Re: IM & P2P packets

[Eric Grejda <eric.grejda () sunrocket com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

ahmad mubarak wrote:

| i am new in infoSec field so my boss asked me to give him
| a list of IM and P2P users in our network
| i searched the Internet to find any tool to help in this task but no
result
| so is there any one can help !!! to achieve this task
| ideas , tools , procedures will appreciated

The Snort and Bleeding Snort rule sets have instant messenger detection
rules in them.  You might want to set up a Snort sensor or two and see
which IP addresses trigger those rules.

Speaking for myself and not my employers, as always.

- --
Eric Grejda
System Administrator, Sunrocket - http://www.sunrocket.com/

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.7 (GNU/Linux)

iD8DBQFDlE6vHJJGEDZR+J8RAi4GAJkBwdYfGawF6ERjnuRRRCdH94TPLgCfe+qE
HwlSJKOs4hEHA01eUtlaUFM=
=emIq
-----END PGP SIGNATURE-----

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
------------------------------------------------------------------------