Monitoring the use of web mail and chat

[fengluo]

We are using Cisco secure IDS version 3, planning upgrading it to version 4 soon.

I am wondering whether Cisco Secure ids is able to dectect the use of web mail and chat in our network or not, and how?

[nikhil_m]

Hi,

I am afraid, but I think even v4 cannot be used to detect the use of web mail/chat .

Regds,

Nikh.

[fengluo]

I will be very surprised. Can I get confirmation from other Cisco IDS experts?

[cgiulini]

There are signatures for AIM, Yahoo Messenger, and Microsoft Messenger available. I'm not quite sure off-hand where these were introduced or if they require the 4.0 engine.

I could not vouch for the efficiency of these signatures though.

With regards to web-mail, that's a bit tougher since it's going over port 80 and there are so many providers. You might want to look at a URL-filtering application like WebSense or N2H2. Alternatively you could find the addresses of some webmail servers and write a custom signature to alert on http connections to those servers.

Hope this helps.

Regards,

Chad