Argus output flows with swapped src/dst IPs and src/dst ports

--00000000000069fc0405988171c3
Content-Type: multipart/alternative; boundary="00000000000069fc0005988171c1"

--00000000000069fc0005988171c1
Content-Type: text/plain; charset="UTF-8"

Hi,

I found argus (Version 3.0.8.2), when fed in some pcaps with tcp packets,
could output flows with swapped  src/dst IPs and src/dst ports. I attach an
example 2-packet pcap (packet IPs and MAC anonymized, payload cropped) that
could trigger this behavior.

Specifically, when I do

> argus -r test_anon.pcap -w - | ra -c "," -r - -s stime ltime saddr daddr
> sport dport proto spkts -nn


The output is
>
> StartTime,LastTime,SrcAddr,DstAddr,Sport,Dport,Proto,SrcPkts
> 1562286513.155328,1562286513.155328,82.26.219.252,175.16.10.94,4104,443,6,0
> 1575055898.822475,1575055897.816590,0,32,0,1,man,0


While test_anon.pcap shows two tcp packets from 175.16.10.94 to
82.26.219.25, argus output shows a tcp flow from 82.26.219.252 to
175.16.10.94 with 0 packets (since SrcPkt=0). And the src and dst ports in
argus output are also swapped. I wonder what goes wrong in this case?

Thanks and happy thanksgiving!
-Hang

--00000000000069fc0005988171c1
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi,<br><br>I found argus (Version 3.0.8.2), when fed in so=
me pcaps with tcp packets, could output flows with swapped=C2=A0 src/dst IP=
s and src/dst ports. I attach an example 2-packet pcap (packet IPs and MAC =
anonymized, payload cropped) that could trigger this behavior.<br><br>Speci=
fically, when I do =C2=A0<br><blockquote class=3D"gmail_quote" style=3D"mar=
gin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1=
ex">argus -r test_anon.pcap -w - | ra -c &quot;,&quot; -r - -s stime ltime =
saddr daddr sport dport proto spkts -nn</blockquote>=C2=A0<br>The output is=
=C2=A0<blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;b=
order-left:1px solid rgb(204,204,204);padding-left:1ex">StartTime,LastTime,=
SrcAddr,DstAddr,Sport,Dport,Proto,SrcPkts<br>1562286513.155328,1562286513.1=
55328,82.26.219.252,175.16.10.94,4104,443,6,0<br>1575055898.822475,15750558=
97.816590,0,32,0,1,man,0</blockquote><div><br></div><div>While test_anon.pc=
ap  shows two tcp packets from 175.16.10.94 to=C2=A0 82.26.219.25, argus ou=
tput shows a tcp flow from 82.26.219.252 to 175.16.10.94 with 0 packets (si=
nce SrcPkt=3D0). And the src and dst ports in argus output are also swapped=
. I wonder what goes wrong in this case?</div><div><br></div><div>Thanks an=
d happy thanksgiving!=C2=A0</div><div>-Hang=C2=A0</div><div><br></div><div>=
=C2=A0</div></div>

--00000000000069fc0005988171c1--
--00000000000069fc0405988171c3
Content-Type: application/vnd.tcpdump.pcap; name="test_anon.pcap"
Content-Disposition: attachment; filename="test_anon.pcap"
Content-Transfer-Encoding: base64
Content-ID: <f_k3kk0oh90>
X-Attachment-Id: f_k3kk0oh90

1MOyoQIABAAAAAAAAAAAAAAABAABAAAAsZkeXcBeAgA8AAAAKwEAAIbYw24xDEBOEUos+wgARQIA
KBMFQAB5BgdErxAKXlIa2/wBuxAIZthrjm4vZwBQGCAm7scAAAAAAAAAALGZHl3AXgIAPAAAACsB
AACG2MNuMQxAThFKLPsIAEUCACgTBUAAeQYHRK8QCl5SGtv8AbsQCGbYa45uL2cAUBggJu7HAAAA
AAAAAAA=
--00000000000069fc0405988171c3--