msn messenger filter

[gleggans]

I am new to sniffer and want to watch for the msn messenger on our network anyone have a filter for this

How about a fountian of smart
we have enough youth

 

[edmtz75]

First you need to know that messenger uses html to transfer data and the ip changes because it has many adresses to enter to logginet.passport.com, so you have to create a filter profile that search the DNS query to logginet.passport.net and destiny UDP port to 53 ( DNS), a data pattern to look up to UDP 1900, I'm not pretty sure of this packet but it appear in my capture, so it culd be optional. Next you could use port 80 and 443 to data. The secuence i have is

Destiny UDP Port 1900
Destiny TCP Port 1863 at an "DNS name" messenger.com ( IP changes in every connection)
Destiny UDP Port 53
DNS Query loginnet.passport.net
Destiny TCP Port 443
Destiny TCP Port 80 at "DNS Name" messenger.msn.com ( IP changes in every connection)
DNS Query svcs.microsoft.net
I hope this work, I haven't prove yet

Regards