[Snort-sigs] Using snort to view/log MSN traffic

Hey there,

I've seen threads on this mailing list and others detailing how to
alert to msn traffic but i have not yet figured out how to amend these
rules to log incoming and outgoing msn traffic.

Im having problems with msn on this network right now and i'd like to
be able to log outgoing traffic when msn sends login details to the
msn server etc.

I somehow figured out a rule a couple of days ago but im running snort
on my linksys wrt54g router and snort etc is stored in the ram so i
lost everything when i cycled the router - my mistake!

So any ideas would be welcomed, i'll include the rules i've found on
mailing lists at the bottom of tihs message.

Rory

Rules:

alert tcp $HOME_NET any -> $EXTERNAL_NET 1863 (msg:"CHAT MSN chat
access"; flow:to_server,established; content:"text/plain"; depth:100;
classtype:misc-activity; sid:540;  rev:6;)

and

alert tcp any 1863 <> $HOME_NET any (msg:"MSN IM Chat Data Logged";
flags:PA;  content:"|746578742F706C61696E|"; depth:100;)


-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs