Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have been working on how to find use of online messenger (e.g imo.im, ebuddy) using wireshark. I'm doing , as i need to build SIEM (security information event management) use-cases which detects usage of online web-messenger.

To do little about of research, i went on a few online web-messenger and turned on the wireshark in the background. After a couple of minutes of browsing the online messenger sites , i stopped the wireshark and went straight on analysis. At first, I found nothing special / unique which tells me (as a user) an online messaging service / protocol i used as all these sites works on http or https.

However, as i dig deep i find something interesting. The reference is given below:-

Hypertext Transfer Protocol
    HTTP/1.1 200 OK\r\n
        **[Expert Info (Chat/Sequence): HTTP/1.1 200 OK\r\n]**
            [Message: HTTP/1.1 200 OK\r\n]
            [Severity level: Chat]
            [Group: Sequence]
        Request Version: HTTP/1.1
        Status Code: 200
        Response Phrase: OK
    Content-Encoding: gzip\r\n
    Cache-Control: max-age=10800\r\n
    Content-Type: text/html; charset=utf-8\r\n
    Date: Thu, 24 Jan 2013 17:58:46 GMT\r\n
    Expires: Thu, 24 Jan 2013 20:58:46 GMT\r\n
    Last-Modified: Thu, 24 Jan 2013 01:07:06 GMT\r\n
    p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"\r\n
    Server: ECS (fra/D439)\r\n
    SVR: SP002B7\r\n
    Vary: Accept-Encoding\r\n
    X-Cache: HIT\r\n
    Content-Length: 387\r\n
    \r\n
    Content-encoded entity body (gzip): 387 bytes -> 942 bytes
    Line-based text data: text/html

I have searched the src code and beside PI_CHAT constant declaration in header file expert.c. If i follow the code in packet-http.c I see the following code.

saw_req_resp_or_header = TRUE;
        if (is_request_or_reply) {
                char *text = tvb_format_text(tvb, offset, next_offset - offset);
            if (tree) {
                hdr_item = proto_tree_add_text(http_tree, tvb,
                    offset, next_offset - offset, "%s", text);
            }
            expert_add_info_format(pinfo, hdr_item, PI_SEQUENCE, PI_CHAT, "%s", text);
            if (reqresp_dissector) {
                if (tree) req_tree = proto_item_add_subtree(hdr_item, ett_http_request);
                else req_tree = NULL;

                reqresp_dissector(tvb, req_tree, offset, line,
                          lineend, conv_data);

From the code above its hard to comprehend as to what conditions or input brings PI_CHAT variable to be set. Beside code , if anyone can explain in terms of theory as to how wireshark detects chatting behavior. The theory I have read on the wireshark official sites says expert info is to detect changes which are abnormal / anomalies in nature. I'm more interested in knowing the 'how' part.

Thanks.

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

You're misinterpreting the categorization.

    **[Expert Info (Chat/Sequence): HTTP/1.1 200 OK\r\n]**
        [Message: HTTP/1.1 200 OK\r\n]
        [Severity level: Chat]

Other things that might show up there are "note", "warn", and "error". If this were expanded to two words, it would be protocol chat. What this is pointing out is that this packet has some control chatter that relates to the state of the connection. It has nothing to do with the content or nature of your traffic's message at a higher level than HTTP. See http://www.wireshark.org/docs/wsug_html_chunked/ChAdvExpert.html for more info.

share|improve this answer
    
thank you for the comment. But i have already went through the article you just linked me.So, can you explain why this syntax appears (i.e Expert Info (Chat/Sequence))whenever i open an IM website not on normal website. I have seen the proto.c file and had seen all other messages that can follow (i.e note, warn etc). –  Saladin Jan 24 '13 at 19:35
2  
@user970533 No, without a capture file I can't tell you any more. I would expect that any HTTP server reply would get that categorization. –  Jeff Ferland Jan 24 '13 at 19:48
    
I say i agree with your statement about seeing this syntax with any traffic capture. I just re-checked with some heavy traffic generation on the browser, it seems so chat/sequence gets added from time to time. So, what is that one thing i should look into the packet or protocol header that tell me its calling for IM website. –  Saladin Jan 24 '13 at 19:59
    
What is the one thing that is exactly the same about every chat related website? Once you can answer that you'll have a way to detect it. Good luck with that though, it's like trying to identify if someone is thinking about bread by listening to their conversations with others all day. There are better ways to detect if people are thinking about bread. –  Paystey Jan 25 '13 at 10:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.