Subject: Re: [usefor] Injection-Info:logging-data NNTP header usefullness ?

From: Julien ÉLIE <[email-masked]>
Date: Sat, 5 Oct 2019 09:42:57 +0200

Bonjour Marc,

> I'v read RFC 6048 https://tools.ietf.org/html/rfc6048  and I was 
> wondering how to query remote NNTP
> Injection-Info (74569) numbers
> 
> <code>
> Injection-Info:logging-data="74569"
> </code>
> 
> is there a tool/script on the net that would return more info on those 
> instead of emailing sysadmin ?

The Injection-Info header field is defined in RFC 5536:
   https://tools.ietf.org/html/rfc5536

3.2.8.  Injection-Info

    The Injection-Info header field contains information provided by the
    injecting news server as to how an article entered the Netnews
    system; it assists in tracing the article's true origin.
[...]
    The "logging-data" <parameter> contains information (typically a
    session number or other non-persistent means of identifying a posting
    account) that will enable the true origin of the article to be
    determined by reference to logging information kept by the news
    server.

As far as I know, retrieving information about logging-data "numbers" 
(or whatever else, because it is not necessarily a number, though NNTP 
implementations usually log there a session number or a process ID) is 
not automatical.
There is no NNTP LIST command for that (RFC 6048 won't be of any help). 
  No automatical tool.

If one wishes to investigate on an article whose logging data is 
"74569", he needs contacting the news administrator of the site where 
the article was injected.  Only this news administrator will know what 
"74569" refers to, and can look into the logs of his server.

-- 
Julien ÉLIE

« Two secrets to keep your marriage brimming:
   1. Whenever you're wrong, admit it.
   2. Whenever you're right, shut up. » (Patrick Murray)