[K12OSN] Hi

[Andy Rabagliati]

On Sat, 10 Apr 2004, Les Bell wrote:

> Petre Scheie <petre at maltzen.net> wrote:
> 
> >>
> The address could be spoofed as well obviously.
> <<

Les, my mail client does not mark your quoting nicely. Can you use
regular quoting ?

> It's actually quite difficult to spoof IP addresses for TCP sessions these
> days, due to the difficulty of predicting the sequence numbers that TCP
> will use. You can generally depend on the IP address that appears between
> the square brackets in the Received: line to be correct.
> 
> >>
> Received: from pc10 (dhcp-192-203-56.in2cable.com [203.192.203.56])
> <<

Remember, a bunch of spoofed Received: lines often appear before the
real one with dedicated spammers. The one at the top is correct, and
a certain number down from there, but not necessarily all.

Cheers,    Andy!