雅虎通协议

Yahoo Messenger Protocol （）（2）

Yahoo Protocol Unleashed !
Commonly userdTerms :
YMSG : Standard Yahoo marker

c0 80 : argument seperator

00 00 00 00 : null seperator

20 byte header!

Lenght of message = total length - length of header(20 bytes)

Protocols : Instant Messaging                    Chat Room

1. Contacting Yahoo! Server.


Internet Protocol, Src Addr: acme (192.168.2.221), Dst Addr: scs-foob.yahoo.com (216.136.225.12)
Transmission Control Protocol, Src Port: 1146 (1146), Dst Port: 5050 (5050), Seq: 1014756916, Ack: 0, Len: 0
0000 00 30 6d cf 38 04 00 c1 26 01 f9 33 08 00 45 00   .0m.8...&..3..E.
0010 00 30 04 cf 40 00 80 06 78 de c0 a8 02 dd d8 88   .0..@...x.......
0020 e1 0c 04 7a 13 ba 3c 7b f6 34 00 00 00 00 70 02   ...z..<{.4....p.
0030 40 00 7b 20 00 00 02 04 05 b4 01 01 04 02         @.{ ..........

* "0" length request

2. Sending
Internet Protocol, Src Addr: acme (192.168.2.221), Dst Addr: scs-foob.yahoo.com (216.136.225.12)
Transmission Control Protocol, Src Port: 1146 (1146), Dst Port: 5050 (5050), Seq: 1014756917, Ack: 2866378083, Len: 0

0000 00 30 6d cf 38 04 00 c1 26 01 f9 33 08 00 45 00   .0m.8...&..3..E.
0010 00 28 04 d0 40 00 80 06 78 e5 c0 a8 02 dd d8 88   .(..@...x.......
0020 e1 0c 04 7a 13 ba 3c 7b f6 35 aa d9 75 63 50 10   ...z..<{.5..ucP.
0030 44 70 83 27 00 00                                 Dp.'..



3. Sending

Ethernet II
Internet Protocol, Src Addr: acme (192.168.2.221), Dst Addr: scs-foob.yahoo.com (216.136.225.12)
Transmission Control Protocol, Src Port: 1146 (1146), Dst Port: 5050 (5050), Seq: 1014756917, Ack: 2866378083, Len: 20
Data (20 bytes)

0000 00 30 6d cf 38 04 00 c1 26 01 f9 33 08 00 45 00   .0m.8...&..3..E.
0010 00 3c 04 d1 40 00 80 06 78 d0 c0 a8 02 dd d8 88   .<..@...x.......
0020 e1 0c 04 7a 13 ba 3c 7b f6 35 aa d9 75 63 50 18   ...z..<{.5..ucP.
0030 44 70 cd 2a 00 00 59 4d 53 47 09 00 00 00 00 00   Dp.*..YMSG......
0040 00 4c 00 00 00 00 00 00 00 00                     .L........


* YMSG 09
* 00 00 00
* 00 00 :zero length message
* 00 4c : login request(new session)
* 8 x "00" (to complete header of 20 bytes)

4. Rec. response

Internet Protocol, Src Addr: scs-foob.yahoo.com (216.136.225.12), Dst Addr: acme (192.168.2.221)
Transmission Control Protocol, Src Port: 5050 (5050), Dst Port: 1146 (1146), Seq: 2866378083, Ack: 1014756937, Len: 20
Data (20 bytes)

0000 00 c1 26 01 f9 33 00 30 6d cf 38 04 08 00 45 00   ..&..3.0m.8...E.
0010 00 3c 0c 9c 40 00 30 06 c1 05 d8 88 e1 0c c0 a8   .<..@.0.........
0020 02 dd 13 ba 04 7a aa d9 75 63 3c 7b f6 49 50 18   .....z..uc<{.IP.
0030 ff ff 11 86 00 00 59 4d 53 47 09 00 00 00 00 00   ......YMSG......
0040 00 4c 00 00 00 01 00 00 00 00                     .L........


* YMSG 09
* 00 00 00
* 00 00 :zero length message
* 00 4c : login request(new session)
* 00 00 00 01 : proceed (Send login name etc)
* 4 x "00" (to complete header of 20 bytes)


5.
Internet Protocol, Src Addr: acme (192.168.2.221), Dst Addr: scs-foob.yahoo.com (216.136.225.12)
Transmission Control Protocol, Src Port: 1146 (1146), Dst Port: 5050 (5050), Seq: 1014756937, Ack: 2866378103, Len: 0

0000 00 30 6d cf 38 04 00 c1 26 01 f9 33 08 00 45 00   .0m.8...&..3..E.
0010 00 28 04 db 40 00 80 06 78 da c0 a8 02 dd d8 88   .(..@...x.......
0020 e1 0c 04 7a 13 ba 3c 7b f6 49 aa d9 75 77 50 10   ...z..<{.I..uwP.
0030 44 5c 83 13 00 00                                 D\....

* proly just ping (cuz zero length)


6.Sending Login
Internet Protocol, Src Addr: acme (192.168.2.221), Dst Addr: scs-foob.yahoo.com (216.136.225.12)
Transmission Control Protocol, Src Port: 1146 (1146), Dst Port: 5050 (5050), Seq: 1014756937, Ack: 2866378103, Len: 34
Data (34 bytes)

0000 00 30 6d cf 38 04 00 c1 26 01 f9 33 08 00 45 00   .0m.8...&..3..E.
0010 00 4a 04 f7 40 00 80 06 78 9c c0 a8 02 dd d8 88   .J..@...x.......
0020 e1 0c 04 7a 13 ba 3c 7b f6 49 aa d9 75 77 50 18   ...z..<{.I..uwP.
0030 44 5c c2 90 00 00 59 4d 53 47 09 00 00 00 00 0e   D\....YMSG......
0040 00 57 00 00 00 00 00 00 00 00 31 c0 80 6b 61 63   .W........1..kac
0050 68 6f 6c 69 61 76 c0 80                           holiav..


* YMSG \x09 : Header for all yahoo commands and messages Ver 09
* "00 00 00"
* 00 0e : length of message (=total length - length of header(20 bytes))
* 8 x "00"
* 31 -> ascii "1"
* c080 : standard yahoo argument seperator
* login name
* c080 

7. Receiving the salt to encode the passwd + login
Internet Protocol, Src Addr: scs-foob.yahoo.com (216.136.225.12), Dst Addr: acme (192.168.2.221)
Transmission Control Protocol, Src Port: 5050 (5050), Dst Port: 1146 (1146), Seq: 2866378103, Ack: 1014756971, Len: 71
Data (71 bytes)

0000 00 c1 26 01 f9 33 00 30 6d cf 38 04 08 00 45 00   ..&..3.0m.8...E.
0010 00 6f 2f 5f 40 00 30 06 9e 0f d8 88 e1 0c c0 a8   .o/_@.0.........
0020 02 dd 13 ba 04 7a aa d9 75 77 3c 7b f6 6b 50 18   .....z..uw<{.kP.
0030 ff ff c1 2a 00 00 59 4d 53 47 00 00 00 00 00 33   ...*..YMSG.....3
0040 00 57 00 00 00 01 68 25 43 9a 31 c0 80 6b 61 63   .W....h%C.1..kac
0050 68 6f 6c 69 61 76 c0 80 39 34 c0 80 75 78 51 42   holiav..94..uxQB
0060 38 6b 72 47 6d 33 57 76 44 74 6d 32 78 68 69 30   8krGm3WvDtm2xhi0
0070 4f 67 2d 2d c0 80 31 33 c0 80 30 c0 80            Og--..13..0..


* YMSG
* 00 : data sent by server
* 3 bytes null seperator
* 00 33 : length of message
* 00 : null seperator
* 57 : W Challenge command
* 00 00 00 01
* 68 25 43 9a : Session ID ; reqd for all messages/communication
* 31: ascii 1
* c080
* login
* c080
* 39 34 : ascii 94
* now it sends the 24 byte salt
* c080
* 31 33 : ascii 13
* c080
* 30 : ascii 0
* c080

8. Sending the strings hence encoded
Internet Protocol, Src Addr: acme (192.168.2.221), Dst Addr: scs-foob.yahoo.com (216.136.225.12)
Transmission Control Protocol, Src Port: 1146 (1146), Dst Port: 5050 (5050), Seq: 1014756971, Ack: 2866378174, Len: 113
Data (113 bytes)

0000 00 30 6d cf 38 04 00 c1 26 01 f9 33 08 00 45 00   .0m.8...&..3..E.
0010 00 99 04 f8 40 00 80 06 78 4c c0 a8 02 dd d8 88   ....@...xL......
0020 e1 0c 04 7a 13 ba 3c 7b f6 6b aa d9 75 be 50 18   ...z..<{.k..u.P.
0030 44 15 87 57 00 00 59 4d 53 47 09 00 00 00 00 5d   D..W..YMSG.....]
0040 00 54 00 00 00 0c 00 00 00 00 30 c0 80 6b 61 63   .T........0..kac
0050 68 6f 6c 69 61 76 c0 80 36 c0 80 4a 5f 57 36 6a   holiav..6..J_W6j
0060 6e 59 39 54 48 72 6b 4c 37 51 73 44 65 78 53 30   nY9THrkL7QsDexS0
0070 67 2d 2d c0 80 39 36 c0 80 46 71 79 41 39 4c 61   g--..96..FqyA9La
0080 65 56 4d 57 74 50 44 4e 56 48 67 6e 55 48 67 2d   eVMWtPDNVHgnUHg-
0090 2d c0 80 32 c0 80 31 c0 80 31 c0 80 6b 61 63 68   -..2..1..1..kach
00a0 6f 6c 69 61 76 c0 80                              oliav..


* YMSG 09
* 3 x "00"
* 00 5d : length of message
* 00 54 : ascii T (Login command)
* 00 00 00 0c 00 00 00 00
* 30 :ascii 1
* c0 80
* login name
* c080
* 36 : ascii 6
* c080
* first 24 byte encoded string
* c080
* 39 36 : ascii 96
* c080
* next 24 byte encoded string
* c080 32 co80 31 c080 31 c080
* login name
* c0 80

9. Receving buddy list + misc
Internet Protocol, Src Addr: scs-foob.yahoo.com (216.136.225.12), Dst Addr: acme (192.168.2.221)
Transmission Control Protocol, Src Port: 5050 (5050), Dst Port: 1146 (1146), Seq: 2866378174, Ack: 1014757084, Len: 713
Data (713 bytes)

0000 00 c1 26 01 f9 33 00 30 6d cf 38 04 08 00 45 00   ..&..3.0m.8...E.
0010 02 f1 32 44 40 00 30 06 98 a8 d8 88 e1 0c c0 a8   ..2D@.0.........
0020 02 dd 13 ba 04 7a aa d9 75 be 3c 7b f6 dc 50 18   .....z..u.<{..P.
0030 ff ff 92 de 00 00 59 4d 53 47 00 00 00 00 02 b5   ......YMSG......
0040 00 55 00 00 00 00 68 25 43 9a 38 37 c0 80 46 72   .U....h%C.87..Fr
0050 69 65 6e 64 73 3a 61 76 61 63 68 68 65 72 32 31   iends:avachher21
0060 2c 62 62 32 31 38 38 33 2c 62 6f 62 73 32 30 34   ,bb21883,bobs204
0070 30 2c 62 70 6b 37 75 6c 2c 64 65 65 70 5f 76 61   0,bpk7ul,deep_va
0080 69 64 79 61 2c 65 6e 69 67 6d 61 36 34 37 2c 65   idya,enigma647,e
0090 76 69 6c 5f 6d 61 6e 5f 69 6e 5f 74 68 65 5f 61   vil_man_in_the_a
00a0 74 74 69 63 2c 65 76 69 6c 61 6e 67 65 6c 31 39   ttic,evilangel19
00b0 37 39 2c 69 6d 70 75 7a 69 62 6c 65 2c 6d 61 6d   79,impuzible,mam
00c0 61 5f 70 65 6e 64 73 65 2c 6d 75 6b 74 61 6b 73   a_pendse,muktaks
00d0 6a 2c 70 72 61 6e 6b 73 68 61 72 6d 61 2c 70 73   j,pranksharma,ps
00e0 79 63 68 6f 5f 33 33 33 2c 72 61 76 69 6e 64 72   ycho_333,ravindr
00f0 61 5f 69 69 74 32 30 30 30 2c 73 77 61 74 69 5f   a_iit2000,swati_
0100 6e 61 6d 0a 66 61 6d 69 6c 79 3a 64 5f 6b 61 63   nam.family:d_kac
0110 68 6f 6c 69 61 0a 70 72 6f 67 3a 6d 65 74 61 6c   holia.prog:metal
0120 70 65 74 2c 73 74 64 69 76 69 6e 65 64 6a 0a c0   pet,stdivinedj..
0130 80 38 38 c0 80 73 6d 61 72 74 62 6f 79 5f 61 73   .88..smartboy_as
0140 68 75 2c 73 6d 69 6c 65 79 5f 69 6c 73 c0 80 38   hu,smiley_ils..8
0150 39 c0 80 6b 61 63 68 6f 6c 69 61 76 c0 80 35 39   9..kacholiav..59
0160 c0 80 59 09 76 3d 31 26 6e 3d 37 65 6a 61 35 63   ..Y.v=1&n=7eja5c
0170 39 66 6f 6e 61 6a 62 26 6c 3d 61 30 32 37 65 62   9fonajb&l=a027eb
0180 38 30 6c 2f 6f 26 70 3d 6d 32 69 76 76 69 6e 31   80l/o&p=m2ivvin1
0190 31 33 30 30 30 35 30 30 26 69 7a 3d 26 72 3d 36   13000500&iz=&r=6
01a0 69 26 6c 67 3d 75 73 26 69 6e 74 6c 3d 75 73 3b   i&lg=us&intl=us;
01b0 20 65 78 70 69 72 65 73 3d 54 68 75 2c 20 31 35    expires=Thu, 15
01c0 20 41 70 72 20 32 30 31 30 20 32 30 3a 30 30 3a    Apr 2010 20:00:
01d0 30 30 20 47 4d 54 3b 20 70 61 74 68 3d 2f 3b 20   00 GMT; path=/;
01e0 64 6f 6d 61 69 6e 3d 2e 79 61 68 6f 6f 2e 63 6f   domain=.yahoo.co
01f0 6d c0 80 35 39 c0 80 54 09 7a 3d 4c 57 4d 54 39   m..59..T.z=LWMT9
0200 41 4c 63 68 54 39 41 30 59 36 76 58 39 7a 56 6e   ALchT9A0Y6vX9zVn
0210 2e 56 4e 6a 55 32 42 6a 42 4f 4d 55 39 4f 4e 44   .VNjU2BjBOMU9OND
0220 4e 50 4e 77 2d 2d 26 61 3d 51 41 45 26 73 6b 3d   NPNw--&a=QAE&sk=
0230 44 41 41 4a 76 2f 50 35 79 6f 54 6d 41 79 26 64   DAAJv/P5yoTmAy&d
0240 3d 63 32 77 42 54 56 52 4a 65 45 46 55 59 7a 56   =c2wBTVRJeEFUYzV
0250 4f 61 6d 63 31 54 58 70 52 4e 45 31 42 4c 53 30   Oamc1TXpRNE1BLS0
0260 42 59 51 46 52 51 55 55 42 65 6e 6f 42 54 46 64   BYQFRQUUBenoBTFd
0270 4e 56 44 6c 42 5a 31 64 42 3b 20 65 78 70 69 72   NVDlBZ1dB; expir
0280 65 73 3d 54 68 75 2c 20 31 35 20 41 70 72 20 32   es=Thu, 15 Apr 2
0290 30 31 30 20 32 30 3a 30 30 3a 30 30 20 47 4d 54   010 20:00:00 GMT
02a0 3b 20 70 61 74 68 3d 2f 3b 20 64 6f 6d 61 69 6e   ; path=/; domain
02b0 3d 2e 79 61 68 6f 6f 2e 63 6f 6d c0 80 35 39 c0   =.yahoo.com..59.
02c0 80 43 09 6d 67 3d 31 c0 80 39 30 c0 80 31 c0 80   .C.mg=1..90..1..
02d0 33 c0 80 6b 61 63 68 6f 6c 69 61 76 c0 80 31 30   3..kacholiav..10
02e0 30 c0 80 31 c0 80 31 30 31 c0 80 c0 80 31 30 32   0..1..101....102
02f0 c0 80 c0 80 39 33 c0 80 38 36 34 30 30 c0 80      ....93..86400..


* YMSG 00 (response from server)
* 3 x "00"
* 02 4b :message length
* 00 55 : 00 ascii U (buddy list)
* 4 x "00"
* Session identifier
* c080
* buddy list starts
*c080 :buddy list ends
* ascii 89
* c080
* login name + c080
* ascii 59 + c080
* ascii Y
* Receive cookies :
               v=1
               n=7eja5c9fonajb
               l=a027eb0l/o
               p=m2ivvin113000500
               iz=
               r=6i
               lg=us
               intl=us;
*set expiration path domain etc
* login name c080 ascii 100 c080 ascii 1 c090 ascii 101 c080 c080 ascii 102 c080 c080 <blah> <blah> end


10. You go "Available"(invisible)
Internet Protocol, Src Addr: acme (192.168.2.221), Dst Addr: scs-foob.yahoo.com (216.136.225.12)
Transmission Control Protocol, Src Port: 1146 (1146), Dst Port: 5050 (5050), Seq: 1014757084, Ack: 2866378887, Len: 0

0000 00 30 6d cf 38 04 00 c1 26 01 f9 33 08 00 45 00   .0m.8...&..3..E.
0010 00 28 04 f9 40 00 80 06 78 bc c0 a8 02 dd d8 88   .(..@...x.......
0020 e1 0c 04 7a 13 ba 3c 7b f6 dc aa d9 78 87 50 10   ...z..<{....x.P.
0030 41 4c 82 80 00 00                                 AL....



12. Recv. list of online friends
Internet Protocol, Src Addr: scs-foob.yahoo.com (216.136.225.12), Dst Addr: acme (192.168.2.221)
Transmission Control Protocol, Src Port: 5050 (5050), Dst Port: 1146 (1146), Seq: 2866378887, Ack: 1014757084, Len: 229
Data (229 bytes)

0000 00 c1 26 01 f9 33 00 30 6d cf 38 04 08 00 45 00   ..&..3.0m.8...E.
0010 01 0d 35 d3 40 00 30 06 96 fd d8 88 e1 0c c0 a8   ..5.@.0.........
0020 02 dd 13 ba 04 7a aa d9 78 87 3c 7b f6 dc 50 18   .....z..x.<{..P.
0030 ff ff a3 e4 00 00 59 4d 53 47 00 00 00 00 00 b4   ......YMSG......
0040 00 01 00 00 00 00 68 25 43 9a 30 c0 80 6b 61 63   ......h%C.0..kac
0050 68 6f 6c 69 61 76 c0 80 31 c0 80 6b 61 63 68 6f   holiav..1..kacho
0060 6c 69 61 76 c0 80 38 c0 80 32 c0 80 37 c0 80 72   liav..8..2..7..r
0070 61 76 69 6e 64 72 61 5f 69 69 74 32 30 30 30 c0   avindra_iit2000.
0080 80 31 30 c0 80 39 39 39 c0 80 31 31 c0 80 30 c0   .10..999..11..0.
0090 80 31 37 c0 80 30 c0 80 31 33 37 c0 80 38 34 32   .17..0..137..842
00a0 c0 80 31 33 c0 80 31 c0 80 37 c0 80 70 72 61 6e   ..13..1..7..pran
00b0 6b 73 68 61 72 6d 61 c0 80 31 30 c0 80 39 39 c0   ksharma..10..99.
00c0 80 31 39 c0 80 48 70 70 79 20 46 72 6e 64 73 68   .19..Hppy Frndsh
00d0 69 70 20 44 61 79 c0 80 34 37 c0 80 32 c0 80 31   ip Day..47..2..1
00e0 31 c0 80 30 c0 80 31 37 c0 80 30 c0 80 31 33 37   1..0..17..0..137
00f0 c0 80 35 37 c0 80 31 33 c0 80 31 c0 80 00 59 4d   ..57..13..1...YM
0100 53 47 00 00 00 00 00 09 00 0b 00 00 00 01 68 25   SG............h%
0110 43 9a 39 c0 80 31 30 38 c0 80 00                  C.9..108...


* YMSG 00
* 00 b4 (length)
* 00 01
* 4 x "00"
* session id
* 30
* c080
* login name
Friend list with status , idle time etc follows

=====to investigate ====================
Frame 110 (54 on wire, 54 captured)
Ethernet II
Internet Protocol, Src Addr: acme (192.168.2.221), Dst Addr: scs-foob.yahoo.com (216.136.225.12)
Transmission Control Protocol, Src Port: 1146 (1146), Dst Port: 5050 (5050), Seq: 1014757084, Ack: 2866379116, Len: 0

0000 00 30 6d cf 38 04 00 c1 26 01 f9 33 08 00 45 00   .0m.8...&..3..E.
0010 00 28 04 fa 40 00 80 06 78 bb c0 a8 02 dd d8 88   .(..@...x.......
0020 e1 0c 04 7a 13 ba 3c 7b f6 dc aa d9 79 6c 50 10   ...z..<{....ylP.
0030 40 67 82 80 00 00                                 @g....


Frame 111 (165 on wire, 165 captured)
Ethernet II
Internet Protocol, Src Addr: acme (192.168.2.221), Dst Addr: scs-foob.yahoo.com (216.136.225.12)
Transmission Control Protocol, Src Port: 1146 (1146), Dst Port: 5050 (5050), Seq: 1014757084, Ack: 2866379116, Len: 111
Data (111 bytes)

0000 00 30 6d cf 38 04 00 c1 26 01 f9 33 08 00 45 00   .0m.8...&..3..E.
0010 00 97 04 fb 40 00 80 06 78 4b c0 a8 02 dd d8 88   ....@...xK......
0020 e1 0c 04 7a 13 ba 3c 7b f6 dc aa d9 79 6c 50 18   ...z..<{....ylP.
0030 40 67 f6 85 00 00 59 4d 53 47 09 00 00 00 00 5b   @g....YMSG.....[
0040 00 16 00 00 00 00 68 25 43 9a 31 c0 80 6b 61 63   ......h%C.1..kac
0050 68 6f 6c 69 61 76 c0 80 32 35 c0 80 43 3d 30 01   holiav..25..C=0.
0060 46 3d 31 2c 50 3d 30 2c 43 3d 30 2c 48 3d 30 2c   F=1,P=0,C=0,H=0,
0070 57 3d 30 2c 4f 3d 30 2c 47 3d 30 01 4d 3d 30 2c   W=0,O=0,G=0.M=0,
0080 50 3d 30 2c 43 3d 30 2c 53 3d 30 2c 4c 3d 31 2c   P=0,C=0,S=0,L=1,
0090 44 3d 30 2c 4e 3d 30 2c 47 3d 30 2c 46 3d 30 2c   D=0,N=0,G=0,F=0,
00a0 54 3d 30 c0 80                                    T=0..


==============to investigate ==========================

13. GO invisible

0000 00 30 6d cf 38 04 00 c1 26 01 f9 33 08 00 45 00   .0m.8...&..3..E.
0010 00 44 2a f1 40 00 80 06 50 e2 c0 a8 02 dd d8 88   .D*.@...P.......
0020 e2 d2 05 c9 13 ba a8 1e cc 78 c4 62 23 f5 50 18   .........x.b#.P.
0030 40 8f ce 6e 00 00 59 4d 53 47 09 00 00 00 00 08   @..n..YMSG......
0040 00 03 00 00 00 00 d2 21 40 3a 31 30 c0 80 31 32   .......!@:10..12
0050 c0 80


*YMSG 09
* 3 x "00"
* 00 08 message length
* 00 03 : invisible
* 4 x "00"
* session ID (tis is changed cuz i logged in/out)
*c080 + ascii 10 + c080 + ascii 12 + c080


13. Server response

0000 00 c1 26 01 f9 33 00 30 6d cf 38 04 08 00 45 00   ..&..3.0m.8...E.
0010 00 28 b2 27 40 00 30 06 19 c8 d8 88 e2 d2 c0 a8   .(.'@.0.........
0020 02 dd 13 ba 05 c9 c4 62 23 f5 a8 1e cc 94 50 10   .......b#.....P.
0030 ff ff ba 65 00 00 00 00 00 00 00 00               ...e........
* nothin much...just
8 x "00" (Rest all is tcp header)

14. Sending IM

Internet Protocol, Src Addr: acme (192.168.2.221), Dst Addr: cs46.msg.sc5.yahoo.com (216.136.233.133)
   Version: 4
   Header length: 20 bytes
   Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
   Total Length: 120
   Identification: 0x3bfe
   Flags: 0x04
   Fragment offset: 0
   Time to live: 128
   Protocol: TCP (0x06)
   Header checksum: 0x38ee (correct)
   Source: acme (192.168.2.221)
   Destination: cs46.msg.sc5.yahoo.com (216.136.233.133)
Transmission Control Protocol, Src Port: 1685 (1685), Dst Port: telnet (23), Seq: 3565363728, Ack: 1283001474, Len: 80
   Source port: 1685 (1685)
   Destination port: telnet (23)
   Sequence number: 3565363728
   Next sequence number: 3565363808
   Acknowledgement number: 1283001474
   Header length: 20 bytes
   Flags: 0x0018 (PSH, ACK)
   Window size: 16525
   Checksum: 0xf3e9 (correct)
Telnet

0000 00 30 6d cf 38 04 00 c1 26 01 f9 33 08 00 45 00   .0m.8...&..3..E.
0010 00 78 3b fe 40 00 80 06 38 ee c0 a8 02 dd d8 88   .x;.@...8.......
0020 e9 85 06 95 00 17 d4 83 22 10 4c 79 0c 82 50 18   ........".Ly..P.
0030 40 8d f3 e9 00 00 59 4d 53 47 09 00 00 00 00 3c   @.....YMSG.....<
0040 00 06 5a 55 aa 56 a7 2c 38 1c 31 c0 80 6b 61 63   ..ZU.V.,8.1..kac
0050 68 6f 6c 69 61 76 c0 80 35 c0 80 65 6e 69 67 6d   holiav..5..enigm
0060 61 36 34 37 c0 80 31 34 c0 80 68 69 79 6f c0 80   a647..14..hiyo..
0070 39 37 c0 80 30 c0 80 36 33 c0 80 3b 30 c0 80 36   97..0..63..;0..6
0080 34 c0 80 30 c0 80                                 4..0..
* YMSG 09
* 3 x "00"

* 00 3c : size
* 00 6a
* 5a 55 aa 56 : standard string for yahoo messages.
* session id
* ascii 1
* c080
* login
* c080 + ascii 5 (idicates PM)
* c080 + (IM to)
* c080 + ascii 14
* c080 + message ("hiyo")
* standard termination strings

Server Response

0000 00 c1 26 01 f9 33 00 30 6d cf 38 04 08 00 45 00   ..&..3.0m.8...E.
0010 00 28 85 a1 40 00 31 06 3e 9b d8 88 e9 85 c0 a8   .(..@.1.>.......
0020 02 dd 00 17 06 95 4c 79 0c 82 d4 83 22 60 50 10   ......Ly...."`P.
0030 ff ff d3 b5 00 00 00 00 00 00 00 00               ............


(empty)