[K12OSN] Hi

[Les Bell]

Petre Scheie <petre at maltzen.net> wrote:

>>
The address could be spoofed as well obviously.
<<

It's actually quite difficult to spoof IP addresses for TCP sessions these
days, due to the difficulty of predicting the sequence numbers that TCP
will use. You can generally depend on the IP address that appears between
the square brackets in the Received: line to be correct.

>>
Received: from pc10 (dhcp-192-203-56.in2cable.com [203.192.203.56])
<<

So, reading from left to right, we have "pc10", the name the sender claimed
in the HELO exchange, "dhcp-192-203-56.in2cable.com", the name obtained by
a reverse DNS lookup, and 203.192.203.56, the IP address that was in the IP
headers. You can bet the machine belongs to a in2cable customer in India.

Best,

--- Les Bell, RHCE, CISSP
[http://www.lesbell.com.au]