Argus is an open source project released under the GPLv2 License.  We do want everyone to use Argus, so if the GPL is not to your liking, please contact us for other available licensing options.

Argus is a network audit system.  It is composed of 2 packages. 1) A packet processing network flow sensor, argus, that generates Argus flow data, and 2) a collection of argus data processing programs, called argus-clients which can be coupled to build high performance data flow pipelines that can process network data in real-time, or uncoupled to support large data science analytics, such as statistical analysis and machine learning.  The records can be processed to generate simple reports, such as billing or resource utilization reports on an endpoint basis.  Argus performance metrics can be used to report on degradation of network function or verification of SLAs.  The ability to label network flow data with geospatial information enables reports to be oriented around country, state, and AS number.

Many organizations store Argus records for up to 2 years, to support forensics investigations when a break-in is suspected or to generate compliance reports.

The Argus Project is divided into a number of efforts; data generation, transport, collection, storage, analytics and various metadata enhancements.  People contribute to the project through opinions, testing, bug-fixes, modifications to existing programs and library routines, contributions of whole programs, suggestions on architectural approaches, as well coding style, and marketing, so there are many avenues for contribution.

A key element is the argus data generated by the sensor.  Argus data can be considered is a superset of all the various flow data technologies today, NetFlow, Jflow, Qflow, Kflow, IPFIX, and the historical flow-tools.  It's models, formats, and attributes are designed to support network operations, performance and cyber security, answering questions regarding historical, current and future network activity and use.  The data has over 175 attributes covering network identification, services, resource utilization, and packet dynamics, and can be extended with metadata and content labeling.  The rich  feature set has been used in over 900 academic papers and dozens of PhD and Masters thesis investigating divergent topics ranging from machine learning and analytics for cyber security to SD-WAN chip architecture and design.

The argus sensor has been ported to over 24 platforms, that include all popular OSs, embedded in a number of systems, with support for realtime OSs, like pSoS, VxWorks, as well as modern SDN switches, clouds, VMs and wireless access points.  Keeping argus current has always been a focus of the Argus Project and is a part of the project that can always use some help.

The argus-clients effort focuses on the large number of data processing efforts including but not limited to data distribution, collection, filtering, aggregation, binning, minimization, privacy, metadata enhancement, geolocation, net-spatial location, compression, anonymization, graphing, databases, analytics, storage, and error correction.  With so much to do, you can image that here is a space that can use a lot of help.