The Ethical Hacker Network - Question On Sniffing MSN Conversation Using Wireshark

Latest Additions

Who's Online

EH-Net News Feeds

Latest Additions

hitmen

Newbie

Offline

Posts: 4

Question On Sniffing MSN Conversation Using Wireshark

« on: August 02, 2010, 05:11:41 AM »

I know that MSN uses tcp port 1683 and that using wireshark I get the protocol as MSNMS.

Sniffing packets is one thing but is there any way I can reconstruct the messages that are sent from one party to another?

Or are there better tools available that can do this job?

Wireshark only seem to display the start and final destination IP and the protocol.

Anyway, any wireshark tutorials?


	Logged

hayabusa

Hero Member

Offline

Posts: 1304

Re: Question On Sniffing MSN Conversation Using Wireshark

« Reply #1 on: August 02, 2010, 07:54:01 AM »

I've never tried sniffing MSN conversations, so someone else might have more specifics. However, if the conversations are, in an way, encrypted, you'd need to have the proper certs, etc, to be able to decrypt the conversation. If they are NOT, the simply selecting one of the packets from the conversation, and right-clicking on it, you can choose 'Follow TCP Stream', and that'll separate out the conversation packets, and open a window of the decoded conversation between the two machines.

So, to clarify, if encrypted, prolly not. If not, follow the stream, and see what you get.


	Logged

~ hayabusa ~

"All men can see these tactics whereby I conquer, but what none can see is the strategy out of which victory is evolved." - Sun Tzu, 'The Art of War'

OSCP , GPEN, C|EH

jimbob

Guest

Re: Question On Sniffing MSN Conversation Using Wireshark

« Reply #2 on: August 02, 2010, 09:19:54 AM »

If you right click on a TCP packet in wireshark there is an option to follow the TCP stream. Wireshark will filter all the packets from the given TCP connection and this might give you what you want.

Since this filters to a single TCP stream then you might want to make sure you haven't missed out some of the traffic. Take a look at the filter string and play around with it, perhaps filtering traffic on 1683 only. I've seen the tool Netwitness reconstruct chat sessions, there's a free version of that you can try.

As for tutorials for wireshark, <insert-name-of-search-engine-here> is your friend.

Jimbob


	Logged

Ketchup

Hero Member

Offline

Posts: 1006

Re: Question On Sniffing MSN Conversation Using Wireshark

« Reply #3 on: August 02, 2010, 09:28:40 AM »

I think that NetWitness is a better option for this. It has some nice features for automatic packet reassembly. I am not sure about MSN IM, but it does a fantastic job rebuilding email conversations for example.