How are people bypassing AIM at work?

Question

Someone at work has managed to get passed the blocks we have on AIM, and i've been going crazy to figure out how. I set up an encypted HTTP tunnel through an ublocked website. It works fine as a proxy for websites, but it still wont let AIM get past. I tried setting the AIM port to 80, and changed the "AIM server address" to the ip address so that the domain name doesn't have to be resolved. Still, I can't get passsed the filter. The HTTP tunnel is encrypted, so there can't be anything analyzing the packets to see that they're from AIM.

Does anyone have any idea on how this stuff is getting past the filter?

Answer 1

Do you have any LANs within your network that do not pass through the filtering mechanism you have set up?  How do you send traffic destined for port 80 to the filters? Do you use a Cisco content switching module?  Perhaps there's a bypass in place to certain destinations or a bypass in place based on source IP address.

Answer 2

1) You and your co-worker may not have the same blocks in place.  (Our network is totally blocked to the outside world - no web  browsing - but the technical people have full access to the internet.  And we're on the same subnet as computers that are blocked.  The only difference - unless you can look at the virtual lans - is that we have access and they don't.)

2) "Getting around" company policies is a good way to be fired for cause.

3) Setting a program to listen on port 80 does no good if incoming connections on port 80 are blocked.  You can still browse the web - outgoing connections - but for incoming connections, port 80 would have to be forwarded to your computer.  And no other computer in the network would be able to listen for connections coming in from the outside world on port 80.  (One computer per port on incoming connections, normally.)