Re: [Full-Disclosure] Decode Messenger conversations from logs

["Dean" <dispacct@xxxxxxxxxxx>]

Thanks Bill,

Unfortunately the way that Wingate is set up, it uses a different port for
each conversation (or so it appears from the decode window in Iris on the
Wingate server machine). This makes it difficult to determine which ports
are used and therefore to set Ethereal to decode those ports as IM.

What I was hoping to find was a perhaps a 3rd party app, or add-on, to parse
the logs and automitically determine if the traffic on a certain port was IM
or not and decode it as necessary.

Thanks for replying,

Dean

----- Original Message ----- 
From: "Bill Royds" <full-disclosure@xxxxxxxxx>
To: <full-disclosure@xxxxxxxxxxxxxxxx>
Sent: Wednesday, April 14, 2004 1:24 AM
Subject: RE: [Full-Disclosure] Decode Messenger conversations from logs


> You can use Ethereal to decode it. One Ethereal option is to tell it to
> decode port y as protocol z. This allows one to decode a port as IM.
>
> -----Original Message-----
> From: full-disclosure-admin@xxxxxxxxxxxxxxxx
> [mailto:full-disclosure-admin@xxxxxxxxxxxxxxxx] On Behalf Of Dean
> Sent: April 13, 2004 11:28 AM
> To: full-disclosure@xxxxxxxxxxxxxxxx
> Subject: [Full-Disclosure] Decode Messenger conversations from logs
>
> Any recommendations for a good IM conversation 'reconstructer' from Iris
> capture logs.
>
> Running Iris on a small network that uses Wingate to share the broadband
> connection. Unfortunately the built in email/msn etc filters are set to
work
> on certain ports (I guess) and don't decode the traffic in a very
human-eye
> friendly way.
>
> So can anybody suggest something that does it instead of Iris or something
> to run over the logs to get that output?
>
> Thanks in advance
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html