Subject: Re: #1047 (was: Old ticket status - USEFOR - Jan 3, 2006)

From: "Charles Lindsey" <[email-masked]>
Date: Mon, 23 Jan 2006 14:42:03 GMT

In <[email-masked]> Richard Clayton <[email-masked]> writes:

>In message <[email-masked]>, Charles Lindsey
><[email-masked]> writes

>>In the cases I looked at, the IP address had clearly been added by the
>>site to the left (since the site to the left always appeared with some IP
>>address to its right - which is essentially what you are reporting).

>I see IPv4 addresses a lot as well...  but only right at the edge of
>network (at the far right of the path)  Usually there is something else
>nearby in the Path header field which is equivalent to POSTED.

Well I posted my evidence in
http://www.imc.org/ietf-usefor/mail-archive/msg01772.html, and indeed
there was one site (uni-berline.de) that regularly did it when injecting,
but there were others (over 1% of my sample) where it was in the middle.

Here is a bunch of Paths with IP addresses in the middle. I have truncated
the irelevant part of the Path up to the site of interest, and I have
folded manually so you can see them.

Path: ...!worldnet.att.net!207.14.113.17!news.alt.net!usenet
Path: ...!worldnet.att.net!216.196.98.144!border2.nntp.dca.giganews.com!
    nntp.giganews.com!local1.nntp.dca.giganews.com!nntp.nildram.net!
    news.nildram.net.POSTED!not-for-mail
Path: ...!worldnet.att.net!198.6.0.85!ash.uu.net!sl-news.
Path: ...!worldnet.att.net!198.6.0.86!ash.uu.net!sl-news.
Path: ...!worldnet.att.net!216.196.98.144!border2.nntp.dca.giganews.com!
    border1.nntp.dca.giganews.com!nntp.giganews.com!
    local1.nntp.dca.giganews.com!nntp.nildram.net!news.nildram.net.POSTED!
    not-for-mail
Path: ...!worldnet.att.net!216.196.98.144!border2.nntp.dca.giganews.com!
    border1.nntp.dca.giganews.com!nntp.giganews.com!
    local1.nntp.dca.giganews.com!nntp.pipex.net!news.pipex.net.POSTED!not-for-mail
Path: ...!worldnet.att.net!216.196.98.144!border2.nntp.dca.giganews.com!
    border1.nntp.dca.giganews.com!nntp.giganews.com!
    local1.nntp.dca.giganews.com!nntp.nildram.net!news.nildram.net.POSTED!
    not-for-mail
Path: ...!worldnet.att.net!207.14.113.17!news.alt.net!usenet
Path: ...!worldnet.att.net!207.14.113.17!news.alt.net!usenet
Path: ...!cyclone-sf.pbi.net!216.218.192.242!news.he.net!news.kjsl.com!
    news-peer-lilac.gradwell.net!not-for-mail
Path: ...!worldnet.att.net!207.14.113.17!news.alt.net!usenet
Path: ...!cyclone-sf.pbi.net!216.218.192.242!news.he.net!news.kjsl.com!
    news-peer-lilac.gradwell.net!news-peer.gradwell.net!news.markshouse.net
Path: ...!cyclone-sf.pbi.net!216.218.192.242!news.he.net!
    news.kjsl.com!news-peer-lilac.gradwell.net!not-for-mail
Path: ...!worldnet.att.net!207.14.113.17!news.alt.net!usenet
Path: ...!cyclone-sf.pbi.net!216.218.192.242!news.he.net!
    news.kjsl.com!news-peer-lilac.gradwell.net!not-for-mail
Path: ...!cyclone-sf.pbi.net!216.218.192.242!news.he.net!news.kjsl.com!
    news-peer-lilac.gradwell.net!not-for-mail
Path: ...!cyclone-sf.pbi.net!216.218.192.242!news.he.net!news.kjsl.com!
    news-peer-lilac.gradwell.net!not-for-mail
Path: ...!worldnet.att.net!129.250.169.16!pln-e!spln!rex!extra.newsguy.com!
    newsp.newsguy.com!psp.co.uk!tfl
Path: ...!worldnet.att.net!207.14.113.17!news.alt.net!usenet

In the case of the worldnet.att.net, it is immediately apparent that the
following IP adress correlates with the host received-from. In the case of
the cyclone-sf.pbi.net, nslookup shows
Name:    news.he.net
Address:  216.218.192.242

So those two sites are clearly using the IP address in our "SEEN" sense.
There are probably other sites doing the same (not a huge number, but
enough).

-- 
Charles H. Lindsey ---------At Home, doing my own thing------------------------
Tel: +44 161 436 6131 Fax: +44 161 436 6133   Web: http://www.cs.man.ac.uk/~chl
Email: [email-masked]      Snail: 5 Clerewood Ave, CHEADLE, SK8 3JU, U.K.
PGP: 2C15F1A9      Fingerprint: 73 6D C2 51 93 A0 01 E7 65 E8 64 7E 14 A4 AB A5