AIM
From Protocolinfo
AIM is AOL Instant Messenger. It is actually two protocols, Oscar and TOC.
Contents |
[edit] Oscar and TOC
[edit] Oscar
Oscar is the official AIM protocol created by AOL, and all official AIM clients use Oscar. Oscar is a closed protocol. Unlike TOC, AOL has never released any specifications on Oscar, which means that all of our knowledge about Oscar comes from reverse engineering.
Oscar is a binary TCP-based protocol. For any successful signon, there are at least three connections made: first to the Authorizor, which validates your username and password; then to the BOS (Basic Oscar Service), the main connection to which and from which you send and receive messages; and ChatNav (Chat Navigation), which allows you to create and join chat rooms. In addition, each chat room that you join is another TCP connection. Finally, each file transfer and direct connection you make is another TCP connection, but these never pass through AOL. There are two ways of sending your password, XOR-based and MD5-based. All messages are routed through AOL, except for direct connections.
There is some documentation of the Oscar protocol at kingant.net.
[edit] TOC
TOC was created by AOL to allow unofficial clients to connect to the AIM service. TOC was originally used by TiK, an AIM client written in tcl/Tk.
TOC is a TCP-based protocol. It is ASCII-based, but uses a 6-byte binary header for length information. There is usually only one connection made in a normal session; however, a connection is made for every file transfer that takes place, but these are direct connections, and so never go through AOL. Passwords are sent using a very weak encryption algorithm. All messages are routed through AOL, except for when a direct connection is requested - however there are no (known) TOC clients that support direct IMs.
Because TOC is not the official AIM protocol, and no official client has ever used TOC (with the exception of TiK), in addition to not keeping up with the official protocol in terms of functionality, TOC's usability has actually deteriorated since it was released. It does not support new features that official clients support, including the ability to request a file transfer (it can accept a request made by an official client though), and the ability to view users' away messages without relying on an auto-reply. It has also lost capabilities, such as searching for users by email address.
[edit] Identification
[edit] Ports
AIM usually runs on TCP port 5190.
[edit] l7-filter
l7-filter uses the aim pattern for both Oscar and TOC. It is well tested.
AIM clients sometimes download advertisements and/or news. To match this, l7-filter uses the aimwebcontent pattern.
[edit] See also
[edit] Credits
Some text on this page is courtesy of the Gaim project.
