Install argus with Homebrew, apt, dnf, MacPorts, Nix, zypper

Project links

• Homepage
• Repository
• Upstream docs
• Package manager page

Commands and aliases

• argus
• argus-airport
• argus-extip
• argus-ipaddr
• argus-ipmitool
• argus-lsof
• argus-netstat
• argus-snmp
• argus-stumbler
• argus-vmstat
• argusbug

Project history

OpenArgus describes Argus as the first network flow system, developed by Carter Bullard in the early 1980s at Georgia Tech. It was later adapted for cyber-security incident response at the first CERT at Carnegie Mellon's Software Engineering Institute in the late 1980s.

The project models network activity auditing after telephone call detail records: the goal is to account for network activity in a way that supports many management functions, including security. The site emphasizes that Argus is not limited to IP-only traffic and that it aims to produce rich network flow data from packets on the wire or in captures.

OpenArgus now presents the system as two coordinated packages: `argus`, the packet-processing network flow sensor, and `argus-clients`, the programs that process the generated records. Recent OpenArgus release notes describe Argus 5.x as a major sensor and client release with many commits, contributions, and new flow-record features.

Adoption history

According to OpenArgus, the software has been used operationally by US Government, US DoD, DHS, DOE, large corporations, and university networks worldwide. The site also describes research use in network performance analysis, situational awareness, cyber security, machine learning, and SDN chip-design work.

Its adoption is helped by a classic source-plus-packages distribution model: OpenArgus notes source builds on Mac OS X, Linux, Unix, and Cygwin-enabled Windows, while the input records packages for Homebrew, Debian/Ubuntu, Fedora, MacPorts, Nix, and openSUSE.

How it is used

The `argus` daemon reads live interfaces or packet captures and writes Argus flow records. Operators then pipe or store those records for processing by the client suite. The official site frames this as real-time network awareness, distributed visibility, active cyber defense, and retrospective analysis.

The server configuration is `argus.conf`; the existing curation cites the official manpage for `/etc/argus.conf`, `$ARGUSPATH/argus.conf`, and `$ARGUSHOME/argus.conf`. Credentials are not a primary documented concept for the daemon package, so the credentials location is null.

Why package nerds care

Argus is significant because it predates many flow-monitoring conventions but still packages cleanly as a modern daemon plus CLI ecosystem. It gives Unix users a source-built, scriptable alternative to appliance-style network telemetry.

For Homebrew users, it is also a reminder that some formulae are not just developer tools: installing `argus` can put a packet-capture daemon and network audit pipeline on a workstation or lab host, with the client formula providing the matching analysis commands.

Timeline

• Early 1980s: Carter Bullard develops Argus at Georgia Tech.
• Late 1980s: Argus is adapted for incident response at CERT/SEI.
• 2020s: Development moves to official openargus GitHub repositories.
• 2020s: Argus 5.x becomes the main branch for the sensor and client programs.

Related projects

• argus-clients processes records produced by the Argus sensor.
• OpenArgus relates its data model to NetFlow, Jflow, Qflow, Kflow, IPFIX, and flow-tools.

Sources

• https://openargus.org/
• https://openargus.org/documentation
• https://openargus.org/getting-argus
• https://openargus.org/using-argus