ARGUS(5)							File Formats Manual							  ARGUS(5)

NAME

       argus - IP Network Auditing Facility

COPYRIGHT

       Copyright (c) 2000-2004 QoSient. All rights reserved.

SYNOPSIS

       #include <[argus_dir]/include/argus_def.h>
       #include <[argus_dir]/include/argus_out.h>

DESCRIPTION

       The format of the argus(8) data stream is most succinctly described through the structures defined in the header file, but the general for-
       mat is as follows:

	      Argus File Format:
		 Argus_Datum Initial_Management_Record
		 Argus_Datum
		      .
		      .
		 Argus_Datum Management_Statistics
		 Argus_Datum
		      .
		      .

       where the individual data fields are defined as follows:

	      struct ArgusRecord {
		 unsigned char type, cause;
		 unsigned short length;
		 unsigned int status;
		 unsigned int argusid;
		 unsigned int seqNumber;

		 union {
		    struct ArgusMarStruct  mar;
		    struct ArgusFarStruct  far;
		 } ar_union;
	      };

	      struct ArgusMarStruct {
		 struct timeval startime, now;
		 unsigned char	major_version, minor_version;
		 unsigned char interfaceType, interfaceStatus;
		 unsigned short reportInterval, argusMrInterval;
		 unsigned int argusid, localnet, netmask, nextMrSequenceNum;
		 unsigned long long pktsRcvd, bytesRcvd;
		 unsigned int  pktsDrop, flows, flowsClosed;
		 unsigned int actIPcons,  cloIPcons;
		 unsigned int actICMPcons,  cloICMPcons;
		 unsigned int actIGMPcons,  cloIGMPcons;
		 unsigned int actFRAGcons,  cloFRAGcons;
		 unsigned int actSECcons,  cloSECcons;
		 int record_len;
	      };

	      struct ArgusFarStruct {
		 unsigned char type, length;
		 unsigned short status;

		 unsigned int ArgusTransRefNum;
		 struct ArgusTimeDesc time;
		 struct ArgusFlow flow;
		 struct ArgusAttributes attr;
		 struct ArgusMeter src, dst;
	      };

	      struct ArgusTimeDesc {
		 struct timeval start;
		 struct timeval last;
	      };

	      struct ArgusFlow {
		 union {
		    struct ArgusIPFlow	   ip;
		    struct ArgusICMPFlow icmp;
		    struct ArgusMACFlow   mac;
		    struct ArgusArpFlow   arp;
		    struct ArgusRarpFlow rarp;
		    struct ArgusESPFlow   esp;
		} flow_union;
	      };

	      struct ArgusIPAttributes {
		 unsigned short soptions, doptions;
		 unsigned char sttl, dttl;
		 unsigned char stos, dtos;
	      };

	      struct ArgusARPAttributes {
		 unsigned char response[8];
	      };

	      struct ArgusAttributes {
		 union {
		    struct ArgusIPAttributes   ip;
		    struct ArgusARPAttributes arp;
		 } attr_union;
	      };

	      struct ArgusMeter {
		 unsigned int count, bytes, appbytes;
	      };

	      struct ArgusIPFlow {
		 unsigned int ip_src, ip_dst;
		 unsigned char ip_p, tp_p;
		 unsigned short sport, dport;
		 unsigned short ip_id;
	      };

	      struct ArgusICMPFlow {
		 unsigned int ip_src, ip_dst;
		 unsigned char ip_p, tp_p;
		 unsigned char type, code;
		 unsigned short id, ip_id;
	      };

	      struct ArgusMACFlow {
		 struct ether_header ehdr;
		 unsigned char dsap, ssap;
	      };

	      struct ArgusArpFlow {
		 unsigned int arp_spa;
		 unsigned int arp_tpa;
		 unsigned char etheraddr[6];
		 unsigned short pad;
	      };

	      struct ArgusRarpFlow {
		 unsigned int arp_tpa;
		 unsigned char srceaddr[6];
		 unsigned char tareaddr[6];
	      };

	      struct ArgusESPFlow {
		 unsigned int ip_src, ip_dst;
		 unsigned char ip_p, tp_p;
		 unsigned short pad;
		 unsigned int spi;
	      };

SEE ALSO

       argus(8),

								   23 June 2000 							  ARGUS(5)