Re: Argus on FreeBSD
Carter Bullard <[email protected]> Tue, 4 Jul 2017 13:12:18 -0400
| Newsgroups | gmane.network.argus |
|---|---|
| Message-ID | <[email protected]> |
Hey Monah, Seems like its not either in this case. I suspect either a firewall rule or a tcp_wrappers issue. You can run radium with -D4 and not the “-d” and let radium tell you want it going on ??? ./radium -XD 4 -S localhost:562 -P 561 Carter > On Jul 4, 2017, at 1:08 PM, Monah Baki <[email protected]> wrote: > > root@devsrvr:/usr/local/argus/bin # cat /etc/radium.conf > RADIUM_CLASSIFIER_FILE=/etc/ralabel.conf > > > Added the -X per your request,no luck. > > root@devsrvr:/usr/local/argus/bin # ps -ax > 59324 - Ss 0:00.39 ./radium -XS localhost:562 -P 561 -d > 59241 0 S 0:01.43 ./argus -s -m -U 256 -i em0 -P 562 -d > > > No results while running, but still getting results on 562 > ./ratop -S localhost:561 -s time saddr sport daddr dport sco dco suser:45 duser:30 > > Monah > > On Tue, Jul 4, 2017 at 1:00 PM, Carter Bullard <[email protected] <mailto:[email protected]>> wrote: > Sure there isn’t an /etc/radium.conf file ?? > Just to be sure, try putting a ‘X’ as the first argument to radium. > > ./radium -XS localhost:562 -P 561 -d > > Carter > >> On Jul 4, 2017, at 12:31 PM, Monah Baki <[email protected] <mailto:[email protected]>> wrote: >> >> Hi Carter, >> >> This is what I am running (argus, radium and ratop) on the freebsd locally: >> >> ./argus -s -m -U 256 -i em0 -P 562 -d >> ./radium -S localhost:562 -P 561 -d >> >> Now if I run on the freebsd locally: >> ./ratop -S localhost:562 >> I get results >> >> Else if I run >> ./ratop -S localhost:561 >> No results >> >> Also if I run: >> ./ratop -S 192.168.1.253:561 <http://192.168.1.253:561/> >> No results >> >> I get none >> >> Thanks >> Monah >> >> >> On Tue, Jul 4, 2017 at 11:53 AM, Carter Bullard <[email protected] <mailto:[email protected]>> wrote: >> You need to BIND to localhost, if you want to access via localhost. If BIND is to a specific address, you’ll need to “-S “ to the address. If you want to access from localhost and the specific IP address, don’t use BIND … use a firewall to control who can get to argus or radium. With radium and argus running together, usually argus BINDS to localhost, so anything external to the machine has to go through radium. >> >> The v6 vs v4 shouldn't really be an issue, both argus and radium put down a “generic” listen down on the port (layer 4), which the os can support on any transport layer it likes (layer 3), so either v4 or v6 works fine. >> >> All clients will try both v6 and v4 when it tries to get a connection, this is controlled by the os, so it shouldn’t matter. >> >> Hope all is most excellent, >> Carter >> >> >>> On Jul 4, 2017, at 11:38 AM, Monah Baki <[email protected] <mailto:[email protected]>> wrote: >>> >>> root radium 49424 3 tcp6 *:561 *:* >>> >>> >>> On Tue, Jul 4, 2017 at 11:37 AM, mike tancsa <[email protected] <mailto:[email protected]>> wrote: >>> >>> Try >>> sockstat | grep 561 >>> >>> to see what is bound on port 561 as it does not seem to be argus >>> >>> ---Mike >>> >>> On 7/4/2017 11:29 AM, Monah Baki wrote: >>> > root argus 49407 3 tcp4 192.168.1.253:562 <http://192.168.1.253:562/> >>> > <http://192.168.1.253:562 <http://192.168.1.253:562/>> *:* >>> > root argus 49407 6 udp4 *:* *:* >>> > root argus 49407 7 tcp4 192.168.1.253:562 <http://192.168.1.253:562/> >>> > <http://192.168.1.253:562 <http://192.168.1.253:562/>> 192.168.1.253:40196 <http://192.168.1.253:40196/> >>> > <http://192.168.1.253:40196 <http://192.168.1.253:40196/>> >>> > >>> > >>> > In my argus.conf, I did specify the IP address to bind to. >>> > ARGUS_BIND_IP="192.168.1.253" >>> > >>> > >>> > >>> > Thanks >>> > Monah >>> > >>> > On Tue, Jul 4, 2017 at 11:07 AM, Mike Tancsa <[email protected] <mailto:[email protected]> >>> > <mailto:[email protected] <mailto:[email protected]>>> wrote: >>> > >>> > On 7/3/2017 11:42 AM, Monah Baki wrote: >>> > > >>> > > Compiled yesterday argus 3.0.8.2 on FreeBSD 10.3-RELEASE-p18. I noticed >>> > > that running: >>> > > >>> > > netstat -an >>> > > tcp4 0 0 *.562 >>> > > tcp6 0 0 *.561 >>> > >>> > > Is it possible that tcp6 might be the issue, not sure why it's running >>> > > on tcp6 when in my rc.cong I have the following: >>> > I usually tell it to bind to a specific IP in my argus config to make it >>> > more predictable. But what does >>> > >>> > sockstat | grep argus >>> > >>> > show ? >>> > >>> > ---Mike >>> > >>> > >>> > -- >>> > ------------------- >>> > Mike Tancsa, tel +1 519 651 3400 <tel:%2B1%20519%20651%203400> <tel:%2B1%20519%20651%203400 <tel:%2B1%20519%20651%203400>> >>> > Sentex Communications, [email protected] <mailto:[email protected]> <mailto:[email protected] <mailto:[email protected]>> >>> > Providing Internet services since 1994 www.sentex.net <http://www.sentex.net/> >>> > <http://www.sentex.net <http://www.sentex.net/>> >>> > Cambridge, Ontario Canada http://www.tancsa.com/ <http://www.tancsa.com/> >>> > >>> > >>> >>> >> >> > >