Practical Packet Analysis

MSN Messenger Service

msnms.pcap

You may find that you need to analyze the traffic of an instant message conversation for several reasons. We explored one possible scenario in Chapter 5 when we suspected an employee of giving away company financial information over messenger software. There are several popular instant messaging applications, and while each one utilizes its own protocol, there are certain similarities in each. Here we'll focus specifically on traffic from the MSN Messenger Service (MSNMS). Let's see if we can't catch some employees in the act.

Note

Some organizations have policies that prevent the use of messaging software, and if so, even seeing the MSNMS protocol in a capture file can set off alarms.

The capture file begins like ...