performance of Internet transactions. What I don’t see are the security uses for this tool. Am I brain-damaged today?