Re: OT: Recording IM sessions

["Alex Butcher, ISC/ISYS" <Alex.Butcher () bristol ac uk>]

--On 21 June 2005 16:21 -0700 Chris Lyon <cslyon () gmail com> wrote:

> This might be a little off topic but we have gotten a few alerts, from
> snort, for people saying things they should not be saying on the
> internet. The problem is, it is a little hard to put the conversation
> back to together and I was wondering if there is a program that is out
> there that will put together IM sessions for me. Any ideas or
> feedback?

Use snort's session tagging on IM rules, log via FLoP, and reassemble 
sessions from the database using FLoP's 'getpacket'. Load the file into 
ethereal, and 'follow TCP stream'.

Best Regards,
Alex.
--
Alex Butcher: Security & Integrity, Personal Computer Systems Group
Information Systems and Computing             GPG Key ID: F9B27DC9
GPG Fingerprint: D62A DD83 A0B8 D174 49C4 2849 832D 6C72 F9B2 7DC9




-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users