Thanks Bill, Unfortunately the way that Wingate is set up, it uses a different port for each conversation (or so it appears from the decode window in Iris on the Wingate server machine). This makes it difficult to determine which ports are used and therefore to set Ethereal to decode those ports as IM.
What I was hoping to find was a perhaps a 3rd party app, or add-on, to parse the logs and automitically determine if the traffic on a certain port was IM or not and decode it as necessary. Thanks for replying, Dean ----- Original Message ----- From: "Bill Royds" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, April 14, 2004 1:24 AM Subject: RE: [Full-Disclosure] Decode Messenger conversations from logs > You can use Ethereal to decode it. One Ethereal option is to tell it to > decode port y as protocol z. This allows one to decode a port as IM. > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Dean > Sent: April 13, 2004 11:28 AM > To: [EMAIL PROTECTED] > Subject: [Full-Disclosure] Decode Messenger conversations from logs > > Any recommendations for a good IM conversation 'reconstructer' from Iris > capture logs. > > Running Iris on a small network that uses Wingate to share the broadband > connection. Unfortunately the built in email/msn etc filters are set to work > on certain ports (I guess) and don't decode the traffic in a very human-eye > friendly way. > > So can anybody suggest something that does it instead of Iris or something > to run over the logs to get that output? > > Thanks in advance > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.netsys.com/full-disclosure-charter.html > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.netsys.com/full-disclosure-charter.html _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
