TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------
Arrgh... :)
with AIM, it is little tricky, since one create a rule on 5190, but that is
really for AOL over TCP/IP. AIM can be sent over any port. if AIM detects
a port is in use, it attempts to use the next one, and so and so on.. It is
a real pain, especially when attempting to block AIM through a firewall or
detect on an IDS. If one uses the sniffer approach, one then can decipher
the packet and develop a regexp rule from there and craft a custom rule,
and then add it to ISS Real Secure. Create the rule outside of ISS Real
Secure, than import it in.. :)
At 10:26 AM 9/16/00 -0500, Matthew F. Caldwell wrote:
>TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
>[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
>----------------------------------------------------------------------------
>
>Like Mark says you would be better off with a sniffer. However if you must
>look at the traffic with real secure. You can create a connections rule in
>your policy to watch for TCP port 5190 (realtime logging and play back).
>Which I believe is the control port of the AIM protocol. Setup AIM on your
>local machine and using netstat -an determine what ports the system is
>communicating on then you can specify those ports in real secure or a
>sniffer
