topic Re: Instant Messenging monitoring in Network Security https://community.cisco.com/t5/network-security/instant-messenging-monitoring/m-p/435743#M95470 <HTML><HEAD></HEAD><BODY><P>Thank you Alex, this is exactly what I was looking for. I'm just glad the customer wants to track and not alert on these or we'd most likely have to get an always on line to them.</P></BODY></HTML> Tue, 30 Aug 2005 20:11:44 GMT 5creedus 2005-08-30T20:11:44Z Instant Messenging monitoring https://community.cisco.com/t5/network-security/instant-messenging-monitoring/m-p/435740#M95455 <P>Looking to montior IM sessions using IDS. Due to the nature of IM and the many ports it can use, is there another method (string match etc) that can be used to monitor this activity? The use of customer signature(s) is ok.</P> Sun, 10 Mar 2019 09:36:46 GMT https://community.cisco.com/t5/network-security/instant-messenging-monitoring/m-p/435740#M95455 5creedus 2019-03-10T09:36:46Z Re: Instant Messenging monitoring https://community.cisco.com/t5/network-security/instant-messenging-monitoring/m-p/435741#M95460 <HTML><HEAD></HEAD><BODY><P>look at the IPS signatures in the 112xx range.</P></BODY></HTML> Mon, 29 Aug 2005 17:46:01 GMT https://community.cisco.com/t5/network-security/instant-messenging-monitoring/m-p/435741#M95460 scothrel 2005-08-29T17:46:01Z Re: Instant Messenging monitoring https://community.cisco.com/t5/network-security/instant-messenging-monitoring/m-p/435742#M95465 <HTML><HEAD></HEAD><BODY><P>There is a long list of signatures that will probably do what you're looking for. They are as follows (as of S187):</P><P></P><P>11200 - Yahoo Messenger Activity</P><P>11201 - MSN Messenger Activity</P><P>11202 - AIM / ICQ Messenger Activity</P><P>11203 - IRC Channel Join</P><P>11204 - Jabber Activity</P><P>11205 - Sametime Activity</P><P>11206 - ICQ Client DNS Request</P><P>11207 - AIM Client DNS request</P><P>11208 - Yahoo Messenger Client DNS Request</P><P>11209 - MSN Messenger Client DNS Request</P><P>11210 - AIM / ICQ Through HTTP Proxy</P><P>11211 - MSN Messenger Through HTTP Proxy</P><P>11212 - Yahoo Messenger Through HTTP Proxy</P><P>11213 - AOL IM Login</P><P>11214 - AIM/ICQ Message Send</P><P>11215 - AIM/ICQ Message Receive</P><P>11216 - AOL IM Chat - User Join</P><P>11217 - Yahoo Messenger Logon</P><P>11218 - Yahoo Messenger Send Message</P><P>11219 - Yahoo Messenger Receive Message</P><P>11221 - Yahoo Messenger Chat Invitation Activity</P><P>11222 - MSN Login</P><P>11223 - MSN Message Sent</P><P>11224 - MSN Message Received</P><P>11225 - MSN Chat Invitation Sent</P><P>11226 - MSN Chat Invitation Received</P><P>11227 - MSN Chat Invitation Accepted</P><P>11228 - MSN Chat Joined</P><P>11229 - AOL IM Chat - User Leave</P><P>11230 - AOL IM Chat - Incoming Message</P><P>11231 - AOL IM Chat - Outgoing Message</P><P>11232 - AOL IM Chat - Create room</P><P>11233 - SSH Over Non-standard Ports</P><P>11234 - Jabber Logon</P><P>11235 - MSN File Transfer Proposal Sent</P><P>11236 - MSN File Transfer Proposal Received</P><P>11237 - Jabber Chatroom Activity</P><P>11238 - MSNFTP File Transfer</P><P>11239 - ICQ Chat Invitation Sent</P><P>11240 - ICQ Chat Invitation Received</P><P>11241 - ICQ Specific Request</P><P>11242 - ICQ File Transfer</P><P>11244 - MSN P2P File Transfer</P><P>11245 - IRC Server Connection</P><P>11246 - AIM File Transfer Request</P><P>11247 - AIM File Transfer</P><P>11248 - Gadu-Gadu Login</P><P>11249 - Gadu-Gadu IM Message Sent</P><P>11250 - Gadu-Gadu IM Message Received</P><P>11251 - Skype Client Activity</P><P></P><P>According to the config on one of my production sensors, none of these signatures, with the exception of 11245 (subsig 0 and 1), are enabled by default. Therefore, in order to take advantage of them, you will have to use your favourite method (IDM, VMS, etc.) to enable them. Also, since they are "informational" only, you may have to reconfigure your monitoring console to actually see them (IEV, for example, only displays "high" and "medium" events by default).</P><P></P><P>That being said, like anything else, there is a cost in using them (read: potential alarm rate). This will particularly evident if IM is not specifically banned in your environment and you just want to use these signatures to develop some statistics detailing the usage of the various IM applications identified by this group of signatures.</P><P></P><P>I hope this helps,</P><P>Alex Arndt</P></BODY></HTML> Mon, 29 Aug 2005 18:24:25 GMT https://community.cisco.com/t5/network-security/instant-messenging-monitoring/m-p/435742#M95465 a.arndt 2005-08-29T18:24:25Z Re: Instant Messenging monitoring https://community.cisco.com/t5/network-security/instant-messenging-monitoring/m-p/435743#M95470 <HTML><HEAD></HEAD><BODY><P>Thank you Alex, this is exactly what I was looking for. I'm just glad the customer wants to track and not alert on these or we'd most likely have to get an always on line to them.</P></BODY></HTML> Tue, 30 Aug 2005 20:11:44 GMT https://community.cisco.com/t5/network-security/instant-messenging-monitoring/m-p/435743#M95470 5creedus 2005-08-30T20:11:44Z Re: Instant Messenging monitoring https://community.cisco.com/t5/network-security/instant-messenging-monitoring/m-p/435744#M95474 <HTML><HEAD></HEAD><BODY><P>My pleasure. Glad I could help out.</P><P></P><P>Alex Arndt</P></BODY></HTML> Wed, 31 Aug 2005 10:45:15 GMT https://community.cisco.com/t5/network-security/instant-messenging-monitoring/m-p/435744#M95474 a.arndt 2005-08-31T10:45:15Z