Argus
Argus is an open-source network audit system that creates flow data from network traffic.
What Argus is
Argus is an open-source network audit system that creates flow data from network traffic. It has two main parts: a packet sensor called argus, which processes live traffic or captured packets, and argus-clients, which process the resulting data. Clients can feed real-time pipelines or support analytics. Argus data has over 175 attributes covering network identification, services, resource use, and packet dynamics, and includes formats such as NetFlow, Jflow, Qflow, Kflow, and IPFIX. The project describes uses in security, performance analysis, operations, forensics, machine learning, and research. Data can be kept in filesystem archives, MySQL tables, or both. Clients support country-code lookup through InterNIC and can be configured to use MaxMind GeoIP. The ranonymize client can mask addresses and other fields, though the project cautions that this is not perfect anonymization. Argus is free and released under GPLv2. General binary distributions are no longer provided; users can build from source, and some Linux variants maintain packages.
Good
- Processes live packets or capture files.
- Offers over 175 flow-data attributes.
- Supports filesystem archives and MySQL storage.
- Clients can form real-time processing pipelines.
- Free and released under GPLv2.
Watch out
- General binary distributions are no longer provided.
- Anonymization is not perfect.
- Source requires libpcap and GNU bison.
Who it suits
Argus suits network teams that need flow-based visibility for security, performance, operations, or research. It is for users comfortable building from source or using a maintained package where available.
Verdict
Argus provides a broad flow-data toolkit for network analysis, with flexible processing and storage options. Plan for source builds or check whether your Linux variant maintains a package.
The facts
Each one read from Argus's own pages, with the date it was checked.
What it does
- Analysis
- Argus flow records are used for network security, performance analysis, operations management, forensics, and machine learning.checked 8 Oct 2026
- Anonymization
- The ranonymize client can anonymize network addresses and other fields, but the maker cautions that its default protection is not perfect.checked 8 Oct 2026
- Components
- The system consists of the Argus packet processing sensor and the argus-clients data processing programs.checked 8 Oct 2026
- Data storage
- Argus data can be stored in filesystem archives or MySQL tables, and the maker describes using both together.checked 8 Oct 2026
- Dependency and remote access
- Argus source requires libpcap and GNU bison, and the maker says it can be linked with cyrus-sasl for remote access security.checked 8 Oct 2026
- Distribution
- The project says it no longer provides general binary distributions; users can build packages from source, and some Linux variants provide maintained packages.checked 7 Oct 2026
- Flow attributes
- The maker says Argus data includes over 175 attributes covering network identification, services, resource utilization, and packet dynamics.checked 8 Oct 2026
- Flow data
- The site says Argus data has over 175 attributes covering network identification, services, resource utilization, and packet dynamics.checked 7 Oct 2026
- Geolocation
- Argus clients support country-code lookup through InterNIC databases and can be configured to use MaxMind GeoIP libraries and databases.checked 8 Oct 2026
- Integrations
- The clients can use InterNIC country-code databases and can be configured to use MaxMind GeoIP libraries and databases.checked 7 Oct 2026
- License
- Argus is released under GPLv2, and the maker invites inquiries about other licensing options.checked 8 Oct 2026
- Payload capture
- Payload capture in flow records is configurable and disabled by default; the maker says anonymization removes payload data.checked 8 Oct 2026
- Privacy
- The ranonymize client can anonymize network addresses and other fields by default, but the site warns this is not perfect anonymization.checked 7 Oct 2026
- Processing
- The sensor can process packets on the wire or in captures, and the clients can be combined into real-time data pipelines or used for analytics.checked 7 Oct 2026
- Protocols and formats
- The maker describes Argus data as a superset of flow technologies including NetFlow, Jflow, Qflow, Kflow, and IPFIX.checked 8 Oct 2026
- Purpose
- Argus is an open source network audit system that generates flow records from network traffic.checked 8 Oct 2026
- Storage
- The site describes storing Argus data in native filesystem archives or MySQL tables, including use of both approaches together.checked 7 Oct 2026
- Support
- The project provides announcement and development mailing lists and directs users to mailing lists or QoSient for contact.checked 8 Oct 2026
- Supported flow formats
- The site describes Argus data as encompassing NetFlow, Jflow, Qflow, Kflow, IPFIX, and historical flow-tools formats.checked 7 Oct 2026
- Uses
- The project says Argus data has been used for network security, performance analysis, operations management, machine learning, and network research.checked 7 Oct 2026
The company
- Headquarters
- New York, New York, United Stateschecked 28 Sep 2026
Where it runs
- Platforms
- The maker says Linux packages are available and mentions source compilation on Mac OS X, Unix, and Cygwin-enabled Windows; endpoint sensor binaries for Windows and macOS are available upon request.checked 8 Oct 2026
Alternatives to Argus
- 1
ntopng
Free planOpen sourceWebAPILinuxmacOS8.3€299.95 one-time - 2
ManageEngine NetFlow Analyzer
Free planAndroidiOSWebLinux7.1From $172 a month - 3
ElastiFlow
Free planWebAPILinuxSelf-hosted6.9Free plan - 4
FlowViewer
Free planWebLinux6.8$500 one-time - 5
SparrowIQ
AndroidiOSWebWindows6.6 - 6
Plixer Scrutinizer
WebAPISelf-hosted6.5From $12,996 a year