Detect Instant Messager Useage

fengluo · ‎09-22-2003

We are using Cisco Secure IDS 3.*, is upgrading it to version 4.*, We would like to see if Cisco Secure IDS can detect Instant Messager Usage and third-party web email usage, is it possible? And how? Do we need to have custom signatures, or Cisco already have.

cskipper · ‎09-24-2003

Hi,

CSIDS have the following signatures to detect IM Activity:

Yahoo - http://miles.cisco.com/nsdb/CSIDS/S53/expsig_11200.html

MSN -

http://miles.cisco.com/nsdb/CSIDS/S53/expsig_11201.html

AOL/ICQ -

http://miles.cisco.com/nsdb/CSIDS/S53/expsig_11202.html

IRC -

http://miles.cisco.com/nsdb/CSIDS/S53/expsig_11203.html

Jabber -

http://miles.cisco.com/nsdb/CSIDS/S53/expsig_11204.html

These signatures fire on a client login attempt via their default TCP ports. The only usuage information you can obtain from these signatures is the number of login attempts detected.

Custom signatures will have to be developed to detect your third-party web email connections.

If I understand your request, determing usage of a product is out of the scope for CSIDS. However, using the above signatures and creating your own for web e-amil will give you some insight in the number of connections detected by CSIDS.

I hope this helps.

Chad R. Skipper