Re: IM & P2P packets

[Joel Esler <eslerj () gmail com>]

I would agree with the other assessments of deploying Snort and it's
rulesets to look for P2P and IM.  (see p2p.rules, chat.rules, and
policy.rules)

P2P and IM both have default ports (5190 for AIM, 5050 for Yahoo are a
couple examples) however, I have seen P2P and IM run on any port. 
Basically, it finds a way out.  So just relying on looking for
<i>a</i> particular port won't help you in this case.

Joel

On 12/3/05, Lachlan Bowes <lachlan () silknetworks com> wrote:
> Probably one of the simplest and cheapest things you could do would be
> to sniff data on your network for certain ports. All the P2P software
> use unique ports, get a list of say the top20 P2P networks and their
> ports and you'll probably the get results you're after.
>
> If you have an IDS you could configure some signatures to alarm on per
> port/per session traffic.
>
> Regards,
>         Lachlan
>
> On Tue, 2005-11-29 at 08:06 +0300, ahmad mubarak wrote:
> > hi all
> >
> > i am new in infoSec field so my boss asked me to give him
> > a list of IM and P2P users in our network
> >
> > i searched the Internet to find any tool to help in this task but no result
> >
> > so is there any one can help !!! to achieve this task
> >
> > ideas , tools , procedures will appreciated
> >
> >
> > thanx
> >
> > ------------------------------------------------------------------------
> > Test Your IDS
> >
> > Is your IDS deployed correctly?
> > Find out quickly and easily by testing it
> > with real-world attacks from CORE IMPACT.
> > Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
> > to learn more.
> > ------------------------------------------------------------------------
>
>
> ------------------------------------------------------------------------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it
> with real-world attacks from CORE IMPACT.
> Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
> to learn more.
> ------------------------------------------------------------------------

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------