Re: IM & P2P packets

[Eric Hines <eric.hines () appliedwatch com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Ahmad,

Your best bet would be to get approval to deploy some Snort IDS sensors
on some switch span ports or preferably, Taps and go to
www.bleedingsnort.com and download the Bleeding Edge P2P rules.. They
are phenomenal in detecting Limewire, Kazaa, etc traffic on a network..

To eliminate other noise except P2P alerts, comment out all the other
rulesets.



Best Regards,

Eric Hines, GCIA, CISSP
CEO, President
Applied Watch Technologies, LLC


- ---------------------------------------------

Eric Hines, GCIA, CISSP
CEO, President
Applied Watch Technologies, LLC
1095 Pingree Road
Suite 213
Crystal Lake, IL 60014
Toll Free: (877) 262-7593 ext:327
Direct: (847) 854-2725 ext:327
Fax: (847) 854-5106
Web: http://www.appliedwatch.com
Email: eric.hines () appliedwatch com

- --------------------------------------------

"Enterprise Open Source Security Management"


ahmad mubarak wrote:
> hi all
>
> i am new in infoSec field so my boss asked me to give him
> a list of IM and P2P users in our network
>
> i searched the Internet to find any tool to help in this task but no result
>
> so is there any one can help !!! to achieve this task
>
> ideas , tools , procedures will appreciated
>
>
> thanx
>
> ------------------------------------------------------------------------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it 
> with real-world attacks from CORE IMPACT.
> Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
> to learn more.
> ------------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFDk4SobOqF2QHgUK0RAl5UAKDGB1Q3t4HWG28dUHEjcIBII7q2lgCfSqGZ
bbVlc1KFT24yumoQQssDMlw=
=Z39v
-----END PGP SIGNATURE-----

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
------------------------------------------------------------------------