How can I monitor all AIM traffic with ethereal/tethereal?
Linux - SecurityThis forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
Well, in theory, you could try to decode all ports by adjusting the tcpdump filters, but you would need a MASSIVE system to handle that kind of traffic.
Originally posted by Matir Well, in theory, you could try to decode all ports by adjusting the tcpdump filters, but you would need a MASSIVE system to handle that kind of traffic.
No you wouldn't ... look at snort. It does inspection of every frame it hears and you can run it on "moderate" systems at best.
Quote:
Originally posted by abefroman
but AIMsniff only monitors 1 port, i have AIM traffic that i noticed on alteast ports 5090 and 5091
AimSniff will do promiscuous monitoring of the network (you'll need a SPAN port in your switch to plug this box into or you won't hear anything). It'll catch all AIM traffic to and from your network (and double log traffic from one user on your network to another user on your network )
I log aim traffic for about 150 users on a 550 P3 running FreeBSD. It's not exactly what I'd call "sizeable", especially considering it's running MySQL, Apache, PHP and Horde for about 50 of those users to work a shared IMAP folder that averages 1500 messages.
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.