Re: IM & P2P packets

[Blake Hartstein <bhartstein () demarc com>]

As a starting point I would recommend the bleeding snort ruleset 
www.bleedingsnort.com
The primary focus is detection of WHEN p2p and AIM are in use and not by 
WHOM.
You could extend the existing rules to include the user information, and 
some of them may already do the trick.

I suggest looking at the following files to identify the useful information.
bleeding-p2p.rules
bleeding-policy.rules

To start download the entire ruleset, 
http://www.bleedingsnort.com/bleeding.rules.tar.gz.

-Blake


ahmad mubarak wrote:

> hi all
>
> i am new in infoSec field so my boss asked me to give him
> a list of IM and P2P users in our network
>
> i searched the Internet to find any tool to help in this task but no result
>
> so is there any one can help !!! to achieve this task
>
> ideas , tools , procedures will appreciated
>
>
> thanx
>
> ------------------------------------------------------------------------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it 
> with real-world attacks from CORE IMPACT.
> Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
> to learn more.
> ------------------------------------------------------------------------
>
>  


--
This email and any files transmitted with it are solely intended for the use of the addressee(s) and may contain 
information that is confidential and privileged.  If you receive this email in error, please advise us by return email 
immediately. Please also disregard the contents of the email, delete it and destroy any copies immediately.  Demarc 
Security, Inc. does not accept liability for the views expressed in the email or for the consequences of any computer 
viruses that may be transmitted with this email.

This email is also subject to copyright. No part of it should be reproduced, adapted or transmitted without the written 
consent of the copyright owner.


------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
------------------------------------------------------------------------