Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am setting up a trial of Argus at my company as a diagnostic tool. We have a collector box attached to a monitoring port on our switch, and the initial plan is to redirect ports with unusual traffic to the collector and then analyze it to get troubleshooting info. I need to sell this before I can pitch a more consistent monitoring solution, which I know is the real strength of this type of application.

The initial reports will be all on the command line, so reducing the information presented to a manageable level is key.

My question is this: From both a security and troubleshooting point of view, what information would be most valuable? What reports should I have preconfigured?

I have already thought of: Listing of address currently talking on the port (our network map is horrible), Protocol distribution, and current flows for a specific IP.

Maybe one on packet loss or broken connections? (not sure if I can do that last one)

Also if you think this should be a community wiki just leave a comment and I'll swap it over.

Thanks, I wish I had the background to answer this, but I'm working hard to get there.

share|improve this question

1 Answer 1

up vote 1 down vote accepted

As a first step I would recommend looking at the "official" Argus wiki page. It is largely a cookbook page that gives some great examples of the kinds of queries that can be run using the tools suite. Also worth browsing is the argus mailing list. Often interesting uses of the product are shared there.

Additionally, my office has produced a number of scripts that work on the output from the 'ra' command. The ones I use most often produce the top $n src addresses by flow count, or byte count. Some others that produce addresses communicating with known botnet C&Cs.

share|improve this answer
    
"Some others that produce addresses communicating with known botnet C&Cs." - this is exactly the kind of idea I was looking for! I'm already implementing some custom scripts along the lines of what you mentioned earlier. I'm also currently trying to get the daily records into mysql, but I'm getting a syntax error on the table creation. –  Chance Oct 9 '09 at 15:34
    
Actually, they just released an updated 3.0.2 clients with some bug fixes that fixed my problem. Now if I could just get ragraph to use more than one color.. :) –  Chance Oct 9 '09 at 16:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.