Howto Record MSN Messenger conversation ?

zaib · Post by **zaib** » Mon Mar 31, 2008 11:33 am

Salam,

Is there any way we can record users MSN conversation (just for specific security need) which is going through our linux server for all hosts or some particular hosts?

ather_36 · Post by **ather_36** » Mon Mar 31, 2008 4:17 pm

Salam Zaib bhai,
Use ethereal for this purpose.It is possible in ethereal.Well ethereal is builting in RedHat/Fedora Linux.

zaib · Post by **zaib** » Mon Mar 31, 2008 4:36 pm

Isn't there any specific tool to monitor such stuff at server end ?

raheelahmad · Post by **raheelahmad** » Tue Apr 01, 2008 7:14 pm

use MSN Sniffer , search google for "MSN CHAT MONITOR"
you will find it.

securitykid · Post by **securitykid** » Sat Apr 05, 2008 4:44 am

Question is What is your server?

Is that simply working as proxy?
and/or
Is that working as router too?
and/or
NATing all internet traffic?

let me know the answers so that I can propose the right solution

Thanks

zaib · Post by **zaib** » Sat Apr 05, 2008 6:15 pm

I have FC8 working in BRIDGE mode.

USERS Traffic ===> eht0 > LINUX BRIDGE > eth1 ====> ISASERVER

I am filtering users ip/mac/ports and other bandwidth shaping via bridge.

I also have another server working on FC8 working as a proxy/dns/dhcp for some users.

Plz guide me on howto record conversation for all or some hosts.

(I need ro record conversation for some secuirty related issue.)

securitykid · Post by **securitykid** » Sun Apr 06, 2008 9:09 am

Dear Jahanzeb,

Does all your user will be notified that you will monitoring the Instant Messages conversation?

You know Jahanzeb writing a solution is 2 mins Job but as a security consultant & Licenced Penetration tester my job is to make sure I am NOT knowingly encouraging to violates people privacy.

I am writing a solution here which is not that Interactive but will solve the purpose.

You can do the tcp dump in your FC machine of your internet traffic of specific IP and/or Port and make a capture file, then you can use software like Shadow IM Sniffer to import the capture file and it will re-generate the IM traffic so it can be readable.

Let me again tell you there are more robust / automated / solutions that I can proposed here BUT I think this will solve the purpose AND / OR I am not 100% sure that this is really for SECURITY REASON.

Thanks