Re: Sniffing ICQ traffic

["Ivan Coric" <ivan.coric () workcoverqld com au>]

ninja site for tcpdump/ethereal filters

http://home.insight.rr.com/procana/

enjoy
Ivan


Ivan Coric CISSP
IT Technical Security Officer
Information Technology
WorkCover Queensland
Ph: (07) 30066414 Fax: (07) 30066424
Email: ivan.coric () workcoverqld com au

> > > <ttsoares () orion ufrgs br> 11/11/03 02:55am >>>
Quoting Jeremiah Cornelius <jeremiah () nur net>:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On Monday 10 November 2003 05:40, Marcos Machado wrote:
> > Does anybody know about any tool to sniff ICQ traffic?
> >
> > I've been searching for a week without success. I am currently using the 
> > msgsnarf from dsniff package (2.3), but it works only with a limited 
> > version (2k) and the protocol has changed. Nowadays, it's quite useless.
>
> Ethereal:
> http://www.ethereal.com/ 
>
> Win32 Complete Installer:
> http://download.openxtra.com/epa/3_1_0/Network/Ethereal_XTRA.exe 
>
> "Because anything less, would be uncivilized."
>
> Protocol reassembly - "ICQ"
> Tools - "Follow TCP Stream"

By the way... do you know a good text or some examples about how do write
filters to ethereal?  The syntax, variables, etc...

Thks.



-------------------------------------------------
This mail sent through IMP: http://horde.org/imp/ 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html 






***************************************************************************
Messages included in this e-mail and any of its attachments are those
of the author unless specifically stated to represent WorkCover Queensland. The contents of this message are to be used 
for the intended purpose only and are to be kept confidential at all times.
This message may contain privileged information directed only to the intended addressee/s. Accidental receipt of this 
information should be deleted promptly and the sender notified.
This e-mail has been scanned by Sophos for known viruses.
However, no warranty nor liability is implied in this respect.
**********************************************************************

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html