As a starting point I would recommend the bleeding snort ruleset
www.bleedingsnort.com
The primary focus is detection of WHEN p2p and AIM are in use and not by
WHOM.
You could extend the existing rules to include the user information, and
some of them may already do the trick.
I suggest looking at the following files to identify the useful information.
bleeding-p2p.rules
bleeding-policy.rules
To start download the entire ruleset,
http://www.bleedingsnort.com/bleeding.rules.tar.gz.
-Blake
ahmad mubarak wrote:
hi all
i am new in infoSec field so my boss asked me to give him
a list of IM and P2P users in our network
i searched the Internet to find any tool to help in this task but no result
so is there any one can help !!! to achieve this task
ideas , tools , procedures will appreciated
thanx
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------
--
This email and any files transmitted with it are solely intended for the use of
the addressee(s) and may contain information that is confidential and
privileged. If you receive this email in error, please advise us by return
email immediately. Please also disregard the contents of the email, delete it
and destroy any copies immediately. Demarc Security, Inc. does not accept
liability for the views expressed in the email or for the consequences of any
computer viruses that may be transmitted with this email.
This email is also subject to copyright. No part of it should be reproduced,
adapted or transmitted without the written consent of the copyright owner.
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------
