Argos

1
Argos

• CS 293
• Team 1
• Ben Kaap
• Scott Stuttle
• Shailesh Kochhar
• Sponsor David Young OJC Tech

2
Overview

• What is Argos?
• Why use Argos?
• GUI
• The Future of Argos

3
What is Argos?

• Traffic Monitor
• Protocol Parser
• TCP
• 802.11b
• Visual Troubleshooting Tool
• Side-by-Side log comparisons
• Problem area identification

4
Analyze 802.11b spec

• Local and Metropolitan Area Networks Wireless
  LAN
• Deciphered MAC Frame formats
• MAC Header
• Frame Body
• FCS (Frame Check Sequence)
• Frame Types
• Control Frames
• Management Frames
• Data Frames

5
802.11b Frame Types

• Control Frame
• Network Protocol Instructions
• (Clear to Send, Ready to Send)
• Management Frame
• Network oversight
• Data Frame
• Actual data to be transferred

6
Decipher TCPDump Log Structure

• TCPDump Wrapper
• 802.11 Wrapper
• Ethernet Wrapper
• IP Wrapper
• TCP Wrapper
• Data

TCPDump
802.11
Ethernet
IP
TCP
Data
7
802.11b Dump Files

• TCP / IP

180332.517658 65.59.207.13.80 gt
64.198.214.195.3699 . 2671727(1460) ack 1 win
16985 (DF)
Ôò i ø?Ä 8 8
ÿÿÿÿÿÿ Ú Ú õC5 d ojc
ø?S 8 8 ÿÿÿÿÿÿ Ú ÚõëÑ6 d
ojc ø?Eã 8 8 ÿÿÿÿÿÿ
Ú Ú õb8 d ojc
8
Why use Argos?

• 00055DDAACA800055DDAACA800F56043355B25000000640001
  0000036F6A63010482840B1603010B050400010000F80F9B3F
  18530200380000003800000080000000FFFF
• 00055DDAACA800055DDAACA810F5EBD1365B25000000640001
  0000036F6A63010482840B1603010B050400010000F80F9B3F
  45E30300380000003800000080000000FFFF
• 00055DDAACA800055DDAACA820F51D62385B25000000640001
  0000036F6A63010482840B1603010B050400010000F80F9B3F
  DB740500380000003800000080000000FFFF
• 00055DDAACA800055DDAACA830F5B1F3395B25000000640001
  0000036F6A63010482840B1603010B050400010000F80F9B3F
  95040700380000003800000080000000FFFF
• 00055DDAACA800055DDAACA840F566833B5B25000000640001
  0000036F6A63010482840B1603010B050400010000F80F9B3F
  FE920800380000003800000080000000FFFF
• 00055DDAACA800055DDAACA850F5CE113D5B25000000640001
  0000036F6A63010482840B1603010B050400010000F80F9B3F
  03240A00380000003800000080000000FFFF
• 00055DDAACA800055DDAACA860F5D6A23E5B25000000640001
  0000036F6A63010482840B1603010B050400010000F80F9B3F
  0EB30B00380000003800000080000000FFFF
• 00055DDAACA800055DDAACA850F5CE113D5B25000000640001
  0000036F6A63010482840B1603010B050400010000F80F9B3F
  03240A00380000003800000080000000FFFF
• 00055DDAACA800055DDAACA860F5D6A23E5B25000000640001
  0000036F6A63010482840B1603010B050400010000F80F9B3F
  0EB30B00380000003800000080000000FFFF
• 00055DDAACA800055DDAACA870F5DE31405B25000000640001
  0000036F6A63010482840B1603010B050400010000F80F9B3F
  AE420D00380000003800000080000000FFFF
• 00055DDAACA800055DDAACA880F57CC1415B25000000640001
  0000036F6A63010482840B1603010B050400010000F80F9B3F
  17D30E00380000003800000080000000FFFF
• 00055DDAACA800055DDAACA890F5E351435B25000000640001
  0000036F6A63010482840B1603010B050400010000F90F9B3F
  062101000380000003800000080000000FFFF
• 00055DDAACA800055DDAACA800F56043355B25000000640001
  0000036F6A63010482840B1603010B050400010000F80F9B3F
  18530200380000003800000080000000FFFF
• 00055DDAACA800055DDAACA810F5EBD1365B25000000640001
  0000036F6A63010482840B1603010B050400010000F80F9B3F
  45E30300380000003800000080000000FFFF
• 00055DDAACA800055DDAACA820F51D62385B25000000640001
  0000036F6A63010482840B1603010B050400010000F80F9B3F
  DB740500380000003800000080000000FFFF
• 00055DDAACA800055DDAACA830F5B1F3395B25000000640001
  0000036F6A63010482840B1603010B050400010000F80F9B3F
  95040700380000003800000080000000FFFF
• 00055DDAACA800055DDAACA840F566833B5B25000000640001
  0000036F6A63010482840B1603010B050400010000F80F9B3F
  FE920800380000003800000080000000FFFF
• 00055DDAACA800055DDAACA850F5CE113D5B25000000640001
  0000036F6A63010482840B1603010B050400010000F80F9B3F
  03240A00380000003800000080000000FFFF
• 00055DDAACA800055DDAACA860F5D6A23E5B25000000640001
  0000036F6A63010482840B1603010B050400010000F80F9B3F
  0EB30B00380000003800000080000000FFFF

9
Why use Argos?

• Debugging
• More useful than Ethereal or TCPDump
• More big picture than Kismet
• Variable Strength Power Efficient Networking
• More powerful than a speeding locomotive

10
GUI Take I
11
GUI Take II
12
GUI Demo - Welcome to Argos
13
GUI Demo - Open a Visualization
14
GUI Demo - Add Nodes
15
GUI Demo - View a Timeline
16
GUI Demo - Multiple Timelines
17
GUI Demo Zoom Out
18
The Future of Argos

• Shift-able Timeline
• Save State
• Garbage timeline
• Signal Strength Attribute
• Auto-Detect Conflict

19
Continuing Argos Extensibility

• Using Abstract for extensibility

AbstractParserFactory parser new
DummyParser() Log dl new DummyLog(parser)