Article 2691 of comp.sources.unix:
Path: nntpd.lkg.dec.com!crl.dec.com!crl.dec.com!caen!reeve.research.aa.wl.com!decwrl!news1.digital.com!vixie!vixie!not-for-mail
From: argus@SEI.CMU.EDU
Newsgroups: comp.sources.unix
Subject: v29i035: argus-1.5 - a generic IP network transaction auditing tool, Part05/06
Date: 16 Oct 1995 23:07:04 -0700
Organization: Vixie Enterprises
Lines: 2962
Sender: vixie@vix.com
Approved: vixie@gw.home.vix.com
Message-ID: <45vh68$22b@gw.home.vix.com>
References: <1.813909952.2078@gw.home.vix.com>
NNTP-Posting-Host: gw.home.vix.com

Submitted-By: argus@SEI.CMU.EDU
Posting-Number: Volume 29, Issue 35
Archive-Name: argus-1.5/part05

#!/bin/sh
# This is `part05' (part 5 of a multipart archive).
# Do not concatenate these parts, unpack them in order with `/bin/sh'.
# File `argus-1.5/server/cons_udp.c' is being continued...
#
touch -am 1231235999 $$.touch >/dev/null 2>&1
if test ! -f 1231235999 && test -f $$.touch; then
  shar_touch=touch
else
  shar_touch=:
  echo
  echo 'WARNING: not restoring timestamps.  Consider getting and'
  echo "installing GNU \`touch', distributed in GNU File Utilities..."
  echo
fi
rm -f 1231235999 $$.touch
#
if test ! -r _sharseq.tmp; then
  echo 'Please unpack part 1 first!'
  exit 1
fi
shar_sequence=`cat _sharseq.tmp`
if test "$shar_sequence" != 5; then
  echo "Please unpack part $shar_sequence next!"
  exit 1
fi
if test ! -f _sharnew.tmp; then
  echo 'x - still skipping argus-1.5/server/cons_udp.c'
else
  echo 'x - continuing file argus-1.5/server/cons_udp.c'
  sed 's/^X//' << 'SHAR_EOF' >> 'argus-1.5/server/cons_udp.c' &&
X      *rev = 0;
X   }
X}
X
Xadjust_group_port (sport, dport)
Xunsigned short *sport, *dport;
X{
X   int is_src_server = 0, is_dst_server = 0;
X   extern unsigned short *udpServicePorts;
X   unsigned short *ptr = udpServicePorts, *end = NULL;
X 
X   if (ptr && *ptr) {
X      do {
X         if (*sport == *ptr) is_src_server = 1;
X         if (*dport == *ptr) is_dst_server = 1;
X         ptr++;
X      } while (*ptr);
X
X      if ((is_src_server || is_dst_server) &&
X                              !(is_src_server && is_dst_server)) {
X         if (is_src_server) *dport = 0;
X         if (is_dst_server) *sport = 0;
X      }
X   }
X}
X
X
Xupdate_udp_record (uh, ep, up, length, tvp, rev)
Xstruct UDP_OBJECT *uh;
Xstruct ether_header *ep;
Xstruct udphdr *up;
Xint length;
Xstruct timeval *tvp;
Xint rev;
X{
X   struct udpcb *udpCb;
X
X   udpCb = &uh->udp_cb;
X   udpCb->lasttime = *tvp; uh->qhdr.last_time = *tvp;
X   if (udpCb->rev == rev) {
X      udpCb->src.count++;
X      udpCb->src.bytes += length;
X   } else {
X      udpCb->dst.count++;
X      udpCb->dst.bytes += length;
X   }
X
X   if (udpCb->status & MODIFIED) {
X      if (!(udpCb->status & MULTIADDR)) {
X         if (rev) {
X            if (bcmp ((char *)&ep->ether_dhost,
X                    (char *)&uh->link.phys.ethersrc, 6) ||
X                bcmp ((char *)&ep->ether_shost,
X                    (char *)&uh->link.phys.etherdst, 6))
X               udpCb->status |= MULTIADDR;
X         } else
X            if (bcmp ((char *)&ep->ether_shost,
X                    (char *)&uh->link.phys.ethersrc, 6) ||
X                bcmp ((char *)&ep->ether_dhost,
X                    (char *)&uh->link.phys.etherdst, 6))
X               udpCb->status |= MULTIADDR;
X      }
X
X   } else {
X      if (rev) {
X         bcopy ((char *)&ep->ether_dhost, (char *)&uh->link.phys.ethersrc, 6);
X         bcopy ((char *)&ep->ether_shost, (char *)&uh->link.phys.etherdst, 6);
X      } else {
X         bcopy ((char *)&ep->ether_shost, (char *)&uh->link.phys.ethersrc, 6);
X         bcopy ((char *)&ep->ether_dhost, (char *)&uh->link.phys.etherdst, 6);
X      }
X   }
X
X   if ((udpCb->src.count + udpCb->dst.count) == 2)
X      udpCb->status |= CON_ESTABLISHED;
X
X   update_queue_status ((struct QUEUE_HEADER *) &uh->qhdr);
X   udpCb->status |= MODIFIED;
X
X   if (((tvp->tv_sec - udpCb->startime.tv_sec) > udptimeout) ||
X         (((udpCb->src.count == 1) && (udpCb->dst.count == 1)) &&
X              !(udpCb->status & LOGGED)))
X      log_udp_connection (uh, tvp, CON_ESTABLISHED);
X}
X 
X
Xint udpdeletecount = 0;
X
Xstatic void
Xdelete_udp (uh)
Xstruct UDP_OBJECT *uh;
X{
X   udpdeletecount++;
X   remove_hash_table_entry (&udp_hash_table, &uh->addr);
X   free (uh);
X}
X
X
Xstatic void
Xnew_udp_hash_entry (up, ep, rev, tvp, ip, tha, len)
Xstruct udphdr *up;
Xstruct ether_header *ep;
Xint rev;
Xstruct timeval *tvp;
Xstruct ip *ip;
Xstruct tha *tha;
Xint len;
X{
X   struct UDP_OBJECT *ptr = NULL;
X   struct udpcb *udpCb;
X
X   if (ptr = (struct UDP_OBJECT *) calloc (1, sizeof (*ptr))) {
X      udpCb = &ptr->udp_cb;
X      udpCb->status = UDPPROTO | UDP_INIT | MODIFIED;
X      if (ip) udpCb->status |= IPPROTO;
X      if (dflag) udpCb->status |= DETAIL;
X      udpCb->startime = *tvp;
X      udpCb->lasttime = *tvp;
X      if (udpCb->rev = rev) {
X         udpCb->status |= REVERSE;
X         bcopy ((char *)&ep->ether_dhost, (char *)&ptr->link.phys.ethersrc, 6);
X         bcopy ((char *)&ep->ether_shost, (char *)&ptr->link.phys.etherdst, 6);
X
X      } else {
X         bcopy ((char *)&ep->ether_shost, (char *)&ptr->link.phys.ethersrc, 6);
X         bcopy ((char *)&ep->ether_dhost, (char *)&ptr->link.phys.etherdst, 6);
X      }
X
X      ptr->qhdr.last_time = *tvp;
X      bcopy ((char *) tha, (char *) &ptr->addr, sizeof (*tha));
X
X      if (ip_options) { 
X         if (ip_rr)   udpCb->status |= RECORDROUTE; 
X         if (ip_ts)   udpCb->status |= TIMESTAMP;
X         if (ip_sec)  udpCb->status |= SECURITY; 
X         if (ip_lsrr) udpCb->status |= LSRCROUTE; 
X         if (ip_ssrr) udpCb->status |= SSRCROUTE; 
X         if (ip_satid) udpCb->status |= SATNETID; 
X      }
X
X      udpCb->src.count++;
X      udpCb->src.bytes += len;
X
X      if (add_to_queue (&udp_display_list, (struct QUEUE_HEADER *)&ptr->qhdr)) {
X         (void) add_hash_table_entry (&udp_hash_table, tha, ptr);
X         if (dflag) {
X            log_udp_connection (ptr, tvp, UDP_INIT);
X            udpCb->status &= ~LOGGED;
X         }
X      } else
X         delete_udp (ptr);
X   }
X}
X
X
X#include <sys/stat.h>
X#include <sys/errno.h>
X
Xvoid
Xlog_udp_connection (ptr, tvp, state)
Xstruct UDP_OBJECT *ptr;
Xstruct timeval *tvp;
Xint state;
X{
X   struct writeStruct output;
X
X   if (clienttags || wflag) {
X      if ((ptr->udp_cb.src.count || ptr->udp_cb.dst.count) &&
X              (ptr->udp_cb.status & MODIFIED)) {
X         output.startime =  ptr->udp_cb.startime;
X         output.lasttime =  ptr->udp_cb.lasttime;
X         output.status   =  ptr->udp_cb.status | state;
X         ptr->udp_cb.status &= ~MODIFIED;
X         ptr->udp_cb.status &= ~MULTIADDR;
X         output.addr     =  ptr->addr;
X         bcopy ((char *)&ptr->link.phys.ethersrc, (char *)&output.ethersrc, 6);
X         bcopy ((char *)&ptr->link.phys.etherdst, (char *)&output.etherdst, 6);
X         output.src_count = ptr->udp_cb.src.count - ptr->udp_cb.src.lastcount;
X         output.dst_count = ptr->udp_cb.dst.count - ptr->udp_cb.dst.lastcount;
X         output.src_bytes = ptr->udp_cb.src.bytes - ptr->udp_cb.src.lastbytes;
X         output.dst_bytes = ptr->udp_cb.dst.bytes - ptr->udp_cb.dst.lastbytes;
X         if ((output.src_count || output.src_bytes) || 
X                        (output.dst_count || output.dst_bytes)) {
X            if (ptr->udp_cb.status & state) {
X               writeOutData (&output);
X               ptr->udp_cb.status |= LOGGED;
X            }
X
X            if (!(dflag && (state & UDP_INIT)) &&
X                            (ptr->udp_cb.status & LOGGED)) {
X               ptr->udp_cb.src.lastcount = ptr->udp_cb.src.count;
X               ptr->udp_cb.src.lastbytes = ptr->udp_cb.src.bytes;
X               ptr->udp_cb.dst.lastcount = ptr->udp_cb.dst.count;
X               ptr->udp_cb.dst.lastbytes = ptr->udp_cb.dst.bytes;
X               ptr->udp_cb.startime = *tvp; ptr->udp_cb.lasttime = *tvp;
X            }
X         }
X      }
X   }
X
X   ptr->qhdr.logtime = *tvp;
X}
X   
X
Xvoid
Xcheck_udp_timeouts (ptr, tvp)
Xstruct UDP_OBJECT *ptr;
Xstruct timeval *tvp;
X{
X   int srccounts, dstcounts;
X
X   if ((tvp->tv_sec - ptr->udp_cb.lasttime.tv_sec) > udptimeout) {
X      if ((ptr->udp_cb.src.count || ptr->udp_cb.dst.count) &&
X                                    !(ptr->udp_cb.status & LOGGED)) {
X         ptr->udp_cb.status |= TIMED_OUT;
X         log_udp_connection (ptr, tvp, TIMED_OUT);
X      }
X      remove_from_queue (&udp_display_list,
X                          (struct QUEUE_HEADER *) &ptr->qhdr);
X      delete_udp (ptr);
X   } else {
X      if ((tvp->tv_sec - ptr->udp_cb.startime.tv_sec) > udptimeout) {
X         srccounts = (ptr->udp_cb.src.count - ptr->udp_cb.src.lastcount);
X         dstcounts = (ptr->udp_cb.dst.count - ptr->udp_cb.dst.lastcount);
X         if ((srccounts || dstcounts) &&
X                              (ptr->udp_cb.status & CON_ESTABLISHED)) {
X            log_udp_connection (ptr, tvp, CON_ESTABLISHED);
X            ptr->qhdr.last_time = *tvp;
X            update_queue_status ((struct QUEUE_HEADER *) &ptr->qhdr);
X         }
X      }
X   }
X}
SHAR_EOF
  echo 'File argus-1.5/server/cons_udp.c is complete' &&
  $shar_touch -am 0508141395 'argus-1.5/server/cons_udp.c' &&
  chmod 0444 'argus-1.5/server/cons_udp.c' ||
  echo 'restore of argus-1.5/server/cons_udp.c failed'
  shar_count="`wc -c < 'argus-1.5/server/cons_udp.c'`"
  test 10712 -eq "$shar_count" ||
    echo "argus-1.5/server/cons_udp.c: original size 10712, current size $shar_count"
  rm -f _sharnew.tmp
fi
# ============= argus-1.5/server/tcp_wrapper.c ==============
if test -f 'argus-1.5/server/tcp_wrapper.c' && test X"$1" != X"-c"; then
  echo 'x - skipping argus-1.5/server/tcp_wrapper.c (file already exists)'
  rm -f _sharnew.tmp
else
  > _sharnew.tmp
  echo 'x - extracting argus-1.5/server/tcp_wrapper.c (text)'
  sed 's/^X//' << 'SHAR_EOF' > 'argus-1.5/server/tcp_wrapper.c' &&
X /*
X  * Modified source from tcp_wrappers_7.1:tcpd.c by
X  *     Wietse Venema (wietse@wzv.win.tue.nl),
X  *     Department of Mathematics and Computing Science,
X  *     Eindhoven University of Technology,
X  *     The Netherlands.
X  *
X  * Carter Bullard
X  * FORE Systems, Inc.
X  * Warrendale, Pennsylvania
X  */
X
X/* System libraries. */
X
X#include <stdlib.h>
X#include <unistd.h>
X
X#include <sys/types.h>
X#include <sys/param.h>
X#include <sys/stat.h>
X#include <sys/socket.h>
X#include <netinet/in.h>
X#include <stdio.h>
X#include <syslog.h>
X
Xextern char *strrchr();
Xextern char *strcpy();
X
X#ifndef MAXPATHNAMELEN
X#define MAXPATHNAMELEN   BUFSIZ
X#endif
X
X/* Local stuff.  */
X
X#ifdef WRAPVERS7
X#include <tcpd.h>
X#else
X#include <log_tcp.h>
X#endif
X
X#define FACILITY LOG_MAIL
X#define SEVERITY LOG_INFO
X
Xint allow_severity = SEVERITY;     /* run-time adjustable */
Xint deny_severity = LOG_WARNING;   /* ditto */
X
Xextern char *program_name;
X
X
Xtcp_wrapper (fd, from)
Xint fd;
Xstruct sockaddr *from;
X{
X   int retn = 0;
X#ifdef WRAPVERS7
X   struct request_info request;
X#else
X   struct sockaddr our_sa;
X   struct client_info client;
X   int from_stat;
X#endif
X
X#ifdef LOG_MAIL
X   (void) openlog(program_name, LOG_PID, FACILITY);
X#else
X   (void) openlog(program_name, LOG_PID);
X#endif
X 
X   /*
X    * Find out the endpoint addresses of this conversation. Host name
X    * lookups and double checks will be done on demand.
X    */
X 
X#ifdef WRAPVERS7
X   request_init(&request, RQ_DAEMON, program_name, RQ_FILE, STDIN_FILENO, 0);
X   request.fd = fd;
X   fromhost(&request);
X#else
X   from_stat = sock_host(&client, fd);
X#endif
X
X   /*
X    * Optionally look up and double check the remote host name. Sites
X    * concerned with security may choose to refuse connections from hosts
X    * that pretend to have someone elses host name.
X    */
X 
X#ifdef PARANOID
X#ifdef WRAPVERS7
X   if (STR_EQ(eval_hostname(request.client), paranoid)) {
X      syslog(deny_severity, "refused connect from %s", eval_client(&request)); 
X      if (request.sink)
X         request.sink(request.fd);
X      return -1;
X   }
X#else
X   if (from_stat == -1) {
X      syslog (deny_severity, "refused connect from %s", hosts_info(client));
X      retn = -1;
X   }
X#endif
X#endif
X
X    /*
X     * The BSD rlogin and rsh daemons that came out after 4.3 BSD disallow
X     * socket options at the IP level. They do so for a good reason.
X     * Unfortunately, we cannot use this with SunOS 4.1.x because the
X     * getsockopt() system call can panic the system.
X     */  
X
X#ifdef KILL_IP_OPTIONS
X   fix_options(&request);
X#endif
X
X    /*
X     * Find out and verify the remote host name. Sites concerned with
X     * security may choose to refuse connections from hosts that pretend to
X     * have someone elses host name.
X     */  
X
X#ifdef HOSTS_ACCESS
X#ifdef WRAPVERS7
X   if (!hosts_access(&request)) {
X      syslog (deny_severity, "refused connect from %s", eval_client(&request));
X      if (request.sink)
X         request.sink(request.fd);
X      return -1;
X   } else
X#else
X   if (!hosts_access(program_name, &client)) {
X      syslog (deny_severity, "refused connect from %s", hosts_info(client));
X      retn = -1;
X   } else
X#endif
X#endif
X
X    /* Report remote client */
X#ifdef WRAPVERS7
X   syslog (allow_severity, "connect from %s", eval_client(&request));
X#else
X   syslog (allow_severity, "connect from %s", hosts_info (&client));
X#endif
X
X   return (retn);
X}
SHAR_EOF
  $shar_touch -am 0508141395 'argus-1.5/server/tcp_wrapper.c' &&
  chmod 0444 'argus-1.5/server/tcp_wrapper.c' ||
  echo 'restore of argus-1.5/server/tcp_wrapper.c failed'
  shar_count="`wc -c < 'argus-1.5/server/tcp_wrapper.c'`"
  test 3376 -eq "$shar_count" ||
    echo "argus-1.5/server/tcp_wrapper.c: original size 3376, current size $shar_count"
  rm -f _sharnew.tmp
fi
# ============= argus-1.5/server/Makefile.in ==============
if test -f 'argus-1.5/server/Makefile.in' && test X"$1" != X"-c"; then
  echo 'x - skipping argus-1.5/server/Makefile.in (file already exists)'
  rm -f _sharnew.tmp
else
  > _sharnew.tmp
  echo 'x - extracting argus-1.5/server/Makefile.in (text)'
  sed 's/^X//' << 'SHAR_EOF' > 'argus-1.5/server/Makefile.in' &&
X
X#  Copyright (c) 1993, 1994 Carnegie Mellon University.
X#  All rights reserved.
X# 
X#  Use in source and binary forms, with or without modification, are 
X#  permitted provided that source code modifications retain all
X#  pertinent copyright notices and this paragraph in its entirety.
X#  This distribution includes software developed at Carnegie Mellon 
X#  University.
X# 
X#  THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
X#  WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
X#  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
X
X#  Copyright (c) 1993, 1994
X# 	The Regents of the University of California.  All rights reserved.
X#
X#  Redistribution and use in source and binary forms, with or without
X#  modification, are permitted provided that: (1) source code distributions
X#  retain the above copyright notice and this paragraph in its entirety, (2)
X#  distributions including binary code include the above copyright notice and
X#  this paragraph in its entirety in the documentation or other materials
X#  provided with the distribution, and (3) all advertising materials mentioning
X#  features or use of this software display the following acknowledgement:
X#  ``This product includes software developed by the University of California,
X#  Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
X#  the University nor the names of its contributors may be used to endorse
X#  or promote products derived from this software without specific prior
X#  written permission.
X#  THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
X#  WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
X#  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
X#
X# @(#) $Header: /usr/users/poepping/src/argus/argus-1.5/server/RCS/Makefile.in,v 1.1 1995/02/08 21:10:53 poepping Exp $ (LBL)
X#
X#
X# You shouldn't need to edit anything below.
X#
X
XDEFINE_STDC = -D__STDC__
X 
X#have-ethers#ETHERS_DEFINES = -DETHER_SERVICE
X#
X#have-solaris#OS_DEFINES = -DSOLARIS
X#have-irix#OS_DEFINES = -Dvolatile= $(DEFINE_STDC)
X
X#have-gcc#DEFINE_STDC =
X
X#have-pf#PCAP_DEFINES = -DPCAP_PF
X
X#have-bpf#PCAP = bpf
X#have-pf#PCAP = pf
X#have-nit#PCAP = nit
X#have-snit#PCAP = snit
X#have-snoop#PCAP = snoop
X#have-dlpi#PCAP = dlpi
X
XCC = cc 
X#have-gcc#CC = gcc
X#have-acc#CC = acc
X
XCCOPT = -g
X#
X# Flex and bison allow you to specify the prefixes of the global symbols
X# used by the generated parser.  This allows programs to use lex/yacc
X# and link against libpcap.  If you don't have flex or bison, get them.
X#
XLEX = lex
XYACC = yacc
X#have-flex#LEX = flex -Ppcap_
X#have-bison#YACC = bison -y -p pcap_
X
XMAKE = make
XSHELL = /bin/sh
X
XRANLIB = echo
X#have-ranlib#RANLIB = ranlib
X
XROOT_DIR=..
XINCLUDE=$(ROOT_DIR)/include
XLIBPCAP=$(ROOT_DIR)/libpcap
XTCPWRAP=$(ROOT_DIR)/wrapper
XOTHDIRS=$(ROOT_DIR)/common
XPROGDIRS=$(ROOT_DIR)/server $(ROOT_DIR)/clients
XALLDIRS=$(LIBPCAP) $(OTHDIRS) $(PROGDIRS)
X#
XINSTALL_LIB=$(ROOT_DIR)/lib
XINSTALL_BIN=$(ROOT_DIR)/bin
X#
XINCLUDES = -I$(INCLUDE) -I$(LIBPCAP)
XDEFINES =  $(PCAP_DEFINES) $(OS_DEFINES)
X
X# Standard CFLAGS
XCFLAGS = $(CCOPT) $(DEFINES) $(INCLUDES)
X
X# Tcpwrapper FLAGS
XTVERS = -DWRAPVERS6
X#have-tcpwrapper-6.3#TVERS = -DWRAPVERS6
X#have-tcpwrapper-7.0#TVERS = -DWRAPVERS7
X#have-tcpwrapper-7.1#TVERS = -DWRAPVERS7
X#have-tcpwrapper-7.2#TVERS = -DWRAPVERS7
XTFLAGS = $(TVERS) -DPARANOID -DHOSTS_ACCESS -DKILL_IP_OPTIONS
X#have-sunos#TFLAGS = $(TVERS) -DPARANOID -DHOSTS_ACCESS
X
X# Explicitly define compiliation rule since SunOS 4's make doesn't like gcc.
X# Also, gcc does not remove the .o before forking 'as', which can be a
X# problem if you don't own the file but can write to the directory.
X.c.o:
X	rm -f $@; $(CC) $(CFLAGS) -c $*.c
X
X
XLIB =$(INSTALL_LIB)/libpcap.a $(INSTALL_LIB)/libwrap.a
X#have-solaris#LIB =$(INSTALL_LIB)/libpcap.a $(INSTALL_LIB)/libwrap.a -lsocket -lnsl
X
XSRC =	argus.c argus_cons.c cons_ip.c cons_tcp.c cons_udp.c\
X        cons_icmp.c cons_ether.c cons_fddi.c cons_sockets.c\
X	argus_util.c bpf_dump.c tcp_wrapper.c
X
XOBJ_CONNECT = argus.o argus_cons.o cons_tcp.o cons_udp.o cons_icmp.o\
X              cons_sockets.o cons_ip.o cons_ether.o cons_fddi.o\
X	      argus_util.o bpf_dump.o tcp_wrapper.o
X
Xall: $(INSTALL_BIN)/argus_$(PCAP)
X
X$(INSTALL_BIN)/argus_$(PCAP): $(OBJ_CONNECT)
X	$(CC) $(CFLAGS) -o $@ $(OBJ_CONNECT) $(LIB)
X
Xtcp_wrapper.o:  tcp_wrapper.c
X	rm -f $@; $(CC) $(CFLAGS) $(TFLAGS) -I$(TCPWRAP) -c $*.c
X
Xclean:
X	rm -f *.o ;
X
Xforce: /tmp
Xinstall: argus
X	ln -s $(INSTALL_BIN)/argus_$(PCAP) $(INSTALL_BIN)/argus
X
Xdepend: force
X	../bin/mkdep $(INCLUDES) $(SRC)
SHAR_EOF
  $shar_touch -am 0508141395 'argus-1.5/server/Makefile.in' &&
  chmod 0444 'argus-1.5/server/Makefile.in' ||
  echo 'restore of argus-1.5/server/Makefile.in failed'
  shar_count="`wc -c < 'argus-1.5/server/Makefile.in'`"
  test 4556 -eq "$shar_count" ||
    echo "argus-1.5/server/Makefile.in: original size 4556, current size $shar_count"
  rm -f _sharnew.tmp
fi
# ============= argus-1.5/server/README ==============
if test -f 'argus-1.5/server/README' && test X"$1" != X"-c"; then
  echo 'x - skipping argus-1.5/server/README (file already exists)'
  rm -f _sharnew.tmp
else
  > _sharnew.tmp
  echo 'x - extracting argus-1.5/server/README (text)'
  sed 's/^X//' << 'SHAR_EOF' > 'argus-1.5/server/README' &&
X
X/*
X * Copyright (c) 1993, 1994, 1995 Carnegie Mellon University.
X * All rights reserved.
X *
X * Permission to use, copy, modify, and distribute this software and
X * its documentation for any purpose and without fee is hereby granted, 
X * provided that the above copyright notice appear in all copies and
X * that both that copyright notice and this permission notice appear
X * in supporting documentation, and that the name of CMU not be
X * used in advertising or publicity pertaining to distribution of the
X * software without specific, written prior permission.  
X * 
X * CMU DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING
X * ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL
X * CMU BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR
X * ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
X * WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
X * ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
X * SOFTWARE.
X *
X */
X
XArgus server directory.
XThis directory contains source code for the Argus server.
X
XManifest:
X-r--r--r--  1 argus    software     4556 Feb  8 16:11 Makefile.in
X-rw-r--r--  1 wcb      software     2036 Apr 25 13:19 README
X-r--r--r--  1 argus    software     5757 Feb  8 16:11 argus.c
X-r--r--r--  1 argus    software     3055 Feb  8 16:11 argus_cons.c
X-r--r--r--  1 argus    software    13631 Apr 19 15:53 argus_util.c
X-r--r--r--  1 argus    software     2189 Feb  8 16:12 bpf_dump.c
X-r--r--r--  1 argus    software     2321 Feb  8 16:12 cons_ether.c
X-r--r--r--  1 argus    software     6285 Feb  8 16:12 cons_fddi.c
X-r--r--r--  1 argus    software     4800 Feb  8 16:12 cons_icmp.c
X-r--r--r--  1 argus    software    12399 Feb  8 16:12 cons_ip.c
X-r--r--r--  1 argus    software     5786 Apr 19 15:29 cons_sockets.c
X-r--r--r--  1 argus    software    16416 Feb  8 16:12 cons_tcp.c
X-r--r--r--  1 argus    software    10070 Feb  8 16:12 cons_udp.c
X-r--r--r--  1 argus    software     3376 Feb  8 16:12 tcp_wrapper.c
SHAR_EOF
  $shar_touch -am 0508141395 'argus-1.5/server/README' &&
  chmod 0444 'argus-1.5/server/README' ||
  echo 'restore of argus-1.5/server/README failed'
  shar_count="`wc -c < 'argus-1.5/server/README'`"
  test 2036 -eq "$shar_count" ||
    echo "argus-1.5/server/README: original size 2036, current size $shar_count"
  rm -f _sharnew.tmp
fi
# ============= argus-1.5/server/argus_util.c ==============
if test -f 'argus-1.5/server/argus_util.c' && test X"$1" != X"-c"; then
  echo 'x - skipping argus-1.5/server/argus_util.c (file already exists)'
  rm -f _sharnew.tmp
else
  > _sharnew.tmp
  echo 'x - extracting argus-1.5/server/argus_util.c (text)'
  sed 's/^X//' << 'SHAR_EOF' > 'argus-1.5/server/argus_util.c' &&
X
X/*
X * Copyright (c) 1993, 1994 Carnegie Mellon University.
X * All rights reserved.
X *
X * Permission to use, copy, modify, and distribute this software and
X * its documentation for any purpose and without fee is hereby granted, 
X * provided that the above copyright notice appear in all copies and
X * that both that copyright notice and this permission notice appear
X * in supporting documentation, and that the name of CMU not be
X * used in advertising or publicity pertaining to distribution of the
X * software without specific, written prior permission.  
X * 
X * CMU DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING
X * ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL
X * CMU BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR
X * ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
X * WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
X * ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
X * SOFTWARE.
X *
X */
X
X/*
X * argus_util.c - supports connection tracking 
X *
X * Useful routines to support argus package.
X *
X * written by Carter Bullard
X * Software Engineering Institute
X * Carnegie Mellon Univeristy
X */
X
X
X#include <stdlib.h>
X#include <unistd.h>
X
X#include <stdio.h>
X#include <sys/types.h>
X#include <sys/time.h>
X
X#include <compat.h>
X#include <pcap.h>
X#include <pcap-int.h>
X#include <interface.h>
X#include <addrtoname.h>
X
X#include <argus.h>
X#include <cons_tcp.h>
X
Xextern fd_set readmask, writemask, exceptmask;
X
Xstruct callback {
X   pcap_handler function;
X   int type;
X};
X
Xstatic struct callback callbacks[] = {
X   { cons_ether_packet,  DLT_EN10MB },
X   { cons_fddi_packet,   DLT_FDDI },
X   { NULL,               DLT_SLIP },
X   { NULL,               DLT_PPP },
X   { NULL,               DLT_NULL },
X   { NULL,               NULL },
X};
X
X
Xextern int lfd;
Xextern pcap_t *pd;
X
Xstatic void check_all_timeouts ();
Xstatic void wrapup ();
X
Xvoid
Xargus_loop (p, callback)
Xpcap_t *p;
Xpcap_handler callback;
X{
X   int pfd = 0, width = ulimit (4, NULL);
X   struct timeval wait, tvp;
X   extern struct timeval globaltvp;
X   extern char *rfile;
X   
X   wait.tv_sec = 1; wait.tv_usec = 0;
X
X   if (p && callback) {
X      if ((pfd = p->fd) >= 0) {
X         if (lfd >= 0) FD_SET (lfd, &readmask);
X         if (pfd >= 0) FD_SET (pfd, &readmask);
X
X         while (select (width, &readmask, NULL, NULL, &wait) >= 0) {
X            if (FD_ISSET (pfd, &readmask))
X               pcap_read (p, -1, callback, (u_char *) NULL);
X
X            if ((lfd >= 0) && FD_ISSET (lfd, &readmask))
X               check_client_status (lfd);
X
X            gettimeofday (&tvp, NULL);
X
X            if (updatetime (&tvp)) check_all_timeouts (&tvp);
X            if (lfd >= 0) FD_SET (lfd, &readmask);
X            if (pfd) FD_SET (pfd, &readmask);
X         }
X      } else
X         pcap_offline_read (p, -1, callback, (u_char *) NULL);
X   }
X}
X
Xint reporttime = 0;
X
Xstatic void
Xcheck_all_timeouts (tvp)
Xstruct timeval *tvp;
X{
X   extern int debug_interval;
X   struct tm *tm;
X   char buf[64];
X
X   check_timeouts (&tcp_timeout_list, tvp, 60);
X   check_timeouts (&tcp_display_list, tvp, tcptimeout);
X   check_timeouts (&udp_display_list, tvp, udptimeout);
X   check_timeouts ( &ip_display_list, tvp,  iptimeout);
X
X   if (debugflag) {
X      if (tvp->tv_sec >= reporttime) {
X         extern int tcpdeletecount, udpdeletecount, ipdeletecount;
X         extern pcap_t *pd;
X         struct pcap_stat stat;
X
X         reporttime = tvp->tv_sec + debug_interval;
X         strftime (buf, 64, "%T", localtime (&tvp->tv_sec));
X         if (pcap_stats (pd, &stat) >= 0) {
X            (void) fprintf (stderr, "%s ", buf);
X            (void) fprintf (stderr, "pkts %8dr %5dd",
X                 stat.ps_recv, stat.ps_drop);
X            (void) fprintf (stderr, " tcp %4da %4dt %5dd",
X                 tcp_display_list.count, tcp_timeout_list.count,
X                 tcpdeletecount);
X            (void) fprintf (stderr, "  udp %4dc %5dd ",
X                 udp_display_list.count, udpdeletecount);
X            (void) fprintf (stderr, "  ip %3dc %4dd\n",
X                 ip_display_list.count, ipdeletecount);
X         }
X      }
X   }
X}
X
X
Xstatic void
Xwrapup (pd)
Xpcap_t *pd;
X{
X   struct pcap_stat stat;
X   extern char *rfile;
X   extern int totalPktsRcv;
X
X   if (rfile) {
X      stat.ps_recv = totalPktsRcv;
X      stat.ps_drop = 0;
X   } else
X      if (pcap_stats (pd, &stat) < 0)
X         (void) fprintf (stderr, "pcap_stats: %s\n", pcap_geterr (pd));
X
X   (void) fprintf (stderr, "\n%d packets recv'd by filter\n", stat.ps_recv);
X   (void) fprintf (stderr, "%d packets dropped by kernel\n", stat.ps_drop);
X
X   pcap_close (pd);
X   close_clients ();
X}
X
Xpcap_handler
Xlookup_pcap_callback (int type)
X{
X   pcap_handler retn = NULL;
X   struct callback *callback;
X
X   for (callback = callbacks; callback->function; ++callback)
X      if (type == callback->type) {
X         retn = callback->function;
X         break;
X      }
X
X   return (retn);
X}
X
X
Xvoid
Xcleanup ()
X{
X   struct timeval tvp;
X
X   gettimeofday (&tvp, NULL);
X   udptimeout = -1; tcptimeout = -1; iptimeout = -1;
X   check_timeouts (&tcp_display_list, tvp, tcptimeout);
X   check_timeouts (&udp_display_list, tvp, udptimeout);
X   check_timeouts ( &ip_display_list, tvp,  iptimeout);
X   
X   if (pd != NULL) wrapup (pd);
X   exit (0);
X}
X
Xvoid
Xusr1sig ()
X{
X   debugflag = (debugflag++ > 30) ? 30 : debugflag;
X   fprintf (stderr, "argus: debug enabled level %d\n", debugflag);
X}
X
Xvoid
Xusr2sig ()
X{
X   debugflag = 0;
X   fprintf (stderr, "argus: debug disabled\n");
X}
X
Xvoid
Xusage(progname)
Xchar *progname;
X{
X   fprintf (stderr, "Version %d.%d\n", VERSION_MAJOR, VERSION_MINOR);
X   fprintf (stderr, "usage: %s [-bhOp][-d detail-interval]", progname);
X   fprintf (stderr, "[-D debug-level][-r tcpdump-file]\n");
X   fprintf (stderr, "           [-w argus-file]");
X   fprintf (stderr, "[-U udp-timeout][-T tcp-timeout][-I ip-timeout]\n");
X   fprintf (stderr, "           [-P port] [-i interface] expression\n");
X   fprintf (stderr, "options: b - print filter definition\n");
X   fprintf (stderr, "         d - log detailed events on sec interval\n");
X   fprintf (stderr, "         D - set debug level\n");
X   fprintf (stderr, "         h - print help\n");
X   fprintf (stderr, "         i - specify network interface\n");
X   fprintf (stderr, "         I - set IP transaction timer\n");
X   fprintf (stderr, "         O - turn off filter optimizer\n");
X   fprintf (stderr, "         p - don't go into promiscuous mode\n");
X   fprintf (stderr, "         P - specify tcp remote access port\n");
X   fprintf (stderr, "         r - read from tcpdump(1) packet file\n");
X   fprintf (stderr, "         T - set TCP transaction timer\n");
X   fprintf (stderr, "         U - set UDP transaction timer\n");
X   fprintf (stderr, "         w - write output to logfile, or stdout '-'\n");
X   exit (-1);
X}
X
X
Xstruct HASH_TABLE_HEADER *
Xadd_hash_table_entry (table, tha, ptr)
Xstruct HASH_TABLE *table;
Xstruct tha *tha;
Xstruct OBJECT *ptr;
X{
X   struct HASH_TABLE_HEADER *retn = NULL;
X   struct HASH_TABLE_HEADER *entry = NULL, *start = NULL;
X   unsigned short hash = 0;
X   int i, len;
X
X   for (i = 0, len = (sizeof (*tha) / sizeof (hash)); i < len; i++)
X      hash += ((unsigned short *)tha)[i];
X
X   if (entry = table->hash_array[hash % table->size]) {
X      start = entry;
X      do {
X         if (!(bcmp ((char *)tha, (char *)&entry->tha, sizeof (*tha)))) {
X            retn = entry;
X            break;
X         }
X         entry = entry->nxt;
X      } while (entry != start);
X   }
X   if (!(retn)) {
X      if (retn = (struct HASH_TABLE_HEADER *) calloc (1, sizeof (*retn))) {
X         retn->object = ptr;
X         retn->hash = hash;
X         bcopy ((char *)tha, (char *)&retn->tha, sizeof (*tha));
X         if (start) {
X            retn->nxt = start;
X            retn->prv = start->prv;
X            retn->prv->nxt = retn;
X            retn->nxt->prv = retn;
X         } else 
X            retn->prv = retn->nxt = retn;
X         table->hash_array[hash % table->size] = retn;
X      } else perror ("add_hash_table_entry: calloc");
X   } else aerror ("add_hash_table_entry: already in queue", 0L);
X
X   return (retn);
X}
X
X
Xstruct OBJECT *
Xfind_hash_entry (table, tha)
Xstruct HASH_TABLE *table;
Xstruct tha *tha;
X{
X   struct OBJECT *retn = NULL;
X   struct HASH_TABLE_HEADER *entry, *start;
X   unsigned short hash = 0;
X   int i, len;
X
X   for (i = 0, len = (sizeof (*tha) / sizeof (hash)); i < len; i++)
X      hash += ((unsigned short *)tha)[i];
X
X   if (entry = table->hash_array[hash % table->size]) {
X      start = entry;
X      do {
X         if (entry) {
X            if (!(bcmp ((char *)tha, (char *)&entry->tha, sizeof (*tha)))) {
X               retn = entry->object;
X               break;
X            } else
X               entry = entry->nxt;
X         } else {
X            aerror ("find_hash_entry: bad entry pointer", 0L);
X         }
X      } while (entry != start);
X   }
X
X   return (retn);
X}
X
X
Xremove_hash_table_entry (table, tha)
Xstruct HASH_TABLE *table;
Xstruct tha *tha;
X{
X   struct HASH_TABLE_HEADER *retn = NULL;
X   struct HASH_TABLE_HEADER *entry, *start;
X   unsigned short hash = 0;
X   int i, len;
X
X   for (i = 0, len = (sizeof (*tha) / sizeof (hash)); i < len; i++)
X      hash += ((unsigned short *)tha)[i];
X
X   if (entry = table->hash_array[hash % table->size]) {
X      start = entry;
X      do {
X         if (!(bcmp ((char *)tha, (char *)&entry->tha, sizeof (*tha)))) {
X            retn = entry;
X            break;
X         }
X         entry = entry->nxt;
X      } while (entry != start);
X   }
X
X   if (retn) {
X      retn->prv->nxt = retn->nxt;
X      retn->nxt->prv = retn->prv;
X      if (retn == start) {
X         if (retn == retn->nxt)
X            table->hash_array[hash % table->size] = NULL;
X         else
X            table->hash_array[hash % table->size] = retn->nxt;
X      }
X      free (retn);
X   }
X}
X
X
Xadd_to_queue (queue, ptr)
Xstruct QUEUE *queue;
Xstruct QUEUE_HEADER *ptr;
X{
X   int retn = 0;
X   struct QUEUE_HEADER *head;
X
X   if (queue && ptr) {
X      if (!(ptr->queue)) {
X         ptr->queue = queue;
X         if (head = queue->start) {
X            if (head->prv && head->nxt) {
X               ptr->nxt = head;
X               ptr->prv = head->prv;
X               ptr->nxt->prv = ptr;
X               ptr->prv->nxt = ptr;
X            } else aerror ("add_to_queue: head pointers bad", 0L);
X         } else {
X            ptr->prv = ptr;
X            ptr->nxt = ptr;
X         }
X         queue->start = ptr;
X         queue->count++;
X         retn = 1;
X      } else
X         aerror ("add_to_queue: ptr->queue not NULL", 0L);
X   } else
X      aerror ("add_to_queue: bad parameters", 0L);
X
X   return (retn);
X}
X
Xvoid
Xremove_from_queue (queue, ptr)
Xstruct QUEUE *queue;
Xstruct QUEUE_HEADER *ptr;
X{
X   struct QUEUE *thisqueue;
X
X   if (queue && ptr) {
X      if (ptr->queue && (ptr->queue == queue)) {
X         if (--queue->count > 0) {
X            if (ptr->prv) ptr->prv->nxt = ptr->nxt; 
X            else aerror ("remove_from_queue: ptr->prv is null", 0L);
X            if (ptr->nxt) ptr->nxt->prv = ptr->prv; 
X            else aerror ("remove_from_queue: ptr->nxt is null", 0L);
X   
X            if (ptr == queue->start)
X                  queue->start = ptr->nxt;
X         } else
X            queue->start = NULL;
X      } else if (ptr->queue)
X                aerror ("remove_from_queue: remove from wrong queue", 0L);
X             else
X                aerror ("remove_from_queue: object not in queue", 0L);
X
X      ptr->queue = NULL;
X      ptr->prv = NULL;
X      ptr->nxt = NULL;
X   } else
X      aerror ("remove_from_queue: bad parameters", 0L);
X}
X
X
Xvoid
Xupdate_queue_status (ptr)
Xstruct QUEUE_HEADER *ptr;
X{
X   struct QUEUE *queue;
X
X   if (ptr) { 
X      queue = ptr->queue;
X      if (queue) {
X         if (ptr != queue->start) {
X            remove_from_queue (queue, ptr);
X            if (!(add_to_queue (queue, ptr)))
X               aerror ("update_queue_status: add_to_queue error", NULL);
X         }
X      } else aerror ("update_queue_status: queue is NULL", 0L);
X   } else aerror ("update_queue_status: ptr is NULL", 0L);
X}
X
X
X#include <malloc.h> 
X#include <string.h> 
X
Xchar *
Xcopy_argv (argv)
Xchar **argv;
X{
X   char **p;
X   int len = 0;
X   char *buf = NULL, *src, *dst;
X
X   p = argv;
X   if (*p == 0) return 0;
X
X   while (*p) len += (int) strlen (*p++) + 1;
X
X   if (buf = calloc (1, len)) {
X      p = argv;
X      dst = buf;
X      while ((src = *p++) != NULL) {
X         while ((*dst++ = *src++) != '\0') ;
X         dst[-1] = ' ';
X      }
X
X      dst[-1] = '\0';
X   }
X   return buf;
X}
X
X#include <sys/types.h>
X#include <sys/stat.h>
X#include <fcntl.h>
X
Xchar *
Xread_infile (char *fname)
X{
X   int fd;
X   char *p;
X   struct stat buf;
X 
X   if ((fd = open(fname, O_RDONLY)) >= 0) {
X      if (fstat(fd, &buf) < 0)
X         aerror ("can't state '%s'", (int) fname);
X 
X      if (p = calloc (1, (u_int) buf.st_size))
X         if (read (fd, p, (unsigned int)buf.st_size) != buf.st_size)
X            aerror ("problem reading '%s'", (int) fname);
X 
X   } else
X      aerror ("can't open '%s'", (int) fname);
X
X   return (p);
X}
X
Xunsigned short udpPorts [128];
Xunsigned short *udpServicePorts = NULL;
X
X#define MAXSTRLEN  1024
X
Xread_udp_services (file)
Xchar *file;
X{
X   FILE *fd;
X   int port, i = 0;
X   char *ptr = NULL, buffer[MAXSTRLEN];
X
X   if (file) {
X      if ((fd = fopen (file, "r")) != NULL) {
X         bzero ((char *) udpPorts, sizeof (udpPorts));
X         while ((i < 128) && fgets (buffer, MAXSTRLEN, fd))
X            if ((*buffer != '#') && (*buffer != '\n') && (*buffer != '!'))
X               if ((ptr = strtok (buffer, " \t")) && (*ptr != '\n'))
X                  if ((ptr = strtok (NULL, " \t")) && (*ptr != '\n'))
X                     if (strstr (ptr, "udp"))
X                        if ((sscanf (ptr, "%d", &port)) == 1)
X                           udpPorts[i++] = (unsigned short) port;
X         if (i)
X            udpServicePorts = udpPorts;
X
X         fclose (fd);
X      }
X   }
X}
X
X#include <varargs.h>
X
Xvoid
Xaerror (fmt, va_alist)
Xchar *fmt;
Xva_dcl
X{
X   va_list ap;
X
X   (void) fprintf (stderr, "%s: ", program_name);
X   va_start (ap);
X   (void) vfprintf (stderr, fmt, ap);
X   va_end (ap);
X   if (*fmt) {
X      fmt += (int) strlen (fmt);
X      if (fmt[-1] != '\n')
X         (void) fputc ('\n', stderr);
X   }
X   exit (1);
X}
X
X#ifdef SOLARIS
Xbcopy (s1, s2, len)
Xchar *s1, *s2;
Xint len;
X{
X   memmove (s2, s1, len);
X}
X
Xbcmp (s1, s2, len)
Xchar *s1, *s2;
Xint len;
X{
X   return (memcmp (s1, s2, len));
X}
X
Xbzero (s1, len)
Xchar *s1;
Xint len;
X{
X   memset (s1, 0, len);
X}
X#endif
SHAR_EOF
  $shar_touch -am 0508141395 'argus-1.5/server/argus_util.c' &&
  chmod 0444 'argus-1.5/server/argus_util.c' ||
  echo 'restore of argus-1.5/server/argus_util.c failed'
  shar_count="`wc -c < 'argus-1.5/server/argus_util.c'`"
  test 14500 -eq "$shar_count" ||
    echo "argus-1.5/server/argus_util.c: original size 14500, current size $shar_count"
  rm -f _sharnew.tmp
fi
# ============= argus-1.5/server/services ==============
if test -f 'argus-1.5/server/services' && test X"$1" != X"-c"; then
  echo 'x - skipping argus-1.5/server/services (file already exists)'
  rm -f _sharnew.tmp
else
  > _sharnew.tmp
  echo 'x - extracting argus-1.5/server/services (text)'
  sed 's/^X//' << 'SHAR_EOF' > 'argus-1.5/server/services' &&
X#
X# @(#)/usr/local/etc/argus/services 
X#
Xdomain           53/udp    Domain Name Server
Xsnmp            161/udp    SNMP
Xypserv          675/udp    Loach ypserv rcp port
Xnfs            2049/udp    Network File System
SHAR_EOF
  $shar_touch -am 0508141395 'argus-1.5/server/services' &&
  chmod 0444 'argus-1.5/server/services' ||
  echo 'restore of argus-1.5/server/services failed'
  shar_count="`wc -c < 'argus-1.5/server/services'`"
  test 215 -eq "$shar_count" ||
    echo "argus-1.5/server/services: original size 215, current size $shar_count"
  rm -f _sharnew.tmp
fi
# ============= argus-1.5/INSTALL ==============
if test -f 'argus-1.5/INSTALL' && test X"$1" != X"-c"; then
  echo 'x - skipping argus-1.5/INSTALL (file already exists)'
  rm -f _sharnew.tmp
else
  > _sharnew.tmp
  echo 'x - extracting argus-1.5/INSTALL (text)'
  sed 's/^X//' << 'SHAR_EOF' > 'argus-1.5/INSTALL' &&
X
X/*
X * Copyright (c) 1993, 1994, 1995 Carnegie Mellon University.
X * All rights reserved.
X *
X * Permission to use, copy, modify, and distribute this software and
X * its documentation for any purpose and without fee is hereby granted, 
X * provided that the above copyright notice appear in all copies and
X * that both that copyright notice and this permission notice appear
X * in supporting documentation, and that the name of CMU not be
X * used in advertising or publicity pertaining to distribution of the
X * software without specific, written prior permission.  
X * 
X * CMU DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING
X * ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL
X * CMU BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR
X * ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
X * WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
X * ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
X * SOFTWARE.
X *
X */
X
X
XArgus and its supporting routines have been developed on Sparc
Xarchitectures under SunOS 4.1.x, and have been successfully ported
Xto Solaris 2.3 and SGI IRIX5.2.  No claim is made as to the portability
Xof Argus to other platforms.  If you make any modifications to support
Xinstalling and running Argus in any other environment, please send us
Xcomments and/or patches.  We will be most grateful.
X
XArgus is dependant on the public domain packages libpcap and tcp_wrappers.
XLibpcap provides the packet capture facility for Argus, and tcp_wrappers
Xprovides remote access control.  At this time, the lastest versions are
Xlibpcap-0.0.6 and tcp_wrappers-7.2.  We recommend installing these
Xpackages at the same directory level as Argus, as the installation
Xconfiguration scripts look for these packages.  Please see below for
Xmore details.  To get copies of libpcap and tcp_wrappers:
X
XLIBPCAP 0.0.6
XLawrence Berkeley Laboratory
XNetwork Research Group
Xlibpcap@ee.lbl.gov
Xftp://ftp.ee.lbl.gov/libpcap-*.tar.Z
X - Steve McCanne (mccanne@ee.lbl.gov)
X   Craig Leres (leres@ee.lbl.gov)
X   Van Jacobson (van@ee.lbl.gov)
X
X
Xtcp_wrappers.7.2
XWietse Venema (wietse@wzv.win.tue.nl)
XDepartment of Mathematics and Computing Science
XEindhoven University of Technology
XP.O. Box 513
X5600 MB Eindhoven
XThe Netherlands
Xftp://ftp.win.tue.nl/pub/security
Xftp://info.cert.org/pub/tools
X
X
XAgain since Argus is dependant on these pacakges, you will need
Xto have installed them prior to building Argus.  Please refer to
Xthe individual packages for installation instructions.  We highly
Xrecommend putting the root directories for these packages, in
Xthe same parent directory as Argus's root directory, so that the
Xautomated configuration procedures can find them.
X
XWe have borrowed libpcap-0.0.6's automatic configuration strategy, which
Xshould make building Argus on Sun and SGI platforms easier.
X
XThe program, ./configure, will scan the file system, looking for
Xthe libpcap and tcp_wrapper directories and libraries and make
Xassumptions about the platform which will allow ./configure to choose
Xbetween gcc, acc, cc, flex, lex, bison and yacc.  The choice of
Xlibpcap interface, whether it is bpf, pf, enet, snit, nit, snoop or
Xdlpi, will be made automatically.
X
XConfigure will create links for the libpcap.a and libwrap.a libraries
Xin ./lib, and will create links to the distribution directories as
X./libpcap and ./wrapper.  Configure will attempt to find the libpcap
Xand tcp_wrappers distribution directories, and their corresponding
Xlibraries, and fail if it cannot do so.  The path used to find
Xthese dependancies is ./libpcap, ./wrapper, /usr/lib, /usr/local/lib,
X../libpcap, ../wrapper, ../tcp_wrappers, ../libpcap-[0-9]*.[0-9ab]*,
Xand ../tcp_wrappers[-.][0-9]*.[0-9ab]*.
X
XBecause of major changes between tcp_wrappers-6 and tcp_wrappers-7,
X./configure needs to discover the tcp_wrappers version number.  It
Xdoes this by scanning the patchlevel.h file in the tcp_wrapper
Xdistribution, as a result, ./configure will attempt to find establish
Xa link to your tcp_wrappers distribution directory.
X
XAgain, we recommend that you install your libpcap and tcp_wrappers
Xdistribution directories, or links to them, in either the same
Xdirectory as the Argus distribution, or as the directories
X./libpcap and ./wrapper, in the Argus directory.
X
XConfigure will determine what interface will be used by Argus, by
Xscanning the libpcap.a library.  The resulting Argus server will be
Xnamed with an interface specific label.  This is done to assist those
Xwho will build multiple versions of Argus from a single machine.
X
XSo, after all that, to build Argus on a Sun or SGI platform, first run
X./configure.  ./configure will determine your system attributes and
Xgenerate subdirectories and the appropriate Makefiles from the Makefile.in
Xfiles found in the distribution.  After this, run "make".  If everything
Xgoes well, appropriate libraries and binaries will be found in the ./bin
Xand ./lib subdirectories.  So, ....
X
X   % ./configure
X   % make
X
XArgus will be found as ./bin/argus_"libpcapInterfaceName".  So for
Xa libpcap.a that is built to support the /dev/snit interface, argus
Xwill be named ./bin/argus_snit.
X
XThe libpcap-0.0.6 package library determines the interface type, so if
Xyou want to make argus for another interface, you will have to make
Xthe appropriate libpcap.a for that interface, and install that library
Xin the appropriate place before remaking Argus.
X
X
X
XSo, at this point you should have all the execuables needed.  But,
Xif you are having problems, it may be related to your compiler or
Xthe flex and bison utilities.  So, ...
X
XYou will need an ANSI C compiler to build argus.  If your compiler
Xis not ANSI compliant, we highly recommend using the GNU C compiler,
Xavailable via anonymous ftp:
X
X	ftp://prep.ai.mit.edu/pub/gnu/gcc-*.tar.gz
X
X
XArgus, uses lex and yacc.  If you use flex, version 2.4.6
Xor higher is recommended, and with it, you must use bison.  The
Xcurrent version of flex and bison are available via anonymous ftp:
X
X	ftp://ftp.ee.lbl.gov/flex-*.tar.Z
X        ftp://prep.ai.mit.edu/pub/gnu/bison-*.tar.gz
X
X
X
XNow, if you are still having problems, ..., well its hard to say
Xfrom here what it might be.  So, you may want to send us some
Xmail.
X
X
XAny comments, patches, bug reports or additions should be sent to 
Xargus@sei.cmu.edu.
X
XCarter Bullard
XSoftware Engineering Institute
XCarnegie Mellon Univeristy
Xwcb@sei.cmu.edu
X
XChas DiFatta
XSoftware Engineering Institute
XCarnegie Mellon Univeristy
Xchas@sei.cmu.edu
SHAR_EOF
  $shar_touch -am 0508141395 'argus-1.5/INSTALL' &&
  chmod 0444 'argus-1.5/INSTALL' ||
  echo 'restore of argus-1.5/INSTALL failed'
  shar_count="`wc -c < 'argus-1.5/INSTALL'`"
  test 6522 -eq "$shar_count" ||
    echo "argus-1.5/INSTALL: original size 6522, current size $shar_count"
  rm -f _sharnew.tmp
fi
# ============= argus-1.5/Makefile.in ==============
if test -f 'argus-1.5/Makefile.in' && test X"$1" != X"-c"; then
  echo 'x - skipping argus-1.5/Makefile.in (file already exists)'
  rm -f _sharnew.tmp
else
  > _sharnew.tmp
  echo 'x - extracting argus-1.5/Makefile.in (text)'
  sed 's/^X//' << 'SHAR_EOF' > 'argus-1.5/Makefile.in' &&
X
X#  Copyright (c) 1994 Carnegie Mellon University.
X#  All rights reserved.
X# 
X#  Use in source and binary forms, with or without modification, are 
X#  permitted provided that source code modifications retain all
X#  pertinent copyright notices and this paragraph in its entirety.
X#  This distribution includes software developed at Carnegie Mellon 
X#  University.
X# 
X#  THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
X#  WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
X#  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
X
X#  Copyright (c) 1993, 1994
X# 	The Regents of the University of California.  All rights reserved.
X#
X#  Redistribution and use in source and binary forms, with or without
X#  modification, are permitted provided that: (1) source code distributions
X#  retain the above copyright notice and this paragraph in its entirety, (2)
X#  distributions including binary code include the above copyright notice and
X#  this paragraph in its entirety in the documentation or other materials
X#  provided with the distribution, and (3) all advertising materials mentioning
X#  features or use of this software display the following acknowledgement:
X#  ``This product includes software developed by the University of California,
X#  Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
X#  the University nor the names of its contributors may be used to endorse
X#  or promote products derived from this software without specific prior
X#  written permission.
X#  THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
X#  WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
X#  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
X#
X# @(#) $Header: /tmp_mnt/us/wcb/research/src/argus/argus-1.5/RCS/Makefile.in,v 1.3 1995/04/25 19:26:38 wcb Exp $ (LBL)
X#
X#
X# You shouldn't need to edit anything below.
X#
X
XDEFINE_STDC = -D__STDC__
X 
X#have-ethers#ETHERS_DEFINES = -DETHER_SERVICE
X#
X#have-solaris#OS_DEFINES = -DSOLARIS
X#have-irix#OS_DEFINES = -Dvolatile= $(DEFINE_STDC)
X
X#have-gcc#DEFINE_STDC =
X
X#have-pf#PCAP_DEFINES = -DPCAP_PF
X
X#have-bpf#PCAP = bpf
X#have-pf#PCAP = pf
X#have-nit#PCAP = nit
X#have-snit#PCAP = snit
X#have-snoop#PCAP = snoop
X#have-dlpi#PCAP = dlpi
X
XCC = cc 
X#have-gcc#CC = gcc
X#have-acc#CC = acc
X
XCCOPT = -g
X#
X# Flex and bison allow you to specify the prefixes of the global symbols
X# used by the generated parser.  This allows programs to use lex/yacc
X# and link against libpcap.  If you don't have flex or bison, get them.
X#
XLEX = lex
XYACC = yacc
X#have-flex#LEX = flex -Ppcap_
X#have-bison#YACC = bison -y -p pcap_
X
XMAKE = make
XSHELL = /bin/sh
X
XRANLIB = echo
X#have-ranlib#RANLIB = ranlib
X
XROOT_DIR=.
XINCLUDE=$(ROOT_DIR)/include
XLIBPCAP=$(ROOT_DIR)/libpcap
XLIBWRAP=$(ROOT_DIR)/wrapper
XCOMMON=$(ROOT_DIR)/common
XPROGDIRS=$(ROOT_DIR)/server $(ROOT_DIR)/clients
XALLDIRS=$(COMMON) $(PROGDIRS)
X#
X#
XINCLUDES = -I$(INCLUDE) -I$(LIBPCAP) -I$(LIBWRAP)
XDEFINES = $(ETHERS_DEFINES) $(PCAP_DEFINES) $(OS_DEFINES)
X
X# Standard CFLAGS
XCFLAGS = $(CCOPT) $(DEFINES) $(INCLUDES)
X
X# Explicitly define compiliation rule since SunOS 4's make doesn't like gcc.
X# Also, gcc does not remove the .o before forking 'as', which can be a
X# problem if you don't own the file but can write to the directory.
X.c.o:
X	rm -f $@; $(CC) $(CFLAGS) -c $*.c
X
Xall: force
X	@for i in  $(ALLDIRS) ; do \
X		if [ -d $$i ] ; then \
X		echo "making in $$i"; \
X		cd $$i; \
X		make; \
X		cd ..; \
X		fi; \
X	done
X
Xforce:  /tmp
X
Xdepend: force
X	@for i in $(ALLDIRS) ; do \
X		if [ -d $$i ] ; then \
X		cd $$i; \
X		make depend; \
X		cd ..; \
X		fi; \
X	done
X
Xinstall: force
X	@for i in $(PROGDIRS) ; do \
X		if [ -d $$i ] ; then \
X		cd $$i; \
X		make install; \
X		cd ..; \
X		fi; \
X	done
X
Xclean: force
X	@for i in $(ALLDIRS) ; do \
X		if [ -d $$i ] ; then \
X		cd $$i; \
X		make clean; \
X		cd ..; \
X		fi; \
X	done
X
Xclobber realclean: force
X	rm -f lib/*
X	rm -f bin/argus*
X	rm -f bin/ra
X	rm -f bin/services
X	rm -f libpcap wrapper
X	@for i in $(ALLDIRS) ; do \
X		if [ -d $$i ] ; then \
X		cd $$i; \
X		make clean; \
X		rm -f Makefile; \
X		cd ..; \
X		fi; \
X	done
X	rm -f ./Makefile
SHAR_EOF
  $shar_touch -am 0508141395 'argus-1.5/Makefile.in' &&
  chmod 0444 'argus-1.5/Makefile.in' ||
  echo 'restore of argus-1.5/Makefile.in failed'
  shar_count="`wc -c < 'argus-1.5/Makefile.in'`"
  test 4112 -eq "$shar_count" ||
    echo "argus-1.5/Makefile.in: original size 4112, current size $shar_count"
  rm -f _sharnew.tmp
fi
# ============= argus-1.5/man/man8/argus.8 ==============
if test ! -d 'argus-1.5/man'; then
  echo 'x - creating directory argus-1.5/man'
  mkdir 'argus-1.5/man'
fi
if test ! -d 'argus-1.5/man/man8'; then
  echo 'x - creating directory argus-1.5/man/man8'
  mkdir 'argus-1.5/man/man8'
fi
if test -f 'argus-1.5/man/man8/argus.8' && test X"$1" != X"-c"; then
  echo 'x - skipping argus-1.5/man/man8/argus.8 (file already exists)'
  rm -f _sharnew.tmp
else
  > _sharnew.tmp
  echo 'x - extracting argus-1.5/man/man8/argus.8 (text)'
  sed 's/^X//' << 'SHAR_EOF' > 'argus-1.5/man/man8/argus.8' &&
X.\" $Header: /tmp_mnt/us/wcb/research/src/argus/argus-1.5/man/man8/RCS/argus.8,v 1.4 1995/04/25 22:28:51 wcb Exp $
X.\" Copyright (c) 1994 Software Engineering Institute (SEI),
X.\" and Carnegie Mellon University. 
X.\" All rights reserved.  The CMU, and SEI specifies the 
X.\" terms and conditions for redistribution.
X.\"
X.TH ARGUS 8 "10 October 1994"
X.SH NAME
Xargus \- IP network auditing facility
X.SH SYNOPSIS
X.B argus
X[
X.B \-bhOp
X] [
X.B \-d
X.I detail-interval
X] [ 
X.B \-F
X.I file
X]
X.br
X.ti +6
X[
X.B \-r
X.I tcpdump-file
X] [
X.B \-w
X.I output-file
X]
X.br
X.ti +6
X[
X.B \-D
X.I debug-interval
X]
X[
X.B \-I
X.I ip-timeout
X] [
X.B \-P
X.I port
X]
X.br
X.ti +6
X[
X.B \-U
X.I udp-timeout
X] [
X.B \-T
X.I tcp-timeout
X]
X.br
X.ti +6
X[
X.B \-S
X.I services-file
X]
X[
X.B \-i
X.I interface
X] expression
X.SH DESCRIPTION
X.IX  "argus command"  ""  "\fLargus\fP \(em Internet audit facility"
X.IX  servers  argus  ""  "\fLargus\fP \(em Internet audit facility"
X.LP
X.B Argus
Xis an IP transaction auditing tool that categorizes
XIP packets which match the boolean
X.I expression
Xinto a protocol-specific network transaction model.
X.B Argus
Xreports on the transactions that it discovers, as they occur.
X.LP
XDesigned to run as a daemon,
X.B argus
Xgenerally pulls packets directly from a network interface, and writes the
Xtransaction status information to a log file or open socket connected to an
X.B argus
Xclient (such as
X.BR policy(1) .
X.B Argus
Xcan also read packet information from
X.B tcpdump(1)
Xraw packet files and/or write the transaction logs to stdout.
X.LP
X.B Argus
Xprovides access control for its socket connection facility using
X.B tcp_wrapper
Xtechnology.  Please refer to the \fBtcp_wrapper\fP distribution
Xfor a complete description.
X.LP
X\fBArgus\fP catches a number of \fBsignal(3)\fP events.
XThe three signals \fBSIGHUP\fP, \fBSIGINT\fP, and \fBSIGTERM\fP
Xcause \fBargus\fP to exit, writing TIMEDOUT status records for
Xall currently active transactions.  The signal \fBSIGUSR1\fP
Xwill turn on \fBdebug\fP reporting, and subsequent \fBSIGUSR1\fP
Xsignals, will increment the \fBdebug-level\fP. The signal \fBSIGUSR2\fP
Xwill cause \fBargus\fP to turn off all \fBdebug\fP reporting.
X.SH OPTIONS
X.TP 5 5
X.B \-b
XDump the compiled packet-matching code to stdout and stop.
X.TP 5 5
X.BI \-d
XPlace
X.B argus
Xin detail mode, and set the reporting \fIdetail-interval\fP, in seconds.
XWhen in detail mode,
X.B argus
Xsends reports at all transaction state changes, and sends interim transaction
Xstatus reports every
X\fIdetail-interval\fP seconds.
X.TP 5 5
X.BI \-D
XTurn on internal \fBargus\fP table structure reporting.
X\fIDebug-interval\fP is specified in seconds.
XAn example \fBdebug\fP output is:
X.nf
X.ft B
X.cs B 30 4
X.ss 4
X
X % argus -D 5 
X 12:03:02 pkts  48r 0d  tcp  1a 0t 0d   udp  8a 0d   ip  1a 0d
X 12:03:07 pkts 227r 0d  tcp  3a 1t 1d   udp 33a 0d   ip  1a 0d
X 12:03:12 pkts 311r 0d  tcp  5a 0t 3d   udp 33a 0d   ip  2a 0d
X
X.ss 12
X.cs B
X.fi
X.ft
X.br
X     Total pkts received (r) and dropped (d).
X     TCP active (a), time waiting (t) and deleted (d).
X     UDP active (a), and deleted (d).
X     IP active (a), and deleted (d).
X.TP 5 5
X.B \-F
XUse \fIfile\fP as input for the filter expression.
XAn additional expression given on the command line is ignored.
X.TP 5 5
X.B \-h
XPrint an explanation of all the arguments.
X.TP 5 5
X.BI \-i\ 
XSpecify the physical network \fIinterface\fP to be audited.
XThe default is le0.
X.TP 5 5
X.BI \-I
XSpecify the \fIip-timeout\fP in seconds.
XThe default is 900 seconds.
X.TP 5 5
X.B \-O
XTurn off Berkeley Packet Filter optimizer.
X.TP 5 5
X.B \-p
XDo not set the physical network interface in promiscuous mode.
X.TP 5 5
X.BI \-P
XSpecifies an alternate \fIport\fP for remote client connection.
XThe default is port 561/tcp.  Setting the \fIport\fP to 0, completely
Xdisables remote client access.
X.TP 5 5
X.B \-r
XRead from
X.B tcpdump(1)
Xraw packet file.
XIf the
X.B \-r
Xoption is specified,
X.B argus
Xwill not put down a
X.B listen(2)
Xto support remote access.
X.TP 5 5
X.BI \-T
XSpecify the \fItcp-timeout\fP in seconds.
XThe default is 120 seconds, and corresponds to the standard TCP FIN-WAIT state timeout.
X.TP 5 5
X.BI \-U
XSpecify the \fIudp-timeout\fP in seconds.
XThe default is 900 seconds.
X.TP 5 5
X.B \-w
XWrite transaction status records to \fIoutput-file\fP.  An \fIoutput-file\fP
Xof '-' directs \fBargus\fP to write the resulting \fIargus-file\fP output
Xto \fIstdout\fP.
X.TP 5 5
X.B \-S
XRead UDP services port definitions from \fIservices-file\fP.  This allows
X\fBargus\fP to "wildcard" the source port number for UDP transactions that
Xare directed to this service.  This should be used for high volume
Xrequest/response protocols, such as DNS, to prevent \fBargus\fP from
Xgenerating too many status records for these \fIservices\fP.  The format of
Xthe \fIservices-file\fP uses \fBservices(5)\fP file format.  Only entries
Xlisted for udp will be recognized.
X.TP 5 5
X.B \fIexpression\fP
XThis
X.B tcpdump(1)
Xexpression
Xspecifies which transactions will be selected.  If no \fIexpression\fP
Xis given, all transactions are selected.  Otherwise,
Xonly transactions for which \fIexpression\fP is `true' will be dumped.
XFor a complete \fIexpression\fP format description, please refer to the
X.B tcpdump(1)
Xman page.
X.SH EXAMPLES
X.LP
XRun \fBargus\fP as a daemon, writing all its transaction status reports to
X\fIoutput-file\fP.  This is the typical mode.
X.RS
X.nf
X\fBargus -w \fIoutput-file\fP &
X.fi
X.RE
X.LP
XIf your ICMP traffic is very high and your \fBargus\fP transaction status
X\fIoutput-file\fP gets too big, you may want to not audit icmp.
X.RS
X.nf
X\fBargus -w \fIoutput-file\fP ip and not icmp &
X.fi
X.RE
X.LP
XIf you are seriously concerned about telnet connections to one host on
Xyour network, you can audit the network activity involving just that host.
XHere is a complex example where we will be auditing destingation traffic for
Xhost \fBcrashtest\fP in \fBdetail\fP mode, with the reporting interval
Xset to 30 seconds, and writing the transaction status reports to \fIstdout\fP, but
Xpiping its output to the \fBargus\fP client, \fBpolicy\fP.  \fBPolicy\fP 
Xis configured to report the telnet traffic.  Each qualifying status
Xreport will be written to stdout.
X.RS
X.nf
X\fBargus -d 30 -w - dst host crashtest |  policy -cn port telnet\fP
X.fi
X.RE
X.LP
XAudit the network activity that is flowing between the two
Xgateway routers, whose ethernet addresses are 00:08:03:2D:42:01 and
X00:00:0C:18:29:F1.  Without specifying an \fIoutput-file\fP, it is
Xassumed that the transaction status reports will be written to a 
Xremote client.  In this case we have changed the port that the
Xremote client will use to port 430/tcp.
X.RS
X.nf
X\fBargus -P 430 ether host (0:8:3:2d:42:1 and 0:0:c:18:29:f1)\fP &
X.fi
X.RE
X.LP
XAudit all NFS transactions invovling the server \fIfileserver\fP
Xand increase the UDP timeout to 3600 seconds (to provide high
Xdata reduction), and write the output to \fIoutput-file\fP.
X.RS
X.nf
X\fBargus -U 3600 -w \fIoutput-file\fP udp and port 2049\fP &
X.fi
X.RE
X.SH AUTHORS
X.nf
XCarter Bullard (wcb@fore.com)
XChas DiFatta (cd@sei.cmu.edu)
XSpecial thanks to Mark Poepping (poepping@sei.cmu.edu).
X.SH SEE ALSO
X.BR policy (1),
X.BR hosts_access (5),
X.BR hosts_options (5),
X.BR tcpd (8),
X.BR tcpdump (1)
SHAR_EOF
  $shar_touch -am 0508141395 'argus-1.5/man/man8/argus.8' &&
  chmod 0444 'argus-1.5/man/man8/argus.8' ||
  echo 'restore of argus-1.5/man/man8/argus.8 failed'
  shar_count="`wc -c < 'argus-1.5/man/man8/argus.8'`"
  test 7164 -eq "$shar_count" ||
    echo "argus-1.5/man/man8/argus.8: original size 7164, current size $shar_count"
  rm -f _sharnew.tmp
fi
# ============= argus-1.5/man/man5/argus.5 ==============
if test ! -d 'argus-1.5/man/man5'; then
  echo 'x - creating directory argus-1.5/man/man5'
  mkdir 'argus-1.5/man/man5'
fi
if test -f 'argus-1.5/man/man5/argus.5' && test X"$1" != X"-c"; then
  echo 'x - skipping argus-1.5/man/man5/argus.5 (file already exists)'
  rm -f _sharnew.tmp
else
  > _sharnew.tmp
  echo 'x - extracting argus-1.5/man/man5/argus.5 (text)'
  sed 's/^X//' << 'SHAR_EOF' > 'argus-1.5/man/man5/argus.5' &&
X.\" $Header: /usr/users/poepping/src/argus/argus-1.5/man/man5/RCS/argus.5,v 1.1 1995/02/08 20:55:21 poepping Exp $
X.\" Copyright (c) 1994 Software Engineering Institute (SEI),
X.\" and Carnegie Mellon University.
X.\" All rights reserved.  The CMU, and SEI specifies the
X.\" terms and conditions for redistribution.
X.\"
X.TH ARGUS 5 "5 December 1994"
X.SH NAME
Xargus \- IP Network Auditing Facility
X.SH SYNOPSIS
X.B #include <[argus_dir]/include/cons_def.h>
X.SH DESCRIPTION
XThe format of the 
X.BR argus (8)
Xdata stream is most succinctly described through the structures defined
Xin the header file, but the general format is as follows:
X.LP
X.RS
X.ft B
XArgus File Format:
X   Argus_ID_Str
X   Argus_Datum
X        .
X        .
X        .
X   Argus_Datum
X.ft
X.fi
X.RE
X.sp
Xwhere the individual data fields are defined as follows:
X.LP
X.RS
X.fi
Xchar
X.B Argus_ID_Str
X[];
X
Xsprintf (
X.B Argus_ID_Str,
X.nf
X     "Argus Version %d.%d\\n", MAJOR_VERSION, MINOR_VERSION);
X.fi
X
X.nf
Xstruct \fBArgusDatum\fP {
X   u_int \fBstatus\fP;                     /*  4bytes; connection status */
X   struct \fBtimeWriteStruct\fP time;      /* 16bytes; start/end times */
X   struct \fBlinkWriteStruct\fP link;      /* 12bytes; src/dst MAC addr */
X   struct \fBinetWriteStruct\fP inet;      /*  8bytes; src/dst IP addr */
X   union {
X      struct  \fBtcpWriteStruct\fP  tcp;
X      struct  \fBudpWriteStruct\fP  udp;
X      struct \fBicmpWriteStruct\fP icmp;
X   } ipws_trans_union;               /* 20bytes */
X};
X.fi
X.RE
X.ce 2
X
X\fBArgus Status Field\fP
XNote: one tick mark represents one bit position.
X.nf
X.ft B
X.cs B 30 4
X.ss 4
X.ce 8
X0                   1                   2                   3   
X0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
X+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
X|0|  Protocol   |   |  IP Opt   |  Exp  |         State         |
X+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
X
X+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
X|1|  Operation  |                   Data                        |
X+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
X.ss 12
X.cs B
X.ft
X.bp
X.nf
Xstruct \fBtimeWriteStruct\fP {
X   struct timeval startime;       /* 8 bytes */
X   struct timeval lasttime;       /* 8 bytes */
X};
X
Xstruct \fBlinkWriteStruct\fP {
X   struct ether_addr ethersrc;    /* 6 bytes */
X   struct ether_addr etherdst;    /* 6 bytes */
X};
X
Xstruct \fBinetWriteStruct\fP {
X   struct in_addr src;            /* 4 bytes */
X   struct in_addr dst;            /* 4 bytes */
X};
X
Xstruct \fBtcpWriteStruct\fP {
X   u_short srcport, dstport;      /* 4 bytes */
X   int src_count, dst_count;      /* 8 bytes */
X   int src_bytes, dst_bytes;      /* 8 bytes */
X};
X
Xstruct \fBudpWriteStruct\fP {
X   u_short srcport, dstport;      /* 4 bytes */
X   int src_count, dst_count;      /* 8 bytes */
X   int src_bytes, dst_bytes;      /* 8 bytes */
X};
X
Xstruct \fBipWriteStruct\fP {
X   u_int protocol;                /* 4 bytes */
X   int src_count, dst_count;      /* 8 bytes */
X   int src_bytes, dst_bytes;      /* 8 bytes */
X};
X
Xstruct \fBicmpWriteStruct\fP {
X   int unused;                    /* 4 bytes */
X   unsigned char type, code;      /* 2 bytes */
X   unsigned short data;           /* 2 bytes */
X   struct in_addr srcaddr;        /* 4 bytes */
X   struct in_addr dstaddr;        /* 4 bytes */
X   struct in_addr gwaddr;         /* 4 bytes */
X};
X
X.fi
X.RE
X.SH SEE ALSO
X.BR argus (8),
X.BR policy (1),
SHAR_EOF
  $shar_touch -am 0508141395 'argus-1.5/man/man5/argus.5' &&
  chmod 0444 'argus-1.5/man/man5/argus.5' ||
  echo 'restore of argus-1.5/man/man5/argus.5 failed'
  shar_count="`wc -c < 'argus-1.5/man/man5/argus.5'`"
  test 3442 -eq "$shar_count" ||
    echo "argus-1.5/man/man5/argus.5: original size 3442, current size $shar_count"
  rm -f _sharnew.tmp
fi
# ============= argus-1.5/man/man1/services.1 ==============
if test ! -d 'argus-1.5/man/man1'; then
  echo 'x - creating directory argus-1.5/man/man1'
  mkdir 'argus-1.5/man/man1'
fi
if test -f 'argus-1.5/man/man1/services.1' && test X"$1" != X"-c"; then
  echo 'x - skipping argus-1.5/man/man1/services.1 (file already exists)'
  rm -f _sharnew.tmp
else
  > _sharnew.tmp
  echo 'x - extracting argus-1.5/man/man1/services.1 (text)'
  sed 's/^X//' << 'SHAR_EOF' > 'argus-1.5/man/man1/services.1' &&
X.\" $Header: /us/wcb/research/src/argus/argus-1.5/man/man1/RCS/services.1,v 1.2 1995/04/20 21:41:14 wcb Exp $
X.\" All rights reserved.
X.\"
X.\" Copyright (c) 1993, 1994 Carnegie Mellon University.
X.\" All rights reserved.
X.\"
X.\" Permission to use, copy, modify, and distribute this software and
X.\" its documentation for any purpose and without fee is hereby granted, 
X.\" provided that the above copyright notice appear in all copies and
X.\" that both that copyright notice and this permission notice appear
X.\" in supporting documentation, and that the name of CMU not be
X.\" used in advertising or publicity pertaining to distribution of the
X.\" software without specific, written prior permission.  
X.\" 
X.\" CMU DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING
X.\" ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL
X.\" CMU BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR
X.\" ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
X.\" WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
X.\" ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
X.\" SOFTWARE.
X.\"
X.\"
X.\"
X.TH SERVICES 1 "1 January 1995"
X.SH NAME
X\fBservices\fP \- tally TCP and UDP statistics from \fBargus(8)\fP data
X.SH SYNOPSIS
X.B services
X[ -bhnEMNORTWX ]
X[
X.B \-C
X.I access-file
X]
X.br
X.ti +7
X[
X.B \-d
X.I debug-level
X] [
X.B -r
X.I argus-file
X]
X.br
X.ti +7
X[
X.B \-w
X.I output-file
X] [
X.B \-P
X.I port
X] [
X.B \-F
X.I file
X]
X.br
X.ti +7
X[
X.B \-S
X.I argus-server
X]
X.I expression
X.SH DESCRIPTION
X.IX  "services command"  ""  "\fLservices\fP \(em argus data"
X.LP
X.B Services
Xpresents a concise report of the occurrence and performance of the 
XTCP and UDP services encountered in an \fIargus\fP data stream.
XFor each unique TCP and UDP destination port number encountered,
X\fBservices\fP prints the number of transactions, the mean (std dev) 
Xsource and destination bytes/packet, and the mean (std dev) 
Xseconds duration for the transactions seen.
X.B Services
Xreads
X.BR argus
Xdata from either \fIstdin\fP, an \fIargus-file\fP, or from a
Xremote host running as an \fIargus-server\fP, and
Xprints network transaction statistics based
Xthe criteria described in the 
X\fIaccess-file\fP and/or the boolean \fIexpression\fP.
X.LP
X.SH OPTIONS
X.TP 5 5
X.B \-b
XDump the compiled transaction-matching code to standard output and stop.
X.TP 5 5
X.B \-C
XMatch entries against a Cisco access control list that is contained
Xin \fIaccess-file\fP.  This can be used to verify that firewalls
Xbased on Cisco products are working as expected.
X.B Argus
Xtransaction reports corresponding to network traffic that should
Xbe blocked by the access control definition, are reported.
XThe file format is that of a single extended access-list definition.
X.TP 5 5
X.B \-d
XPrint debug information relating to Cisco access control list
Xtransaction reporting.  When \fIdebug-level\fP is 1,
X.B services
Xprints the Cisco access control list definition that would cause the
Xargus datum to be rejected.  With a \fIdebug-level\fP of 2,
X.B services
Xalso prints the Cisco access control list definition that permits
Xargus data. 
X.TP 5 5
X.B \-E
XUse transactions that have been established.
X.TP 5 5
X.B \-F
XUse \fIfile\fP as input for the filter expression.
XAn additional expression given on the command line is ignored.
X.TP 5 5
X.B \-h
XPrint an explanation of all the arguments. 
X.TP 5 5
X.B \-M
XUse transactions with multiple routes involved with the transaction.
XThis condition exists when a transaction involves more than a single
Xsource and destination MAC address pair.
X.TP 5 5
X.B \-n
XNo not translate host and service numbers to names. \fB-nn\fP will
Xsuppress translation of protocol numbers, as well.
X.TP 5 5
X.B \-N
XUse TCP transactions that closed normally.
X.TP 5 5
X.B \-O
XUse transactions that involved the use of IP options.
X.TP 5 5
X.B \-P
XUse alternate \fIport\fP when accessing remote
X.B argus
Xserver.  The default is port 561/tcp.
X.TP 5 5
X.B \-r
XRead from the specified \fIargus-file\fP.
X.TP 5 5
X.B \-R
XUse TCP transactions that encountered a RESET indication.
X.TP 5 5
X.B \-S
XSpecify a \fIremote-argus-server\fP. 
X.TP 5 5
X.B \-T
XUse transactions that reported because of a TIMED_OUT condition.
X.TP 5 5
X.B \-w
XWrite out matching data to \fIoutput-file\fP, in
X.B argus
Xfile format. An \fIoutput-file\fP of '-' directs 
X.B services
Xto write the '\fIargus-file\fP to stdout, allowing for "chaining"
X.B services
Xcommands together.
X.TP 5 5
X.B \-W
XUse TCP transactions where the source or destination window was
Xset to zero at some time during the transaction.
X.TP 5 5
X.B \-X
XUse TCP transactions that involved packet retransmissions.
X.TP 5 5
X.B \fIexpression\fP
XThis
X.B tcpdump(1)
Xexpression
Xspecifies which transactions will be selected.  If no \fIexpression\fP
Xis given, all transactions are selected.  Otherwise,
Xonly transactions for which \fIexpression\fP is `true' will be dumped.
XFor a complete \fIexpression\fP format description, please refer to the
X.B tcpdump(1)
Xman page.
X.br
X.SH EXAMPLES
X.LP
XTo report all TCP services that the host electronomo provides,
Xreading transaction data from \fIargus-file\fP argus.data:
X.RS
X.nf
X\fBservices -r \fIargus.data\B tcp and dst host electronomo\fP
X.fi
X.RE
X.LP
XTo review the network services accessed by hosts on the network 198.257.3.0,
Xusing the remote 
X.B argus
Xserver \fIargus-host\fP.
XNote, statistics are collected silently from the remote host until a
X\fISIGHUP, SIGINT, SIGQUIT\fP or a \fISIGTERM\fP is detected, then
Xthey are reported to \fIstdout\fP. 
X.RS
X.nf
X\fBservices -S \fIargus-host\fB src net 198.2.3.0\fP
X.fi
X.RE
X
X.fi
X.RE
X.br
X.SH OUTPUT FORMAT
X.LP
XThe following is a brief description of the output format of
X.B services.
XThe general format is:
X.RE
X.RS
X.nf
X
X.sp .1
X\fI            proto  port  cons  src_stats  dst_stats  secs\fP
X.sp .1
X.fi
X.RE
X.TP 4 4
X.BI proto
XProtocol specific field that indicates either a TCP or UDP service.
X.TP 5 5
X.BI port
XThis field is composed of the port number through which the service was
Xprovided (for instance, 25 for smtp). 
X.TP 5 5
X.BI cons
XThe number of transactions seen of a specific service.
X.TP 4 4
X.BI src_stats
XThe mean source bytes/packet of the service,
Xand the standard deviation.
X.TP 4 4
X.BI dst_stats
XThe mean destination bytes/packet of the service,
Xand the standard deviation.
X.TP 3 3
X.BI secs
XThe mean elapsed time of the service, and the standard deviation.
X.SH OUTPUT EXAMPLES
XThese examples show typical \fBservices\fP output, and demonstrates a
Xnumber of variations seen in \fBargus\fP data.  This \fBservices\fP
Xoutput was generated to examine the performance of external services
Xprovided by the network 192.292.2.0.
X
X.ft B
X.cs B 30 4
X.ss 4
X.nf
X./services -r argus-data -nn dst net 192.292.2.0
XTotal Cons            189    90.69(99.13)    138.29(130.88)    10.11(65.96)   
X        port         cons      src b/pkt       dst b/pkt         secs
X                               mean(sd)         mean(sd)       mean(sd)
X
X      tcp     21        3     9.60(3.57)      30.51(5.44)       1.91(1.32)    
X      tcp     25       22   130.18(35.05)     26.82(7.55)       6.55(6.40)    
X      udp     53       53    47.87(4.98)     129.85(65.54)      0.14(0.42)    
X      tcp     70        4     4.55(2.30)     166.23(104.26)     1.97(1.11)    
X      tcp     79        1     1.00(0.00)      43.83(0.00)       0.71(0.00)    
X      tcp     80       52    46.76(31.90)    237.70(141.62)     6.65(6.66)    
X      tcp    113        1     1.86(0.00)      13.00(0.00)       7.05(0.00)    
X      tcp    771        1     6.46(0.00)      42.00(0.00)       0.90(0.00)    
X      tcp   1095        1   346.14(0.00)      73.00(0.00)       0.82(0.00)    
X      udp   7001        4    40.00(0.00)      40.00(6.93)       0.05(0.05)    
X      udp   7003        1    52.00(0.00)     512.00(0.00)       0.01(0.00)    
X      tcp   7999        1    87.29(0.00)      92.33(0.00)       2.29(0.00)    
X      tcp   8001        9    97.91(30.66)    308.29(126.46)     1.91(1.11)    
X
X
X.fi
X.bp
X.ft R
X.in +6n
X.ll -1n
XThis is an example of 
X.B services
Xused for reviewing the network services provided by the host 192.292.2.34
X.in -6n
X.ll +1n
X.ft B
X.nf
Xservices -nnS cz host 192.292.2.34 
XTotal Cons          94789   275.32(378.74)   295.12(411.67)     3.89(0.77)    
X        port         cons      src b/pkt       dst b/pkt         secs
X                               mean(sd)         mean(sd)       mean(sd)
X
X      tcp     23        1     2.17(0.00)       6.73(0.00)       1.99(0.00)
X      tcp     25        1   166.83(0.00)      34.31(0.00)       0.70(0.00)
X      udp     53       27   106.38(5.62)      34.31(0.67)       0.70(4.12)
X      tcp     79        1    87.40(0.00)      46.00(10.23)      3.41(0.00)
X      udp    111     3484    66.71(83.23)     91.00(0.87)       8.76(0.10)
X      tcp    123       29    56.25(0.02)      56.33(0.34)      23.87(9.52)
X      tcp    513        3   115.75(1.01)     106.00(2.92)       1.90(0.79)
X      udp   2049    91243   422.47(19.77)   1084.82(1.23)       5.75(11.69)
X
X.fi
X.SH AUTHORS
X.nf
XCarter Bullard (wcb@fore.com).
XChas DiFatta (cd@sei.cmu.edu).
XSpecial thanks to Mark Poepping (poepping@sei.cmu.edu).
X.fi
X.SH SEE ALSO
X.BR tcpdump (1),
X.BR argus (8)
X.LP
XPostel, Jon,
X.IR "Internet Protocol",
X.SM RFC
X791,
XNetwork Information Center,
X.SM SRI
XInternational, Menlo Park, Calif.,
XMay 1981.
X.LP
XPostel, Jon, 
X.IR "Internet Control Message Protocol" ,
X.SM RFC
X792,
XNetwork Information Center, SRI International, Menlo Park, Calif.,
XMay 1981.
X.LP
XPostel, Jon, 
X.IR "Transmission Control Protocol" ,
X.SM RFC
X793,
XNetwork Information Center, SRI International, Menlo Park, Calif.,
XMay 1981.
X.LP
XPostel, Jon,
X.IR "User Datagram Protocol" ,
X.SM RFC
X768,
XNetwork Information Center, SRI International, Menlo Park, Calif.,
XMay 1980.
X.LP
XMcCanne, Steven, and Van Jacobson,
X.IR "The BSD Packet Filter: A New Architecture for User-level Capture" ,
XLawrwnce Berkeley Laboratory, One Cyclotron Road, Berkeley, Calif., 94720,
XDecember 1992.
SHAR_EOF
  $shar_touch -am 0508141395 'argus-1.5/man/man1/services.1' &&
  chmod 0444 'argus-1.5/man/man1/services.1' ||
  echo 'restore of argus-1.5/man/man1/services.1 failed'
  shar_count="`wc -c < 'argus-1.5/man/man1/services.1'`"
  test 9968 -eq "$shar_count" ||
    echo "argus-1.5/man/man1/services.1: original size 9968, current size $shar_count"
  rm -f _sharnew.tmp
fi
# ============= argus-1.5/man/man1/tcpdump.1 ==============
if test -f 'argus-1.5/man/man1/tcpdump.1' && test X"$1" != X"-c"; then
  echo 'x - skipping argus-1.5/man/man1/tcpdump.1 (file already exists)'
  rm -f _sharnew.tmp
else
  > _sharnew.tmp
  echo 'x - extracting argus-1.5/man/man1/tcpdump.1 (text)'
  sed 's/^X//' << 'SHAR_EOF' > 'argus-1.5/man/man1/tcpdump.1' &&
X.\" @(#) $Header: /tmp_mnt/us/wcb/research/src/argus/argus-1.5/man/man1/RCS/tcpdump.1,v 1.1 1995/05/05 20:37:07 wcb Exp $ (LBL)
X.\"
X.\" Copyright (c) 1988-1990 The Regents of the University of California.
X.\" All rights reserved.
X.\"
X.\" Redistribution and use in source and binary forms, with or without
X.\" modification, are permitted provided that: (1) source code distributions
X.\" retain the above copyright notice and this paragraph in its entirety, (2)
X.\" distributions including binary code include the above copyright notice and
X.\" this paragraph in its entirety in the documentation or other materials
X.\" provided with the distribution, and (3) all advertising materials mentioning
X.\" features or use of this software display the following acknowledgement:
X.\" ``This product includes software developed by the University of California,
X.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
X.\" the University nor the names of its contributors may be used to endorse
X.\" or promote products derived from this software without specific prior
X.\" written permission.
X.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
X.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
X.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
X.\"
X.TH TCPDUMP 1  "25 Jun 1989"
X.SH NAME
Xtcpdump \- dump traffic on a network
X.SH SYNOPSIS
X.na
X.B tcpdump
X[
X.B \-deflnNOpqStvx
X] [
X.B \-c
X.I count
X] [
X.B \-F
X.I file
X]
X.br
X.ti +8
X[
X.B \-i
X.I interface
X] [
X.B \-r
X.I file
X]
X[
X.B \-s
X.I snaplen
X]
X.br
X.ti +8
X[
X.B \-w
X.I file
X]
X.I expression
X.br
X.ad
X.SH DESCRIPTION
X.LP
X\fITcpdump\fP prints out the headers of packets on a network interface
Xthat match the boolean \fIexpression\fP.
X.B Under SunOS:
XYou must be root to invoke \fItcpdump\fP or it must be installed
Xsetuid to root.
X.B Under Ultrix:
XAny user can invoke \fItcpdump\fP once the super-user has enabled
Xpromiscuous-mode operation using
X.IR pfconfig (8).
X.B Under BSD:
XAccess is controlled by the permissions on 
X.I /dev/bpf0, 
Xetc.
X.SH OPTIONS
X.TP
X.B \-c
XExit after receiving \fIcount\fP packets.
X.TP
X.B \-d
XDump the compiled packet-matching code to standard output and stop.
X.TP
X.B \-e
XPrint the link-level header on each dump line.
X.TP
X.B \-f
XPrint `foreign' internet addresses numerically rather than symbolically
X(this option is intended to get around serious brain damage in
XSun's yp server \(em usually it hangs forever translating non-local
Xinternet numbers).
X.TP
X.B \-F
XUse \fIfile\fP as input for the filter expression.
XAn additional expression given on the command line is ignored.
X.TP
X.B \-i
XListen on \fIinterface\fP.
XIf unspecified, \fItcpdump\fP searches the system interface list for the
Xlowest numbered, configured up interface (excluding loopback).
XTies are broken by choosing the earliest match.
X.TP
X.B \-l
XMake stdout line buffered.  Useful if you want to see the data
Xwhile capturing it.  E.g.,
X.br
X``tcpdump\ \ \-l\ \ |\ \ tee dat'' or
X``tcpdump\ \ \-l \ \ > dat\ \ &\ \ tail\ \ \-f\ \ dat''.
X.TP
X.B \-n
XDon't convert addresses (i.e., host addresses, port numbers, etc.) to names.
X.TP
X.B \-N
XDon't print domain name qualification of host names.  E.g.,
Xif you give this flag then \fItcpdump\fP will print ``nic''
Xinstead of ``nic.ddn.mil''.
X.TP
X.B \-O
XDo not run the packet-matching code optimizer.  This is useful only
Xif you suspect a bug in the optimizer.
X.TP
X.B \-p
X\fIDon't\fP put the interface
Xinto promiscuous mode.  Note that the interface might be in promiscuous
Xfor some other reason; hence, `-p' cannot be used as an abbreviation for
X`ether host {localhost} or broadcast'.
X.TP
X.B \-q
XQuick (quiet?) output.  Print less protocol information so output
Xlines are shorter.
X.TP
X.B \-r
XRead packets from \fIfile\fR (which was created with the -w option).
XStandard input is used if \fIfile\fR is ``-''.
X.TP
X.B \-s
XSnarf \fIsnaplen\fP bytes of data from each packet rather than the
Xdefault of 68 (with NIT, the minimum is actually 96).
X68 bytes is adequate for IP, ICMP, TCP
Xand UDP but may truncate protocol information from name server and NFS
Xpackets (see below).  Packets truncated because of a limited snapshot
Xare indicated in the output with ``[|]''.
XNote that taking larger snapshots both increases
Xthe amount of time it takes to process packets and, effectively,
Xdecreases the amount of packet buffering.  This may cause packets to be
Xlost.  You should limit \fIsnaplen\fP to the smallest number that will
Xcapture the protocol information you're interested in.
X.TP
X.B \-S
XPrint absolute, rather than relative, TCP sequence numbers.
X.TP
X.B \-t
X\fIDon't\fP print a timestamp on each dump line.
X.TP
X.B \-v
X(Slightly more) verbose output.  For example, the time to live
Xand type of service information in an IP packet is printed.
X.TP
X.B \-w
XWrite the raw packets to \fIfile\fR rather than parsing and printing 
Xthem out.  They can later be printed with the \-r option.
XStandard output is used if \fIfile\fR is ``-''.
X.TP
X.B \-x
XPrint each packet (minus its link level header) in hex.
XThe smaller of the entire packet or
X.I snaplen
Xbytes will be printed.
X.IP "\fI expression\fP"
X.RS
Xselects which packets will be dumped.  If no \fIexpression\fP
Xis given, all packets on the net will be dumped.  Otherwise,
Xonly packets for which \fIexpression\fP is `true' will be dumped.
X.LP
XThe \fIexpression\fP consists of one or more
X.I primitives.
XPrimitives usually consist of an
X.I id
X(name or number) preceded by one or more qualifiers.  There are three
Xdifferent kinds of qualifier:
X.IP \fItype\fP
Xqualifiers say what kind of thing the id name or number refers to.
XPossible types are
X.BR host ,
X.B net
Xand
X.BR port .
XE.g., `host foo', `net 128.3', `port 20'.  If there is no type
Xqualifier,
X.B host
Xis assumed.
X.IP \fIdir\fP
Xqualifiers specify a particular tranfer direction to and/or from
X.I id.
XPossible directions are
X.BR src ,
X.BR dst ,
X.B "src or dst"
Xand
X.BR "src and dst" .
XE.g., `src foo', `dst net 128.3', `src or dst port ftp-data'.  If
Xthere is no dir qualifier,
X.B "src or dst"
Xis assumed.
X.IP \fIproto\fP
Xqualifiers restrict the match to a particular protocol.  Possible
Xprotos are:
X.BR ether ,
X.BR ip ,
X.BR arp ,
X.BR rarp ,
X.B tcp
Xand
X.BR udp .
XE.g., `ether src foo', `arp net 128.3', `tcp port 21'.  If there is
Xno proto qualifier, all protocols consistent with the type are
Xassumed.  E.g., `src foo' means `(ip or arp or rarp) src foo'
X(except the latter is not legal syntax), `net bar' means `(ip or
Xarp or rarp) net bar' and `port 53' means `(tcp or udp) port 53'.
X.LP
XIn addition to the above, there are some special `primitive' keywords
Xthat don't follow the pattern:
X.BR gateway ,
X.BR broadcast ,
X.BR less ,
X.B greater
Xand arithmetic expressions.  All of these are described below.
X.LP
XMore complex filter expressions are built up by using the words
X.BR and ,
X.B or
Xand
X.B not
Xto combine primitives.  E.g., `host foo and not port ftp and not port ftp-data'.
XTo save typing, identical qualifier lists can be omitted.  E.g.,
X`tcp dst port ftp or ftp-data or domain' is exactly the same as
X`tcp dst port ftp or tcp dst port ftp-data or tcp dst port domain'.
X.LP
XAllowable primitives are:
X.IP "\fBdst host \fIhost\fR"
XTrue if the IP destination field of the packet is \fIhost\fP,
Xwhich may be either an address or a name.
X.IP "\fBsrc host \fIhost\fR"
XTrue if the IP source field of the packet is \fIhost\fP.
X.IP "\fBhost \fIhost\fP
XTrue if either the IP source or destination of the packet is \fIhost\fP.
XAny of the above host expressions can be prepended with the keywords,
X\fBip\fP, \fBarp\fP, or \fBrarp\fP as in:
X.in +.5i
X.nf
X\fBip host \fIhost\fR
X.fi
X.in -.5i
Xwhich is equivalent to:
X.in +.5i
X.nf
X\fBether proto \fI\\ip\fB and host \fIhost\fR
X.fi
X.in -.5i
XIf \fIhost\fR is a name with multiple IP addresses, each address will
Xbe checked for a match.
X.IP "\fBether dst \fIehost\fP
XTrue if the ethernet destination address is \fIehost\fP.  \fIEhost\fP
Xmay be either a name from /etc/ethers or a number (see
X.IR ethers (3N)
Xfor numeric format).
X.IP "\fBether src \fIehost\fP
XTrue if the ethernet source address is \fIehost\fP.
X.IP "\fBether host \fIehost\fP
XTrue if either the ethernet source or destination address is \fIehost\fP.
X.IP "\fBgateway\fP \fIhost\fP
XTrue if the packet used \fIhost\fP as a gateway.  I.e., the ethernet
Xsource or destination address was \fIhost\fP but neither the IP source
Xnor the IP destination was \fIhost\fP.  \fIHost\fP must be a name and
Xmust be found in both /etc/hosts and /etc/ethers.  (An equivalent
Xexpression is
X.in +.5i
X.nf
X\fBether host \fIehost \fBand not host \fIhost\fR
X.fi
X.in -.5i
Xwhich can be used with either names or numbers for \fIhost / ehost\fP.)
X.IP "\fBdst net \fInet\fR"
XTrue if the IP destination address of the packet has a network
Xnumber of \fInet\fP, which may be either an address or a name.
X.IP "\fBsrc net \fInet\fR"
XTrue if the IP source address of the packet has a network
Xnumber of \fInet\fP.
X.IP "\fBnet \fInet\fR"
XTrue if either the IP source or destination address of the packet has a network
Xnumber of \fInet\fP.
X.IP "\fBdst port \fIport\fR"
XTrue if the packet is ip/tcp or ip/udp and has a
Xdestination port value of \fIport\fP.
XThe \fIport\fP can be a number or a name used in /etc/services (see
X.IR tcp (4P)
Xand
X.IR udp (4P)).
XIf a name is used, both the port
Xnumber and protocol are checked.  If a number or ambiguous name is used,
Xonly the port number is checked (e.g., \fBdst port 513\fR will print both
Xtcp/login traffic and udp/who traffic, and \fBport domain\fR will print
Xboth tcp/domain and udp/domain traffic).
X.IP "\fBsrc port \fIport\fR"
XTrue if the packet has a source port value of \fIport\fP.
X.IP "\fBport \fIport\fR"
XTrue if either the source or destination port of the packet is \fIport\fP.
XAny of the above port expressions can be prepended with the keywords,
X\fBtcp\fP or \fBudp\fP, as in:
X.in +.5i
X.nf
X\fBtcp src port \fIport\fR
X.fi
X.in -.5i
Xwhich matches only tcp packets.
X.IP "\fBless \fIlength\fR"
XTrue if the packet has a length less than or equal to \fIlength\fP.
XThis is equivalent to:
X.in +.5i
X.nf
X\fBlen <= \fIlength\fP.
X.fi
X.in -.5i
X.IP "\fBgreater \fIlength\fR"
XTrue if the packet has a length greater than or equal to \fIlength\fP.
XThis is equivalent to:
X.in +.5i
X.nf
X\fBlen >= \fIlength\fP.
X.fi
X.in -.5i
X.IP "\fBip proto \fIprotocol\fR"
XTrue if the packet is an ip packet (see
X.IR ip (4P))
Xof protocol type \fIprotocol\fP.
X\fIProtocol\fP can be a number or one of the names
X\fIicmp\fP, \fIudp\fP, \fInd\fP, or \fItcp\fP.
XNote that the identifiers \fItcp\fP and \fIudp\fP are also keywords
Xand must be escaped via backslash (\\), which is \\\\ in the C-shell.
X.IP \fBbroadcast\fR
XTrue if the packet is a broadcast packet.
X.IP  "\fBether proto \fIprotocol\fR"
XTrue if the packet is of ether type \fIprotocol\fR.
X\fIProtocol\fP can be a number or a name like
X\fIip\fP, \fIarp\fP, or \fIrarp\fP.
XNote these identifiers are also keywords
Xand must be escaped via backslash (\\).
X.IP "\fBip\fR, \fBarp\fR, \fBrarp\fR"
XAbbreviations for:
X.in +.5i
X.nf
X\fBether proto \fIp\fR
X.fi
X.in -.5i
Xwhere \fIp\fR is one of the above protocols.
X.IP  "\fBtcp\fR, \fBudp\fR"
XAbbreviations for:
X.in +.5i
X.nf
X\fBip proto \fIp\fR
X.fi
X.in -.5i
Xwhere \fIp\fR is one of the above protocols.
X.IP  "\fIexpr relop expr\fR"
XTrue if the relation holds, where \fIrelop\fR is one of >, <, >=, <=, =, !=,
Xand \fIexpr\fR is an arithmetic expression composed of integer constants
X(expressed in standard C syntax), the normal binary operators
X[+, -, *, /, &, |], a length operator, and special packet data accessors.
XTo access
Xdata inside the packet, use the following syntax:
X.in +.5i
X.nf
X\fIproto\fB [ \fIexpr\fB : \fIsize\fB ]\fR
X.fi
X.in -.5i
X\fIProto\fR is one of \fBether, ip, arp, rarp, tcp, \fRor \fBudp\fR, and
Xindicates the protocol layer for the index operation.
XThe byte offset, relative to the indicated protocol layer, is
Xgiven by \fIexpr\fR.
X\fISize\fR is optional and indicates the number of bytes in the
Xfield of interest; it can be either one, two, or four, and defaults to one.
XThe length operator, indicated by the keyword \fBlen\fP, gives the
Xlength of the packet.
X
XFor example, `\fBether[0] & 1 != 0\fP' catches all multicast traffic.
XThe expression `\fBip[0] & 0xf != 5\fP'
Xcatches all IP packets with options. The expression
X`\fBip[2:2] & 0x1fff = 0\fP'
Xcatches only unfragmented datagrams and frag zero of fragmented datagrams.
XThis check is implicitly applied to the \fBtcp\fP and \fBudp\fP 
Xindex opertations.
XFor instance, \fBtcp[0]\fP always means the first
Xbyte of the TCP \fIheader\fP, and never means the first byte of an
Xintervening fragment.
X.LP
XPrimitives may be combined using:
X.IP
XA parenthesized group of primitives and operators
X(parentheses are special to the Shell and must be escaped).
X.IP
XNegation (`\fB!\fP' or `\fBnot\fP').
X.IP
XConcatenation (`\fBand\fP').
X.IP
XAlternation (`\fBor\fP').
X.LP
XNegation has highest precedence.
XAlternation and concatenation have equal precedence and associate
Xleft to right.  Note that explicit \fBand\fR tokens, not juxtaposition,
Xare now required for concatenation.
X.LP
XIf an identifier is given without a keyword, the most recent keyword
Xis assumed.
XFor example,
X.in +.5i
X.nf
X\fBnot host vs and ace\fR
X.fi
X.in -.5i
Xis short for
X.in +.5i
X.nf
X\fBnot host vs and host ace\fR
X.fi
X.in -.5i
Xwhich should not be confused with
X.in +.5i
X.nf
X\fBnot ( host vs or ace )\fR
X.fi
X.in -.5i
X.LP
XExpression arguments can be passed to tcpdump as either a single argument
Xor as multiple arguments, whichever is more convenient.
XGenerally, if the expression contains Shell metacharacters, it is
Xeasier to pass it as a single, quoted argument.
XMultiple arguments are concatenated with spaces before being parsed.
X.SH EXAMPLES
X.LP
XTo print all packets arriving at or departing from \fIsundown\fP:
X.RS
X.nf
X\fBtcpdump host sundown\fP
X.fi
X.RE
X.LP
XTo print traffic between \fIhelios\fR and either \fIhot\fR or \fIace\fR:
X.RS
X.nf
X\fBtcpdump host helios and \\( hot or ace \\)\fP
X.fi
X.RE
X.LP
XTo print all IP packets between \fIace\fR and any host except \fIhelios\fR:
X.RS
X.nf
X\fBtcpdump ip host ace and not helios\fP
X.fi
X.RE
X.LP
XTo print all traffic between local hosts and hosts at Berkeley:
X.RS
X.nf
X.B
Xtcpdump net ucb-ether
X.fi
X.RE
X.LP
XTo print all ftp traffic through internet gateway \fIsnup\fP:
X(note that the expression is quoted to prevent the shell from
X(mis-)interpreting the parentheses):
X.RS
X.nf
X.B
Xtcpdump 'gateway snup and (port ftp or ftp-data)'
X.fi
X.RE
X.LP
XTo print traffic neither sourced from nor destined for local hosts
X(if you gateway to one other net, this stuff should never make it
Xonto your local net).
X.RS
X.nf
X.B
Xtcpdump ip and not net \fIlocalnet\fP
X.fi
X.RE
X.LP
XTo print the start and end packets (the SYN and FIN packets) of each
XTCP conversation that involves a non-local host.
X.RS
X.nf
X.B
Xtcpdump 'tcp[13] & 3 != 0 and not src and dst net \fIlocalnet\fP'
X.fi
X.RE
X.LP
XTo print IP packets longer than 576 bytes sent through gateway \fIsnup\fP:
X.RS
X.nf
X.B
Xtcpdump 'gateway snup and ip[2:2] > 576'
X.fi
X.RE
X.LP
XTo print IP broadcast or multicast packets that were
X.I not
Xsent via ethernet broadcast or multicast:
X.RS
X.nf
X.B
Xtcpdump 'ether[0] & 1 = 0 and ip[16] >= 224'
X.fi
X.RE
X.SH OUTPUT FORMAT
X.LP
XThe output of \fItcpdump\fP is protocol dependent.  The following
Xgives a brief description and examples of most of the formats.
X.de HD
X.sp 1.5
X.B
X..
X.HD
XLink Level Headers
X.LP
XIf the '-e' option is given, the link level header is printed out.
XOn ethernets, the source and destination addresses, protocol,
Xand packet length are printed.
X.LP
X\fI(N.B.: The following description assumes familiarity with
Xthe SLIP compression algorithm described in RFC-1144.)\fP
X.LP
XOn SLIP links, a direction indicator (``I'' for inbound, ``O'' for outbound),
Xpacket type, and compression information are printed out.
XThe packet type is printed first.
XThe three types are \fIip\fP, \fIutcp\fP, and \fIctcp\fP.
XNo further link information is printed for \fIip\fR packets.
XFor TCP packets, the connection identifier is printed following the type.
XIf the packet is compressed, its encoded header is printed out.
XThe special cases are printed out as
X\fB*S+\fIn\fR and \fB*SA+\fIn\fR, where \fIn\fR is the amount by which 
SHAR_EOF
  : || echo 'restore of argus-1.5/man/man1/tcpdump.1 failed'
fi
echo 'End of archive part 5'
echo 'File argus-1.5/man/man1/tcpdump.1 is continued in part 6'
echo 6 > _sharseq.tmp
exit 0


