From owner-freebsd-net@FreeBSD.ORG  Tue Jun 10 16:03:21 2008
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 4A22F106568D
	for <freebsd-net@freebsd.org>; Tue, 10 Jun 2008 16:03:21 +0000 (UTC)
	(envelope-from wmoran@collaborativefusion.com)
Received: from mx00.pub.collaborativefusion.com
	(mx00.pub.collaborativefusion.com [206.210.89.199])
	by mx1.freebsd.org (Postfix) with ESMTP id F2F628FC33
	for <freebsd-net@freebsd.org>; Tue, 10 Jun 2008 16:03:20 +0000 (UTC)
	(envelope-from wmoran@collaborativefusion.com)
Received: from vanquish.ws.pitbpa0.priv.collaborativefusion.com
	(vanquish.ws.pitbpa0.priv.collaborativefusion.com [192.168.2.162])
	(SSL: TLSv1/SSLv3,256bits,AES256-SHA)
	by wingspan with esmtp; Tue, 10 Jun 2008 12:03:19 -0400
	id 0005641D.484EA5C8.00013EBA
Date: Tue, 10 Jun 2008 12:02:22 -0400
From: Bill Moran <wmoran@collaborativefusion.com>
To: R J <rjohanne@wnk.hamline.edu>
Message-Id: <20080610120222.9e2760fe.wmoran@collaborativefusion.com>
In-Reply-To: <Pine.LNX.4.64.0806100940230.24255@wnk.hamline.edu>
References: <Pine.LNX.4.64.0806100940230.24255@wnk.hamline.edu>
Organization: Collaborative Fusion
X-Mailer: Sylpheed 2.4.8 (GTK+ 2.12.9; i386-portbld-freebsd7.0)
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Cc: freebsd-net@freebsd.org
Subject: Re: tcpdump/snort to capture chat sessions
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 10 Jun 2008 16:03:21 -0000

In response to R J <rjohanne@wnk.hamline.edu>:

> I am trying to use tcpdump (or snort, but they are both behaving the same 
> in this case) to capture all the lines or contents of an msn 
> chat session, the actual conversation.  I am getting partial output; i.e, 
> I'll only get half of a sentence, and I don't see the rest of the lines. 
> And ofcourse, alot of it seems to be hex or obfuscated html?
> 
> What switches do I need to capture the entire lines of text?

Don't know about snort, but with tcpdump use -s0

-- 
Bill Moran
Collaborative Fusion Inc.
http://people.collaborativefusion.com/~wmoran/

wmoran@collaborativefusion.com
Phone: 412-422-3463x4023