What it does
Argus combines a network-flow sensor with client tools for processing traffic data used in network operations, performance analysis and investigations.
Choose a live interface or saved PCAP and write Argus flow records, then read them with the client tools such as ra. The sensor supports configurable flow keys and bidirectional or unidirectional tracking, so retain that configuration with an investigation. The live-capture example uses elevated access; build prerequisites include libpcap, a compiler, parser tools and zlib. Coordinate sensor and client versions: Argus 3 clients cannot read Argus 5 data, while the newer clients support older records. The 5.0.2 notes also describe optional encapsulation-buffer capture, which can retain packet content beyond a simple flow summary. The sensor’s published source is GPLv3.
Strengths
- Sensor and analysis client workflow
- Documents data-format compatibility
Watch out for
- Older clients cannot read newer Argus 5 data
Sources
- openargus - Home (Oct 26, 2026)
- Argus sensor workflow and prerequisites (Oct 26, 2026)