Re: IM & P2P packets



Probably one of the simplest and cheapest things you could do would be
to sniff data on your network for certain ports. All the P2P software
use unique ports, get a list of say the top20 P2P networks and their
ports and you'll probably the get results you're after.

If you have an IDS you could configure some signatures to alarm on per
port/per session traffic.

Regards,
Lachlan

On Tue, 2005-11-29 at 08:06 +0300, ahmad mubarak wrote:
> hi all
>
> i am new in infoSec field so my boss asked me to give him
> a list of IM and P2P users in our network
>
> i searched the Internet to find any tool to help in this task but no result
>
> so is there any one can help !!! to achieve this task
>
> ideas , tools , procedures will appreciated
>
>
> thanx
>
> ------------------------------------------------------------------------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it
> with real-world attacks from CORE IMPACT.
> Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
> to learn more.
> ------------------------------------------------------------------------
>
>


------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------



Relevant Pages

  • RE: HIDS/HIPS Selection Process
    ... network based, many of the same considerations are suggested. ... Subject: Re: HIDS/HIPS Selection Process ... > with real-world attacks from CORE IMPACT. ...
    (Focus-IDS)
  • Re: IM & P2P packets
    ... > to sniff data on your network for certain ports. ... >> with real-world attacks from CORE IMPACT. ...
    (Focus-IDS)
  • Re: 2 pc network - cant see host files from pc 2 on pc 1
    ... Assuming that you have firewall protection via your internet router try ... workgroup because it will be needed for the network to work correctly. ... see if you can access TCP ports 139 and 445 on computer one of which at ... permissions. ...
    (microsoft.public.windowsxp.security_admin)
  • RE: Scan for "outsider" Pcs on network
    ... If all he wants is to find out when new machines show up, ... If he is interested in more control, he needs a strict network as you ... with real-world attacks from CORE IMPACT. ...
    (Focus-IDS)
  • Re: PC Tools Firewall Question
    ... So, it's to be assumed that the two machines that are connected to your router, the LAN or Local Area Network, are never to share resources or network between the two, which are the ports you're blocking below with the PFW. ...
    (comp.security.firewalls)