×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

Detect Instant Messager Useage

Unanswered Question
Sep 22nd, 2003
User Badges:

We are using Cisco Secure IDS 3.*, is upgrading it to version 4.*, We would like to see if Cisco Secure IDS can detect Instant Messager Usage and third-party web email usage, is it possible? And how? Do we need to have custom signatures, or Cisco already have.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
cskipper Wed, 09/24/2003 - 06:56
User Badges:

Hi,


CSIDS have the following signatures to detect IM Activity:


Yahoo - http://miles.cisco.com/nsdb/CSIDS/S53/expsig_11200.html


MSN -

http://miles.cisco.com/nsdb/CSIDS/S53/expsig_11201.html


AOL/ICQ -

http://miles.cisco.com/nsdb/CSIDS/S53/expsig_11202.html


IRC -

http://miles.cisco.com/nsdb/CSIDS/S53/expsig_11203.html


Jabber -

http://miles.cisco.com/nsdb/CSIDS/S53/expsig_11204.html


These signatures fire on a client login attempt via their default TCP ports. The only usuage information you can obtain from these signatures is the number of login attempts detected.


Custom signatures will have to be developed to detect your third-party web email connections.


If I understand your request, determing usage of a product is out of the scope for CSIDS. However, using the above signatures and creating your own for web e-amil will give you some insight in the number of connections detected by CSIDS.


I hope this helps.


Chad R. Skipper

Actions

This Discussion