2)      MSN检测

这里举个MSN传文件的例子

#detect msn file transfer

if(index($buffer,"\x41\x70\x70\x49\x44\x3a\x20\x32\x0d\x0a")>=0){

       $to=elem(split($buffer, "\r\n"), 5);

       $from=elem(split($buffer, "\r\n"), 6);

       $temp=elem(split($buffer, "\r\n"), 16);

       $temp1=substr($temp,(strlen("context:")));

       $temp1=substr($temp1,0,100);

       $filename=debase64($temp1);

       alert(ims_source, msn_file_alert, $from, $to, tcp.connsrc,

                tcp.conndst,

                "--AlertDetails", "ALERT_ID", "911-010-002",

                "ALERT_CONFIDENCE", 90,

                "ALERT_SEVERITY", "info",

                "ALERT_IMPACT", "information",

                "ALERT_EVENT_TYPE", "logging",

                "filename",$filename,

                "IP_ADDR_SRC", tcp.connsrc, "IP_ADDR_DST", tcp.conndst,

                "PORT_SRC", tcp.connsport, "PORT_DST", tcp.conndport);

                }

总结一下:IMS软件的特征基本在应用层协议找,不用在传输层找,应用层协议有HTTP的,有HTTP隧道的,有UDP的,特征基本在PAYLOAD这里找,还有就是将来要做IMS软件的功能的禁止或者是检测,最好作好干净的机器,卸装其他有网络应用的软件,以防止干扰,如果是做IMS的某个功能点,最好是在功能点启动的那一刻启动抓包软件进行抓包,这样少干扰的包.

C)     网络视频

1)      QQLIVE检测

这里检测UDP协议：

if((udp.sport > 1024) && (udp.dport > 1024))

   {

    if (substr(udp.blob,0,1) == "\xfe")

    {

       if (( substr(udp.blob,2,2) == "\x00\x00") || ( substr(udp.blob,2,2) == "\x04\x04"))

      {

    alert( source_qqliveudpdata, qqlive_udp_datatrans_alert,                 

             ip.src, ip.dst,

             "--AlertDetails", "ALERT_ID", "988-002-002",      

             "ALERT_SEVERITY", "info",     

             "ALERT_IMPACT", "information gathering",          

             "ALERT_EVENT_TYPE","logging",  

             "ALERT_ASSESSMENT", "unknown",

             "IP_PROTO_NUM", 17,                   

             "IP_ADDR_SRC", ip.src,       

             "PORT_SRC", udp.sport,       

             "IP_ADDR_DST", ip.dst,       

             "PORT_DST", udp.dport,

             "QQLIVE METHOD","_1");

        }

    }