Builder prewire problems

[G. Morgan]

alt.security.alarms

Wow, funny how this post, which was from "Mike" comes from the same
IP address as Robert Bass.

How did you discern his IP address? The only thing in the header that
could have possibly given it away was the message id.

Message-ID: <[email protected]>

If that's a HEX number then it's:
44-7B-38-F2-AC-0A-77-C0-E2-E7-05-20-82-2E-80-39

which translates to decimal (not an IP):

68 123 56 242 172 10 119 192 226 231 5 32 130 46 128 57

Am I missing something?



-Graham

Remove the 'snails' from my email

 

[[email protected]]

alt.security.alarms



How did you discern his IP address? The only thing in the header that
could have possibly given it away was the message id.

Here's a header from Robert Bass:

Path:
attbi_s52!attbi_slave62!attbi_s51!attbi_slave61!attbi_slave12!attbi_master11!wns13feed!worldnet.att.net!
216.196.98.144!border2.nntp.dca.giganews.com!border1.nntp.dca.giganews.com!nntp.giganews.com!
local1.nntp.dca.giganews.com!news.giganews.com.POSTED!not-for-mail

The IP is 216.196.98.144



Here's Bass's forgery with Mike's name:

Path:
attbi_s52!attbi_s02!attbi_slave12!attbi_master11!wns13feed!worldnet.att.net!
216.196.98.144!border2.nntp.dca.giganews.com!border1.nntp.dca.giganews.com!nntp.giganews.com!
newsfeed-east.nntpserver.com!nntpserver.com!news.meganetnews.com!not-for-mail

The IP is 216.196.98.144

Identical! How about that!

Once a crook, always a crook.

You're an idiot, Bass

 

[G. Morgan]

alt.security.alarms

Here's Bass's forgery with Mike's name:

Path:
attbi_s52!attbi_s02!attbi_slave12!attbi_master11!wns13feed!worldnet.att.net!
216.196.98.144!border2.nntp.dca.giganews.com!border1.nntp.dca.giganews.com!nntp.giganews.com!
newsfeed-east.nntpserver.com!nntpserver.com!news.meganetnews.com!not-for-mail

The IP is 216.196.98.144

Identical! How about that!

Hate to burst your bubble but..

The "path" data is different for each of us, it's the path the message
took from the poster's NNTP server to your server. It's not like an
email header that shows the path from the originating IP.

For instance the same message path from 'Mike' on my end is:

Path:
uni-berlin.de!fu-berlin.de!news.glorb.com!newsfeed-east.nntpserver.com!nntpserver.com!
news.meganetnews.com!not-for-mail

That IP you posted belongs to Giga216.196.98.144 PTR record: border2.nntp.dca.giganews.com.

I think if you look at ALL the paths in each message on your end they
will have that hop.

The only way of telling for sure where the message from 'Mike' truly
originated is from the Message ID in this case. We don't know how
MegaNetnews encodes that. Some servers will add the NNTP Posting Host
in the header, but Fat-Ass knows better than to use a server that adds
that one.






-Graham

Remove the 'snails' from my email