We have Linux server ( RHEL 5 ), and some client machines ( Windows XP ) in local area network. We using server as proxy server.
I am using squid proxy.
My windows machines using internet by proxy.
Now my client machines using IP messenger for chatting and sharing files with in local network.
How can i trace what they are doing or chatting by ip messenger, from my server by wireshark packet sniffer ?
If i can't do it by wireshark , What will you give idea about it...
From a quick look at the IP Messenger website, it seems all communications are peer to peer and encrypted. Being peer to peer will be a problem on a switched network because it will mean you can't easily see all traffic between the peers since the traffic isn't going through your server. Being encrypted (assuming it's on by default and well-implemented) is a problem because all you're going to see is the encrypted traffic - you'll see that people are communicating, but not what they are saying.
Try running it yourself on the machine running wireshark, and see what traffic it generates. It may send some unencrypted traffic you can use despite it claiming not to.
There is readily available software for sniffing and monitoring other (unencrypted) instant messaging protocols if you need to be able to monitor usage. But then you lose the encryption which IP Messenger claims to offer.
If you have access to the Chat Server and can turn off forced encryption (AND compression), so that traffic defaults to non-SSL/non-TLS , then the traffic will be watchable across the wire with Wireshark (or SmartSniff).
This is easy to do with Openfire but probably impossible with MSN Chat (since Microsoft only allows encrypted traffic to their servers).
