Missing sport / dport for Argus 3.0.8

Kjell Tore Fossbakk via Argus-info <[email protected]>
Newsgroups gmane.network.argus
Message-ID <CABNi_Ayj2y7_MPBXvF6Jvpti3Vv_Pk144F5u7iyG9R9F5uHz9g@mail.gmail.com>
Hello.

Im running Argus Version 3.0.8 (same with clients) with libpcap 1.5.3.
Previously we ran Argus Version 3.0.6.1 with libpcap 1.1.1.

We use ra with DELIMITERS "," and a list of fields, such as sport and
dport. If we have an ICMP with sport=0, or TCP/UDP with sport=0/dport=0 and
run this through both these Argus versiosn we get the following behavior;

Using Argus 3.0.6.1 with libpcap 1.1.1 we get 0x0000 as sport for ICMP.
Using Argus 3.0.6.1 with libpcap 1.1.1 we get 0 as sport / dport for
TCP/UDP.
For 3.0.0.6.1 we would seem to get sport 0 as icmp type=0, and sport 8 as
icmp type=8.

When Now, when we use the newest version;
Using Argus 3.0.8 with libpcap 1.5.3 we get <empty data> as sport for ICMP
where we got 0x0000 for 3.0.6.1
Using Argus 3.0.8 with libpcap 1.5.3 we get <empty data> as sport/dport for
TCP/UDP where we got sport/dport 0 for 3.0.6.1

By <empty data> we mean there is nothing between the delimited on the
output.

I'v tried to read ChangeLogs, CHANGES etc in argus, argus-clients, libpcap.
Also did a little "grepping" without much success.

So, something must have changed. Question is was the change in Argus or
libpcap? Was it deliberate, or is this a bug?

Kjell Tore
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.