Protocols > MSN Instant Messenger

MSN Messenger is one of the most popular instant messaging networks in the world.  This protocol is relatively simple to break down, though I've thought to put a little more complexity in the analysis of this protocol for safety sake to not over-classify.  The first packet in every MSN session I've observed so far is:

VER 1 MSNP8 CVR0

Though I know there are other MSN protocol versions out there, so I'm going to make it look at this next phrase most likely.  For example, upon looking at the new "Windows Live Messenger" which is just the newest iteration of MSN Messenger, the packet actually is:

VER 1 MSNP14 MSNP13 CVR0

So based on this information, you can obfuscate this a bit to come up with a little better idea of what to look for, such as what is below, which is effectively what HiPPIE identifies MSN Messenger on.

VER <number> MSNP<number> CVR0