使用 Homebrew, apt, dnf, MacPorts, Nix, zypper 安装 argus

项目链接

• 主页
• 仓库
• 上游文档
• 软件包管理器页面

命令和别名

• argus
• argus-airport
• argus-extip
• argus-ipaddr
• argus-ipmitool
• argus-lsof
• argus-netstat
• argus-snmp
• argus-stumbler
• argus-vmstat
• argusbug

项目历史

OpenArgus describes Argus as the first network flow system, developed by Carter Bullard in the early 1980s at Georgia Tech. It was later adapted for cyber-security incident response at the first CERT at Carnegie Mellon's Software Engineering Institute in the late 1980s.

The project models network activity auditing after telephone call detail records: the goal is to account for network activity in a way that supports many management functions, including security. The site emphasizes that Argus is not limited to IP-only traffic and that it aims to produce rich network flow data from packets on the wire or in captures.

OpenArgus now presents the system as two coordinated packages: `argus`, the packet-processing network flow sensor, and `argus-clients`, the programs that process the generated records. Recent OpenArgus release notes describe Argus 5.x as a major sensor and client release with many commits, contributions, and new flow-record features.

采用历史

According to OpenArgus, the software has been used operationally by US Government, US DoD, DHS, DOE, large corporations, and university networks worldwide. The site also describes research use in network performance analysis, situational awareness, cyber security, machine learning, and SDN chip-design work.

Its adoption is helped by a classic source-plus-packages distribution model: OpenArgus notes source builds on Mac OS X, Linux, Unix, and Cygwin-enabled Windows, while the input records packages for Homebrew, Debian/Ubuntu, Fedora, MacPorts, Nix, and openSUSE.

使用方式

The `argus` daemon reads live interfaces or packet captures and writes Argus flow records. Operators then pipe or store those records for processing by the client suite. The official site frames this as real-time network awareness, distributed visibility, active cyber defense, and retrospective analysis.

The server configuration is `argus.conf`; the existing curation cites the official manpage for `/etc/argus.conf`, `$ARGUSPATH/argus.conf`, and `$ARGUSHOME/argus.conf`. Credentials are not a primary documented concept for the daemon package, so the credentials location is null.

为什么软件包爱好者会关心

Argus is significant because it predates many flow-monitoring conventions but still packages cleanly as a modern daemon plus CLI ecosystem. It gives Unix users a source-built, scriptable alternative to appliance-style network telemetry.

For Homebrew users, it is also a reminder that some formulae are not just developer tools: installing `argus` can put a packet-capture daemon and network audit pipeline on a workstation or lab host, with the client formula providing the matching analysis commands.

时间线

• Early 1980s: Carter Bullard develops Argus at Georgia Tech.
• Late 1980s: Argus is adapted for incident response at CERT/SEI.
• 2020s: Development moves to official openargus GitHub repositories.
• 2020s: Argus 5.x becomes the main branch for the sensor and client programs.

Related projects

• argus-clients processes records produced by the Argus sensor.
• OpenArgus relates its data model to NetFlow, Jflow, Qflow, Kflow, IPFIX, and flow-tools.

来源

• https://openargus.org/
• https://openargus.org/documentation
• https://openargus.org/getting-argus
• https://openargus.org/using-argus