Date: Wed, 11 Jun 2008 16:41:25 -0400 From: Bill Moran <wmoran@collaborativefusion.com> To: Tom Judge <tom@tomjudge.com> Cc: R J <rjohanne@wnk.hamline.edu>, freebsd-net@freebsd.org Subject: Re: tcpdump/snort to capture chat sessions Message-ID: <20080611164125.ac5b7312.wmoran@collaborativefusion.com> In-Reply-To: <48502F2C.7090505@tomjudge.com> References: <Pine.LNX.4.64.0806100940230.24255@wnk.hamline.edu> <20080610120222.9e2760fe.wmoran@collaborativefusion.com> <48502F2C.7090505@tomjudge.com>
next in thread | previous in thread | raw e-mail | index | archive | help
In response to Tom Judge <tom@tomjudge.com>: > Bill Moran wrote: > > In response to R J <rjohanne@wnk.hamline.edu>: > > > >> I am trying to use tcpdump (or snort, but they are both behaving the same > >> in this case) to capture all the lines or contents of an msn > >> chat session, the actual conversation. I am getting partial output; i.e, > >> I'll only get half of a sentence, and I don't see the rest of the lines. > >> And ofcourse, alot of it seems to be hex or obfuscated html? > >> > >> What switches do I need to capture the entire lines of text? > > > > Don't know about snort, but with tcpdump use -s0 > > > This is a good start however you are not guaranteed to see the whole > chat message in a single TCP packet. If you are looking for something > more advanced you will have to write a program around pcap/bpf or > similar to read the TCP stream. He could use wireshark. -- Bill Moran Collaborative Fusion Inc. http://people.collaborativefusion.com/~wmoran/ wmoran@collaborativefusion.com Phone: 412-422-3463x4023
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20080611164125.ac5b7312.wmoran>