I had a brief look at this. I use squid to proxy the http traffic so I can see more of what is going on than just the firewall logs. The messenger client connects to login.live.com to authenticate and then to a server by IP address. I don't know if it consistently goes to the same IP, so I suggest that you get a sniffer on your machine and run some tests to see where it is connecting to.
|