[Snort-users] MSN Chat Rule Help

Ricardo Londoño ricardo at ...7540...
Mon Dec 2 15:42:01 EST 2002

I have tried both rules and nothing!   My AIM rule works great but not the
MSN Messenger!

Would the version of MSN have anything to do with how well the rule works?
I remember an older version of snort would log MSN chat no problems...

anyways, thanks for any suggestions!


----- Original Message -----
From: "Brian" <bmc at ...950...>
To: "Derrick Lichti" <dlichti at ...7267...>
Cc: "Ricardo Londoño" <ricardo at ...7540...>;
<snort-users at lists.sourceforge.net>
Sent: Monday, December 02, 2002 3:42 PM
Subject: Re: [Snort-users] MSN Chat Rule Help

On Mon, Dec 02, 2002 at 04:24:51PM -0500, Derrick Lichti wrote:
> From: Ricardo Londoño [mailto:ricardo at ...7540...]
>> My Current Rule:
>> alert tcp $HOME_NET any -> $EXTERNAL_NET 1863 (msg:"CHAT MSN chat
>> flow:to_server,established; content:"text/plain"; depth:100;
>> classtype:misc-activity; sid:540;  rev:6;)

> alert tcp any 1863 <> $HOME_NET any (msg:"MSN IM Chat Data Logged";
> content:"|746578742F706C61696E|"; depth:100;)

These are the same signature, except the "official one" is a bit less
(Its still crappy and needs revisited, but less so)

"|746578742F706C61696E|" transates to "text/plain".  The original content is
much harder to read than the plain ascii version.  The "official" rule also
flow instead of flags.  I'll look at MSN messenger tonight and see what I
come up with.


This SF.net email is sponsored by: Get the new Palm Tungsten T
handheld. Power & Color in a compact size!
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

More information about the Snort-users mailing list