Missing sport / dport for Argus 3.0.8
Kjell Tore Fossbakk via Argus-info <[email protected]>
| Newsgroups | gmane.network.argus |
|---|---|
| Message-ID | <CABNi_Ayj2y7_MPBXvF6Jvpti3Vv_Pk144F5u7iyG9R9F5uHz9g@mail.gmail.com> |
Hello. Im running Argus Version 3.0.8 (same with clients) with libpcap 1.5.3. Previously we ran Argus Version 3.0.6.1 with libpcap 1.1.1. We use ra with DELIMITERS "," and a list of fields, such as sport and dport. If we have an ICMP with sport=0, or TCP/UDP with sport=0/dport=0 and run this through both these Argus versiosn we get the following behavior; Using Argus 3.0.6.1 with libpcap 1.1.1 we get 0x0000 as sport for ICMP. Using Argus 3.0.6.1 with libpcap 1.1.1 we get 0 as sport / dport for TCP/UDP. For 3.0.0.6.1 we would seem to get sport 0 as icmp type=0, and sport 8 as icmp type=8. When Now, when we use the newest version; Using Argus 3.0.8 with libpcap 1.5.3 we get <empty data> as sport for ICMP where we got 0x0000 for 3.0.6.1 Using Argus 3.0.8 with libpcap 1.5.3 we get <empty data> as sport/dport for TCP/UDP where we got sport/dport 0 for 3.0.6.1 By <empty data> we mean there is nothing between the delimited on the output. I'v tried to read ChangeLogs, CHANGES etc in argus, argus-clients, libpcap. Also did a little "grepping" without much success. So, something must have changed. Question is was the change in Argus or libpcap? Was it deliberate, or is this a bug? Kjell Tore