How does Wireshark detect online-messenger traffic?

Question

I have been working on how to find use of online messenger (e.g imo.im, ebuddy) using Wireshark. I'm doing, as I need to build SIEM (security information event management) use-cases which detects usage of online web-messenger.

To do little about of research, I went on a few online web-messenger and turned on the Wireshark in the background. After a couple of minutes of browsing the online messenger sites, I stopped the Wireshark and went straight on analysis. At first, I found nothing special / unique which tells me (as a user) an online messaging service / protocol I used as all these sites works on http or https.

However, as I dig deep I find something interesting. The reference is given below:

Hypertext Transfer Protocol
    HTTP/1.1 200 OK\r\n
        **[Expert Info (Chat/Sequence): HTTP/1.1 200 OK\r\n]**
            [Message: HTTP/1.1 200 OK\r\n]
            [Severity level: Chat]
            [Group: Sequence]
        Request Version: HTTP/1.1
        Status Code: 200
        Response Phrase: OK
    Content-Encoding: gzip\r\n
    Cache-Control: max-age=10800\r\n
    Content-Type: text/html; charset=utf-8\r\n
    Date: Thu, 24 Jan 2013 17:58:46 GMT\r\n
    Expires: Thu, 24 Jan 2013 20:58:46 GMT\r\n
    Last-Modified: Thu, 24 Jan 2013 01:07:06 GMT\r\n
    p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"\r\n
    Server: ECS (fra/D439)\r\n
    SVR: SP002B7\r\n
    Vary: Accept-Encoding\r\n
    X-Cache: HIT\r\n
    Content-Length: 387\r\n
    \r\n
    Content-encoded entity body (gzip): 387 bytes -> 942 bytes
    Line-based text data: text/html

I have searched the src code and beside PI_CHAT constant declaration in header file expert.c. If I follow the code in packet-http.c I see the following code.

saw_req_resp_or_header = TRUE;
        if (is_request_or_reply) {
                char *text = tvb_format_text(tvb, offset, next_offset - offset);
            if (tree) {
                hdr_item = proto_tree_add_text(http_tree, tvb,
                    offset, next_offset - offset, "%s", text);
            }
            expert_add_info_format(pinfo, hdr_item, PI_SEQUENCE, PI_CHAT, "%s", text);
            if (reqresp_dissector) {
                if (tree) req_tree = proto_item_add_subtree(hdr_item, ett_http_request);
                else req_tree = NULL;

                reqresp_dissector(tvb, req_tree, offset, line,
                          lineend, conv_data);

From the code above its hard to comprehend as to what conditions or input brings PI_CHAT variable to be set. Beside code, if anyone can explain in terms of theory as to how Wireshark detects chatting behavior. The theory I have read on the Wireshark official sites says expert info is to detect changes which are abnormal / anomalies in nature. I'm more interested in knowing the 'how' part.

Answer 1

You're misinterpreting the categorization.

    **[Expert Info (Chat/Sequence): HTTP/1.1 200 OK\r\n]**
        [Message: HTTP/1.1 200 OK\r\n]
        [Severity level: Chat]

Other things that might show up there are "note", "warn", and "error". If this were expanded to two words, it would be protocol chat. What this is pointing out is that this packet has some control chatter that relates to the state of the connection. It has nothing to do with the content or nature of your traffic's message at a higher level than HTTP. See http://www.wireshark.org/docs/wsug_html_chunked/ChAdvExpert.html for more info.