Re: raservices signature file

Hey Michael,
The idea of rauserdata() and raservices() is that the user data fields in argus data can be analyzed to determine signatures of protocols.  These signatures can be used in a classic pattern matching strategy to “discover” the protocols and services that are being employed in a network flow.

rauserdata() processes the user fields of a set of argus flow records and generates signatures for the payloads that were captured.

raservices() will perform pattern matching of an argus record’s users data field(s) against that signature file, and label the flows based on the match.  This gives you some ‘proof of concept’ tools to try to figure out what protocols are running on an arbitrary flow.  Because raservices() can be configured to guess, you can get a best guess labeling for user payloads.

We provide a rudimentary signature file, std.sig, that has some very basic signatures.  FTP, telnet, smtp, pop3, imap, imaps, dns, http, etc…
If you run raservices() with the std.sig, the output will be a label added to the flow record that has the field “srv=“ + the Service: identifier in the std.sig file, if it found a match.

So what kind of label are you getting ???

Carter   

> On Dec 6, 2015, at 11:48 AM, Michael Brookes via Argus-info <[email protected]> wrote:
> 
> Thanks very much.
> What is the general idea of raservices?
> Is there a field which holds the detected protocol that raservices can print?
> I see a label field but this doesn't print what I expect - the
> detected protocol.
> Maybe I've got completely the wrong end of the stick!
> 
> 
> On 6 December 2015 at 01:32, David Edelman <[email protected]> wrote:
>> It is in the client distribution in /support/Config/std.sig
>> 
>> This is really a basic sample but the instructions are in the first few lines of the header:
>> 
>>  rauserdata -d16 -e encode32
>> 
>> --Da ve
>> 
>> -----Original Message-----
>> From: Argus-info [mailto:[email protected]] On Behalf Of Michael Brookes via Argus-info
>> Sent: Saturday, December 5, 2015 4:18 PM
>> To: [email protected]
>> Subject: [ARGUS] raservices signature file
>> 
>> Hello list
>> 
>> Does anyone have an raservices.dat file, the one you pass to raservices to aid in protocol identification?
>> There is mention of it in a flocon presentation but I can't see any man page on the qosient site.
>> 
>> Thanks!
>> 
>