Re: how to block ALL AIM traffic ?

From: Ramon Kagan (rkagan_at_yorku.ca)
Date: 04/28/05

  • Next message: TOSE: "Re: block MSN Messenger" 
    Date: Thu, 28 Apr 2005 08:17:10 -0400 (EDT)
To: Realized Mofo <realized@gmail.com>

    HI,

    I don't have AIM traffic on my network right now... but what I would do it
    conduct a tcpdump, full packet capture (-s 0) for port 5190 traffic. Then
    I would inspect the payload for a pattern. Once I have a pattern write a
    filter/signature based on it to conduct the packet drop.

    I was hoping to give you a signature or pattern, but we seem to be AIM
    free here.

    Ramon Kagan
    York University, Computing and Network Services
    Information Security - Senior Information Security Analyst
    (416)736-2100 #20263
    rkagan@yorku.ca

    ----------------------------------- ------------------------------------
    I have not failed. I have just I don't know the secret to success,
    found 10,000 ways that don't work. but the secret to failure is
                                           trying to please everybody.
            - Thomas Edison - Bill Cosby
    ----------------------------------- ------------------------------------

    On Tue, 26 Apr 2005, Realized Mofo wrote:

    > I am at an office with 50~ machines , out of thoes about 20 or so use
    > AIM. I would like to block AIM and normally i'd just block the AIM
    > port (5190) or whatever it is..
    >
    > BUT AOL seems to have found a great way around this and has 4000+
    > diffrent ports they use and i'd assume lots of diffrent hosts.
    >
    >
    > Whats the best way of blocking all AIM traffic ?
    >
    >

  • Next message: TOSE: "Re: block MSN Messenger"

    Relevant Pages

    • the classic AOL AIM questions...
      ... students will load AIM onto thier computers. ... So I want to prevent AIM from being used on my network. ... know it uses port 5190, but i also heard that if AIM cant get out on ...
      (comp.os.ms-windows.nt.admin.security)
    • Logitech Quick Cam Zoom
      ... I'm trying to narrow down the ports that AIM ... You can poke a hole in your firewall, ... however I don't know which port it is. ... >have AOL 9.0, you may be able to get help from AOL ...
      (microsoft.public.windowsxp.general)
    • AIM Remote File Transfer/Direct Connection Vulnerability
      ... AIM Remote File Transfer/Direct Connection ... I Discovered this vulnerability while I was port ... A temporary way to protect from the file transfer spy ...
      (Bugtraq)
    • Re: Linksys BEFSR41 and Aim Talk and/or AIM file transfer
      ... >>What is the TCP port that AIM uses? ... a lot of other things don't work behind a router due ... to the NAT involved (which, I insist, is merely how a router does its job, ...
      (comp.security.firewalls)
    • Re: AIM Port Problem
      ... >> AIM, like a port I can change it to or whatever else... ... > AIM, would be security risks. ... I just uninstalled, uninstalled msn, and will jsut use ...
      (comp.security.firewalls)