Re: Very basic query... MAC address

Hi Dave/Carter/Argus list,

Apologies for responding a while after the initial query... It took a while
to hook the box to the span port thus a while for me to get my hands on the
data flow.

Recap : I am trying to pull the source mac address from the traffic going
from our aruba conroller to the internet... I can see the traffic however I
am not yet able to pull the source mac address. This is what I have done so
far:

argus -X -d -m -i eth0 -P 561

and then : ra -S localhost:561 -s stime daddr saddr smac

The above did not give me the source mac address... I can see the stime,
daddr, and saddr... but no MAC address. I tried ratop -S localhost:561
too... gives me all the other data but the mac address.

Please find below the output for ra -S localhost:561 -N 20 -s +smac +dmac
-L0

[image: Inline image 1]

... any help you are able to offer will be most appreciated. I am currently
trying Carter's recommendations and will follow up if I see a different
outcome.

Many thanks in advance.

Kind Regards,
Muneer


On Thu, May 12, 2016 at 6:23 PM, David Edelman <[email protected]> wrote:

> This should work unless there is some conflict with the argus.conf file. I
> suggest that you use this command line
>
>
>
> argus  -X -d -m -i dup:eth0,eth1 -P 561
>
> The –X must be the first parameter.
>
> I expect that you are using something like ra –S localhost:561 –s stime
> daddr saddr smac to display the output.
>
> Just a side note, you are not capturing netflow data but network flow
> data. Netflow is a Cisco protocol that would not have any MAC information.
> The smac and dmac fields are used to show the source and destination
> interface numbers for the netflow derived flows.
>
> If none of this works, please post the output of this command
>
> ra –S localhost:561 –N 20 –s +smac +dmac –L0
>
>
>
> --Dave
>
>
>
>
>
>
>
> *From:* Argus-info [mailto:argus-info-bounces+dedelman=iname.com@lists.
> andrew.cmu.edu] *On Behalf Of *Noman Muneer via Argus-info
> *Sent:* Thursday, May 12, 2016 4:37 PM
> *To:* Argus <[email protected]>
> *Subject:* Re: [ARGUS] Very basic query... MAC address
>
>
>
> Hi,
>
> A little information on what I am trying to do.
>
> My organization has Aruba controllers however we do not have the ability
> to log the traffic. I will be placing a TAP in front of the Aruba
> controller and running Argus on a box to capture netflow data. I would like
> to capture the time, dst_ip, src_ip, and MAC address of src device. I have
> been able to capture all the data except for the MAC address on a test
> setup.
>
> The command I am using is as follows:
>
> argus -d -m -i dup:eth0,eth1 -P 561
>
> Am I doing something wrong? Or is my concept out-of-whack, so to speak?
>
> Any feedback/guidance will be most appreciated indeed.
>
> Thank you.
>
> Kind Regards,
>
> Noman Muneer
>