Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have Linux server ( RHEL 5 ), and some client machines ( Windows XP ) in local area network. We using server as proxy server.

I am using squid proxy.

My windows machines using internet by proxy.

Now my client machines using IP messenger for chatting and sharing files with in local network.

How can i trace what they are doing or chatting by ip messenger, from my server by wireshark packet sniffer ?

If i can't do it by wireshark , What will you give idea about it...

share|improve this question
also, please make sure you have the legal right to be snooping on people conversations. You'll find your self on the wrong side of the law if your not careful. – The Unix Janitor Apr 13 '10 at 13:09
i agree. even if your the server admin, your crossing a line into questionable behavior by snooping without telling anyone. – djangofan Apr 13 '10 at 19:02
up vote 1 down vote accepted

From a quick look at the IP Messenger website, it seems all communications are peer to peer and encrypted. Being peer to peer will be a problem on a switched network because it will mean you can't easily see all traffic between the peers since the traffic isn't going through your server. Being encrypted (assuming it's on by default and well-implemented) is a problem because all you're going to see is the encrypted traffic - you'll see that people are communicating, but not what they are saying.

Try running it yourself on the machine running wireshark, and see what traffic it generates. It may send some unencrypted traffic you can use despite it claiming not to.

There is readily available software for sniffing and monitoring other (unencrypted) instant messaging protocols if you need to be able to monitor usage. But then you lose the encryption which IP Messenger claims to offer.

share|improve this answer

If you have access to the Chat Server and can turn off forced encryption (AND compression), so that traffic defaults to non-SSL/non-TLS , then the traffic will be watchable across the wire with Wireshark (or SmartSniff).

This is easy to do with Openfire but probably impossible with MSN Chat (since Microsoft only allows encrypted traffic to their servers).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.