Re: Argus output flows with swapped src/dst IPs and src/dst ports
[email protected] Sat, 30 Nov 2019 10:38:32 -0500
| Newsgroups | gmane.network.argus |
|---|---|
| Message-ID | <[email protected]> |
--Apple-Mail=_A7DC370E-3599-4772-AC5D-E896D90D1A44
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
charset=utf-8
Hey Hang,
Bi-directional flow level semantics are different from packet level =
semantics, especially with regard to src and dst. So who is the src and =
dst in a flow where they are both transmitting and receiving ?? Is it =
the first to send ?? maybe not when you have very long lived flows that =
are idle for long periods of time, or in asymmetric routing where you =
don't see the first packet, or in this case where you anonymize out the =
time to where multiple packets have the same uSec timestamps and you =
can=E2=80=99t tell which packet was first. For some people, the Src and =
Dst are relative assignements base on geo or net-spatial criteria. They =
want the local host be the source when the 2 parties are not in the same =
local network. This is legitimate for some ACL tests and useful for =
visualization and analytics where they want the src / local address on =
the left (some like the source on the left and dest on the right in =
tables).
Argus uses a lot of conditions to decide who is the source, or better =
the initiator of the flow. As a bi-directional flow sensor, Argus has =
to deal with matching a packet in either direction to the same flow, so =
who gets to be the source and who gets to the destination ??? When =
it's TCP, argus and the clients use the TCP state to determine who =
initiated the flow. Who sent the SYN, who sent the SYN/ACK =E2=80=A6 =
for some protocols, like DNS where the transaction has client server =
specific semantics, its who sent the request, who sent the response =E2=80=
=A6 should that indicate who the client and server are ????? For some, =
its more important to know that the protocol response came from 1.2.3.4, =
regardless of who transmitted first, or what port is being used. And of =
course from a cyber security perspective, most covert channels and =
attempts to fool the sensor use well know ports as the source port of a =
transaction. All of this is fair game when you=E2=80=99re trying to =
build a generic sensor ...
OK with that said, what does it mean. When I run your command, I get =
=E2=80=A6
set:Desktop carter$ argus -r *.pcap -w - | ra
StartTime Flgs Proto SrcAddr Sport. Dir DstAddr =
Dport SrcPkts DstPkts SrcBytes DstBytes State=20
07/04.20:28:33.1 e tcp 82.26.219.252.4104 <? =
175.16.10.94.443 0 2 0 598 CON
The key to this is the =E2=80=98 ? =E2=80=98 in the dir(ection) field. =
This is a TCP connection, and =E2=80=98 ? =E2=80=98 indicates that there =
wasn=E2=80=99t a SYN or SYN/ACK seen to reveal who requested the TCP. =
The clients have the option to figure it out (guess). My clients are =
configured to put the service port as the destination when the clients =
get to guess.
In my ~/.rarc=20
RA_PORT_DIRECTION=3D"services,wellknown"
So my clients put the =E2=80=9C 443 =E2=80=9C port on the right, with =
the arrow going to the left, because there is no additional information =
to nail down who initiated the connection. DstPkts become > zero, as =
the destination is transmitting to the source.
This is all important for argus analytics. Here is the same flow =
record, but called without the use of the rarc configuration file =E2=80=A6=
(-X option)
set:Desktop carter$ argus -r *.pcap -w - | ra -X
StartTime Flgs Proto SrcAddr Sport. Dir DstAddr =
Dport SrcPkts DstPkts SrcBytes DstBytes State=20
07/04.20:28:33.1 e tcp 175.16.10.94.443 ?> =
82.26.219.252.4104 2 0 598 0 CON
Regardless of the configuration, the clients are free to guess only when =
there is no SYN or SYN/ACK. You can force the assignments, but you have =
to tell the clients to force it. If you cluster a lot of records =
together, they preserve all the TCP flags such that if this =
direction-less flow is merged with the previous flow record that has the =
SYN or SYN/ACK in it, it will figure out what the =E2=80=98 real =E2=80=98=
direction should be.
Hope this helps !!!
Carter
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 <http://qosient.com/> =09
Carter Bullard=C2=A0=C2=A0 <mailto:[email protected]>=E2=80=A2 =
Chairman / Founder / CTO
150 E 57th Street, Suite 12D
New York, New York 10022-2795
Phone +1.212.588.9133 =E2=80=A2 Mobile +1.917.497.9494
=20
> On Nov 29, 2019, at 2:42 PM, Hang Guo <[email protected]> wrote:
>=20
> Hi,
>=20
> I found argus (Version 3.0.8.2), when fed in some pcaps with tcp =
packets, could output flows with swapped src/dst IPs and src/dst ports. =
I attach an example 2-packet pcap (packet IPs and MAC anonymized, =
payload cropped) that could trigger this behavior.
>=20
> Specifically, when I do =20
> argus -r test_anon.pcap -w - | ra -c "," -r - -s stime ltime saddr =
daddr sport dport proto spkts -nn
> =20
> The output is=20
> StartTime,LastTime,SrcAddr,DstAddr,Sport,Dport,Proto,SrcPkts
> =
1562286513.155328,1562286513.155328,82.26.219.252,175.16.10.94,4104,443,6,=
0
> 1575055898.822475,1575055897.816590,0,32,0,1,man,0
>=20
> While test_anon.pcap shows two tcp packets from 175.16.10.94 to =
82.26.219.25, argus output shows a tcp flow from 82.26.219.252 to =
175.16.10.94 with 0 packets (since SrcPkt=3D0). And the src and dst =
ports in argus output are also swapped. I wonder what goes wrong in this =
case?
>=20
> Thanks and happy thanksgiving!=20
> -Hang=20
>=20
> =20
> <test_anon.pcap>
--Apple-Mail=_A7DC370E-3599-4772-AC5D-E896D90D1A44
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
charset=utf-8
<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; =
charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; =
-webkit-nbsp-mode: space; line-break: after-white-space;" class=3D"">Hey =
Hang,<div class=3D"">Bi-directional flow level semantics are different =
from packet level semantics, especially with regard to src and dst. =
So who is the src and dst in a flow where they are both =
transmitting and receiving ?? Is it the first to send ?? =
maybe not when you have very long lived flows that are idle for =
long periods of time, or in asymmetric routing where you don't see the =
first packet, or in this case where you anonymize out the time to where =
multiple packets have the same uSec timestamps and you can=E2=80=99t =
tell which packet was first. For some people, the Src and Dst are =
relative assignements base on geo or net-spatial criteria. They =
want the local host be the source when the 2 parties are not in the same =
local network. This is legitimate for some ACL tests and useful =
for visualization and analytics where they want the src / local address =
on the left (some like the source on the left and dest on the right in =
tables).</div><div class=3D""><br class=3D""></div><div class=3D"">Argus =
uses a lot of conditions to decide who is the source, or better the =
initiator of the flow. As a bi-directional flow sensor, Argus has =
to deal with matching a packet in either direction to the same flow, so =
who gets to be the source and who gets to the destination ??? =
When it's TCP, argus and the clients use the TCP state to determine who =
initiated the flow. Who sent the SYN, who sent the SYN/ACK =E2=80=A6=
for some protocols, like DNS where the transaction has client server =
specific semantics, its who sent the request, who sent the response =E2=80=
=A6 should that indicate who the client and server are ????? For =
some, its more important to know that the protocol response came from =
1.2.3.4, regardless of who transmitted first, or what port is being =
used. And of course from a cyber security perspective, most =
covert channels and attempts to fool the sensor use well know ports as =
the source port of a transaction. All of this is fair game when =
you=E2=80=99re trying to build a generic sensor ...</div><div =
class=3D""><br class=3D""></div><div class=3D"">OK with that said, what =
does it mean. When I run your command, I get =E2=80=A6</div><div =
class=3D""><br class=3D""></div><div class=3D""><div style=3D"margin: =
0px; font-stretch: normal; line-height: normal;" class=3D""><span =
style=3D"font-variant-ligatures: no-common-ligatures; font-style: =
normal; font-size: 11px;" class=3D""><font face=3D"Andale Mono" =
class=3D"">set:Desktop carter$ argus -r *.pcap -w - | =
ra</font></span></div><div style=3D"margin: 0px; font-stretch: normal; =
line-height: normal;" class=3D""><span style=3D"font-variant-ligatures: =
no-common-ligatures; font-style: normal; font-size: 11px;" =
class=3D""><font face=3D"Andale Mono" class=3D""> =
StartTime Flgs Proto =
SrcAddr Sport. Dir =
DstAddr Dport SrcPkts DstPkts SrcBytes DstBytes =
State </font></span></div><div style=3D"margin: 0px; font-stretch: =
normal; line-height: normal;" class=3D""><span =
style=3D"font-variant-ligatures: no-common-ligatures; font-style: =
normal; font-size: 11px;" class=3D""><font face=3D"Andale Mono" =
class=3D"">07/04.20:28:33.1 e tcp =
82.26.219.252.4104 <? 175.16.10.94.443 =
0 2 =
0 598 =
CON</font></span></div></div><div style=3D"margin: 0px; font-stretch: =
normal; line-height: normal;" class=3D""><span =
style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><br =
class=3D""></span></div><div class=3D"">The key to this is the =E2=80=98 =
? =E2=80=98 in the dir(ection) field. This is a TCP connection, =
and =E2=80=98 ? =E2=80=98 indicates that there wasn=E2=80=99t a SYN or =
SYN/ACK seen to reveal who requested the TCP. The clients have the =
option to figure it out (guess). My clients are configured to put =
the service port as the destination when the clients get to =
guess.</div><div class=3D""><br class=3D""></div><div class=3D"">In my =
~/.rarc </div><div class=3D""><div style=3D"margin: 0px; =
font-stretch: normal; line-height: normal;" class=3D""><span =
style=3D"font-variant-ligatures: no-common-ligatures" class=3D""> =
RA_PORT_DIRECTION=3D"services,wellknown"</span></div></div><div =
class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures" =
class=3D""><br class=3D""></span></div><div class=3D""><span =
style=3D"font-variant-ligatures: no-common-ligatures" class=3D"">So my =
clients put the =E2=80=9C 443 =E2=80=9C port on the right, with the =
arrow going to the left, because there is no additional information to =
nail down who initiated the connection. DstPkts become > zero, =
as the destination is transmitting to the source.</span></div><div =
class=3D""><br class=3D""></div><div class=3D"">This is all important =
for argus analytics. Here is the same flow record, but called =
without the use of the rarc configuration file =E2=80=A6 (-X =
option)</div><div class=3D""><br class=3D""></div><div class=3D""><div =
style=3D"margin: 0px; font-stretch: normal; line-height: normal;" =
class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures; =
font-size: 11px;" class=3D""><font face=3D"Andale Mono" =
class=3D"">set:Desktop carter$ argus -r *.pcap -w - | ra =
-X</font></span></div></div><div class=3D""><div style=3D"margin: 0px; =
font-stretch: normal; line-height: normal;" class=3D""><span =
style=3D"font-variant-ligatures: no-common-ligatures; font-size: 11px;" =
class=3D""><font face=3D"Andale Mono" class=3D""> =
StartTime Flgs Proto =
SrcAddr Sport</font>. <font face=3D"Andale Mono" =
class=3D"">Dir =
DstAddr Dport SrcPkts DstPkts SrcBytes DstBytes =
State </font></span></div><div style=3D"margin: 0px; font-stretch: =
normal; line-height: normal;" class=3D""><span =
style=3D"font-variant-ligatures: no-common-ligatures; font-size: 11px;" =
class=3D""><font face=3D"Andale Mono" class=3D"">07/04.20:28:33.1 =
e tcp </font><span =
style=3D"font-family: "Andale Mono";" =
class=3D"">175.16.10.94</span><font face=3D"Andale Mono" class=3D"">.443 =
?> </font><span style=3D"font-family: "Andale =
Mono";" class=3D"">82.26.219.252</span><font face=3D"Andale Mono" =
class=3D"">.4104 2 =
0 598 =
0 CON</font></span></div></div><div class=3D""><br =
class=3D""></div><div class=3D"">Regardless of the configuration, the =
clients are free to guess only when there is no SYN or SYN/ACK. =
You can force the assignments, but you have to tell the clients to =
force it. If you cluster a lot of records together, they preserve =
all the TCP flags such that if this direction-less flow is merged with =
the previous flow record that has the SYN or SYN/ACK in it, it will =
figure out what the =E2=80=98 real =E2=80=98 direction should =
be.</div><div class=3D""><br class=3D""></div><div class=3D"">Hope this =
helps !!!</div><div class=3D""><br class=3D""></div><div class=3D""><div =
class=3D"">Carter<br class=3D""><div class=3D"">
<div dir=3D"auto" style=3D"caret-color: rgb(0, 0, 0); color: rgb(0, 0, =
0); letter-spacing: normal; text-align: start; text-indent: 0px; =
text-transform: none; white-space: normal; word-spacing: 0px; =
-webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: =
break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" =
class=3D""><div dir=3D"auto" style=3D"caret-color: rgb(0, 0, 0); color: =
rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: =
0px; text-transform: none; white-space: normal; word-spacing: 0px; =
-webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: =
break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" =
class=3D""><table id=3D"sig" width=3D"360" cellspacing=3D"0" =
cellpadding=3D"0" border-spacing=3D"0" style=3D"width: 360px; margin: =
0px; padding: 0px;" class=3D""><tbody class=3D""><tr class=3D""><td =
width=3D"142" style=3D"width: 142px; margin: 0px; padding: 0px;" =
class=3D""><a href=3D"http://qosient.com" title=3D"QoSient" =
style=3D"border: none; text-decoration: none;" class=3D""><img =
src=3D"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAR8AAABdCAYAAACcsGKeA=
AAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAACy9JREFUeNrsndt140YShmt=
85n2RgbERCI5gMBEMNgLBEZiOQHAEtCOgHIFGEZCKgNoIyI2AzMArnGkcy5jqC9DVF4D/dw4eR=
ElEo6vr7+oLqokAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBN8CGTctSaz1/=
frivMlJTi7apGn53VBcBixKdW193bVTKNWsfQ2F/eroO6QDixad+uT8pWheFvX9U12OUs2Ebe2=
/4RZgFzaN6u3dt1ebv+EryelJMUqGIRSmUnH5scBWzSjb5zD9OAqb1n34hOwoLDXRflNCWqXcz=
hJWyynWkTiA/wasiXCKLDXTtEQpM7iWPgjqGB+IAY8zmukc5e9Yyt+r/S8J2NapBPjqLW/80G5=
rBSWex1Ujbi7FMpu2wdxKuD+ICQbCPO0dSOc0h7REHGiOdiEJ12xnyRbpgN8QHJwvZQ8zHDqsz=
JEgVVMNN3HA228mVsE4gPiB627ynOJHBB9gnTFubSOneoOhpEaKr41Op/hgu2y48yZadeGcL2S=
6IGU1qiMDTib3XE1c02YMeAyHN9beiSKiI1Cc+R0i957yBAk+rmCH8CM6ZZ9ilufqH8J3hbgwA=
1N9x4ONvV8Ckwo/OKLj4hJypjCdCtTkLXxK9sAeA64km2ELA1RDy50hqGh7e2DN9RvLkesP7Oa=
5/qxkty4o7iTrLmyhNhDgwsUHxOmuFLuWDH++vGhl97wnwPyEh8fnCMHDiR+ZmWk9OlL+tVM5Q=
EACTAJj79kOoX5vOv6loKvfD8qlHzW+798foJyFZ8NpoG+usCn/WR+CRkDzdiay5KxQZAkC3cX=
M9uwc9T0+3O/XSEDYZAzne853w+Gn7Xb8Yrmc9/W3AF9pHPKyM29+rzGFRMNBkjV/WBifIq1ag=
ON+5Y3GsgueYPrxdSTiumHM59hNOOPuvnef6z8IbWMtFbPyT5d6D79SL+RTXuykEgXlQ9hxDDC=
yN8/T0/Z+Zc9cg2j8L3KEd20c19XVX9PCubSDl5Z/l53EHcqzqpLOV8UXV1negPpcPf/TjSg94=
uf07o+CZ1cNyQaw2vJhQRhl4l+eetPpL8PpyOZBJ+xRwe7gPYxSddr8Qk/fi7daKzn1nObkI59=
xQ+w+ik9lVpvmQtcBW+ERK2TthwJ5JbkTO9m9etXHyk7CKRKdPmV51Qu6lyFp+PBvHhQqe18MI=
4dH9UzO+eczk7B4NfmSFVbemt96psvquM/b37PU9PzO8eVB0saf+Wq+A+OQj4wdEm/ff1+8Pul=
D2k51t2lojXtZylip5/tgxbXyfUY2Vpxzomtacu89BcYl5BcuWnIXN+o536m8IiXhsy5ySSyhy=
wFQzbc458TJk2hxzVlUX4N6RPmjf39SJd5LPTlLOzlLNSz6Jrg3UAnwn2esWe1p2KohAcVrYBn=
Lg2hMNS79PZ5j5SiZCU+OiE5zKzI201zn0UEp8d+SflKzR2vZBM7vRk4lPTuuAcrvA0iHQK2Y1=
gg5/iUNzermZh4vOkqTefhYVSI2hbz7bXCEe4G5LfnxdNfCQcM3eOngJbahxXehOmLnOk1HtpJ=
bmvAA1DgDJz8dkEjBh1k/a1h39dArQfTnzLpYrP2vCN7vYUb/d3ReGzEE4RoeFZ6wzFhxMH6Qw=
MNfklZjPVqeTUwkXw+yE+mYgPN8/zFLi8vg1+igh15L5HSXo/kq/47CjOfCV3n9bDv0I485YRY=
YjPwsXnxIhAjGFpR3ETgrXkvg/kJFQWH/EpKF6mzdKjAwoxIexaxgris1zxaSntSuCJ4udhLlU=
v6nIctu9ku4/4bCjuQgk3r1LM8K8mYnvZ5C4+F+HJqhw5zXzGPaV9Mzy1+LlEQz5J+n3E5xhZm=
OfaImbHPhbILhfx0eXzedX0fmuCe56zw/+Me9I/Ipf7kSnnl8j3/6yug2H4s6e4qUq4N9NDJ7z=
jvv9TZu38v7mWTyc+15WLzxzhIU0InyKj41eHcoXmoARIl6K2oHhHZpNG6F4C3/PKtJvcckOdc=
3XCHxzVsuduReJTzTTSHeOAKXKpPDNimmofVh8J/aSJlocdtzGoHedkpK+SeWaIj/Cwq16R+Hy=
a2UtWkXtWU9ThIqgxG/hnQ7tpI5ThXxl3bGCC+Oga91p2OTeOz2wbrqXMIHfNbFh8VQLE1ckDn=
B6M+WhoSFy60Ybks8ql6Jk4EZkjPq8Jn+N1FI2WGdTtcErIjqm3KnJ99e30T7j48sSHlOG4XMd=
LF5975rOvaAqiTv/AiGETWXz+R8hNvchhl84h64WHt4Vm/uEZTUGUJSxBg4zF56zpOX5Z8PNy5=
5CdEfmI8+wwZAUQHyPcMTktLXPlS3f66pRNgufRzymjwMpStpSk2KQ6Xnn8Ee69bPE5aKKfJZ5=
xzp080E+QPnqIT6oGXmgiuFzI4RwpRFoLFx9d9NP3ut2CnrMhfnn9t4mOMiXxe0hqx2jjljhkY=
hsgKD69Ubk5kQdaxuTzcKoE56xTT6t4Yb47RQ/7hXmWnE6tTLEf7FXT6YAFi0+P7v2dPeW98bA=
g/UFvc46hOWTSwBuHcqUWfIpcRm6v1j1cfPniM5z3xDl3rgJkerP695nOcGWiwNirfy1T37ltp=
uOGPOcI931mRLqEm68DXY5fqeTcksJzNJTV17FSnWnWP9eJ0uYTcoHLldQ6/m9HfpkMLxQp6ZU=
HMfP51EL1UedQryanzqGXKQ1llEokvie55FlT2JJfGtUYZWzJL01oR/I5nDcQn3WIT2Fx7jpxu=
G86ObQKZNAY0R/n1FMbwCWwIxaaqGdKWg1f8dEdbRNDeCvH+6xBfE6pnNwkQCmOVi7IfgSwdOP=
bRhSgRuiZpA81tEWEc6LNjsKc2xU6Ot1M6HzXID5J87rbBOgUKQpqyZzYPFSj0z2/tAC1mudqZ=
3wX10lIHaS3E+qIOiFn0Qmh9OpkObrXLYlPmVqAbNni9hRmOdomOhLH47o0vEug4acpmpubHTD=
EmeymObY5DV1KfEyd41ZAdAvizzdbq/gUFPfYptkNRhcJbT2dslGO53KgnUQDcx3nXwzOV88wc=
mv4Tp+0pLYTJ7YTxLq0DHXnRoBS4mPqHN6fM1bMsPfW8L1rFR8ifqW1cLRDRwHnGyvLMIxzzK0=
qVKMq6f3VqN/tyP3guqFC6sjia3v2QXgbjXPXyhFswrqNZKOTKks3skmrPjs62GCu8EuKjy0yG=
0R3R/oXpoe26HJumatzLVV8OtKfWFsy992MRkZdaEd0GQ6FuKROzAw5BJ17Sc9VtOR+HPLUa+c=
ZcUqLT2jbDGWcMrxfqvjY5nltVxfLGVvPgrpeT5TXOzy1sPj6OrOpIW0Ey3oSskMI8Xk/bJe0z=
XHmMy9VfGzTDNmIz3iMfBIWnA3lvXW+nThc5IYCsZ6v8YgMTsQnactRfCQ6xsE2PkP7JYvPnEj=
yRMyixofIDlnS3xuxPhF/yuSY/m3lM307S+xAy8vLWyjnvnv37AXzjP17Yy8ZPGNjsc97e3wl+=
VQe5Uh0rxQuXUj5zjalRlAOqgyS7a9m7hGy/VWB6rP/3nv6Pr3yWV0vgdqIKNtIcx0AAMD2uKY=
l6xJVBAAIOSwzjcVj7d0BANwoHZkn/DqIEAAgZBRkWy3qVx18Xp9oIGIAAJNA2Jbph6W8Ka8GD=
C9CdqhiAOLzYUFlbYk/hnfMsJT4Qt8vKw5LyMMKWv+7z5RX8nUAQMYiJLFzekp2PQAA+EcU4/q=
Ge+zEUgCAG2FIteH6CkeLKgMAhIiINkqMuOFZhyoCID0fbuQ5a/o2v1PS9FNKAQAAAAAAAAAAA=
AAAAAAAAAAAAAAASM3/BRgAaVGndQa4eeAAAAAASUVORK5CYII=3D" alt=3D"QoSient" =
style=3D"border: none; height: 48px; font-family: "Gill Sans", =
sans-serif; font-weight: 100; font-size: 48px; line-height: 48px; color: =
rgb(0, 0, 0);" class=3D""><span =
class=3D"Apple-converted-space"> </span><span =
class=3D"Apple-converted-space"> </span><span =
class=3D"Apple-converted-space"> </span><span =
class=3D"Apple-converted-space"> </span><span =
class=3D"Apple-converted-space"> </span><span =
class=3D"Apple-converted-space"> </span></a><span =
class=3D"Apple-converted-space"> </span><span =
class=3D"Apple-converted-space"> </span><span =
class=3D"Apple-converted-space"> </span><span =
class=3D"Apple-converted-space"> </span></td><td width=3D"20" =
style=3D"width: 16px; min-width: 16px; max-width: 16px; margin: 0px; =
padding: 0px;" class=3D""> </td><td style=3D"margin: 0px; padding: =
0px; border-collapse: collapse;" class=3D""><table id=3D"sig2" =
cellspacing=3D"0" cellpadding=3D"0" border-spacing=3D"0" class=3D""><tbody=
class=3D""><tr class=3D""><td style=3D"font-family: "Gill Sans =
Light", sans-serif; white-space: nowrap;" class=3D""><a =
href=3D"mailto:[email protected] " style=3D"border: none; =
text-decoration: none;" class=3D""><span style=3D"font-size: 16px; =
line-height: 16px; color: rgb(0, 0, 176);" class=3D"">Carter =
Bullard</span><span class=3D"Apple-converted-space"> </span><span =
class=3D"Apple-converted-space"> </span></a><span style=3D"font-size:=
12px; line-height: 14px; color: rgb(0, 0, 0);" class=3D"">=E2=80=A2</span=
><span class=3D"Apple-converted-space"> </span><span =
class=3D"Apple-converted-space"> </span><span style=3D"font-size: =
12px; line-height: 14px; color: rgb(0, 0, 0);" class=3D"">Chairman / =
Founder / CTO</span></td></tr><tr class=3D""><td style=3D"font-family: =
"Gill Sans Light", sans-serif; white-space: nowrap;" =
class=3D""><span style=3D"font-size: 12px; line-height: 14px; color: =
rgb(0, 0, 0);" class=3D"">150 E 57th Street, Suite =
12D</span></td></tr><tr class=3D""><td style=3D"font-family: "Gill =
Sans Light", sans-serif; white-space: nowrap;" class=3D""><span =
style=3D"font-size: 12px; line-height: 14px; color: rgb(0, 0, 0);" =
class=3D"">New York, New York 10022-2795</span></td></tr><tr =
class=3D""><td style=3D"font-family: "Gill Sans Light", =
sans-serif; white-space: nowrap;" class=3D""><span style=3D"font-size: =
12px; line-height: 12px; color: rgb(0, 0, 0);" class=3D"">Phone =
+1.212.588.9133 =E2=80=A2 Mobile =
+1.917.497.9494</span></td></tr></tbody></table></td></tr><tr =
class=3D""></tr></tbody></table><br class=3D""> </div></div>
</div>
<div><br class=3D""><blockquote type=3D"cite" class=3D""><div =
class=3D"">On Nov 29, 2019, at 2:42 PM, Hang Guo <<a =
href=3D"mailto:[email protected]" class=3D"">[email protected]</a>> =
wrote:</div><br class=3D"Apple-interchange-newline"><div class=3D""><div =
dir=3D"ltr" class=3D"">Hi,<br class=3D""><br class=3D"">I found argus =
(Version 3.0.8.2), when fed in some pcaps with tcp packets, could output =
flows with swapped src/dst IPs and src/dst ports. I attach an =
example 2-packet pcap (packet IPs and MAC anonymized, payload cropped) =
that could trigger this behavior.<br class=3D""><br =
class=3D"">Specifically, when I do <br class=3D""><blockquote =
class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px =
solid rgb(204,204,204);padding-left:1ex">argus -r test_anon.pcap -w - | =
ra -c "," -r - -s stime ltime saddr daddr sport dport proto spkts =
-nn</blockquote> <br class=3D"">The output is <blockquote =
class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px =
solid =
rgb(204,204,204);padding-left:1ex">StartTime,LastTime,SrcAddr,DstAddr,Spor=
t,Dport,Proto,SrcPkts<br =
class=3D"">1562286513.155328,1562286513.155328,82.26.219.252,175.16.10.94,=
4104,443,6,0<br =
class=3D"">1575055898.822475,1575055897.816590,0,32,0,1,man,0</blockquote>=
<div class=3D""><br class=3D""></div><div class=3D"">While =
test_anon.pcap shows two tcp packets from 175.16.10.94 to =
82.26.219.25, argus output shows a tcp flow from 82.26.219.252 to =
175.16.10.94 with 0 packets (since SrcPkt=3D0). And the src and dst =
ports in argus output are also swapped. I wonder what goes wrong in this =
case?</div><div class=3D""><br class=3D""></div><div class=3D"">Thanks =
and happy thanksgiving! </div><div class=3D"">-Hang </div><div =
class=3D""><br class=3D""></div><div class=3D""> </div></div>
<span =
id=3D"cid:f_k3kk0oh90"><test_anon.pcap></span></div></blockquote></d=
iv><br class=3D""></div></div></body></html>=
--Apple-Mail=_A7DC370E-3599-4772-AC5D-E896D90D1A44--