>Yes. you can put in any email address you want to.
>
>*HOWEVER*, you _cannot_ spoof the IP address that is in the google-supplied
>headers.
>Stan _is_ entitled to his opinion -- he might even be right.
>The hard facts, however. don't provide much support for his assertation.
>>Yes. you can put in any email address you want to.
>>
>>*HOWEVER*, you _cannot_ spoof the IP address that is in the google-supplied
>>headers.
>
>Sure you can. Trivially easily.
You don't know what you're talking about, or you are using a "different"
meaning of 'spoof', than what network professionals mean by the term.
The address listed in the headers is *guaranteed* to be the address of the
machine that connected to Google.
Yes, it is possible that that machine was a 'relay', and not the 'point of
origin'. But _HIGHLY_unlikely_, given the characteristics of the IP
address involved
>>In the case of the OP, that IP address is a residentail connection in the
>>Rochester NY area. Anyone with basic technical skills can verify that.
[quoted text clipped - 5 lines]
>That doesn't show you where the OP is. It simply shows you where the
>post hit the big Internet Cloud.
I'll agree that it is not _absolutely_ certain, but i'll bet $1000 to your
$1 that it _is_ the OP's actual location.
There are two ways the OP could be 'somewhere else'.
Both require a degree of technical sophistication with regard to Internet
technology such that the perpetrator would _know_ the reception the 'fake
recommendation' posting gets.`
Of those two methods, one requires the active 'co-operation' (or 'collusion',
if you prefer) of the party who operates the gear at the address Google saw,
The other involves a Federal felony. Someone going that route would't do
just a single posting. They would hit -every- 'somewhat releant' newsgroup.
>The most trivial way is to use a national ISP like NetZero or
>PeoplePC, consult their POP list and make a long distance dial-up call
>to another city.
So what? If they did that, the address would _not_ identify itself as
eqipment installed _at_the_customer_location_ of a RESIDENTIAL service
customer.
>>Stan _is_ entitled to his opinion -- he might even be right.
>>
[quoted text clipped - 5 lines]
>Neither do yours. I can't see anything in the OP's post to convince
>me either way on the spam issue.
Extensive experience with Roadrunner's naminng conventions helps.
(And of their policies -- notably that of forbidding _any_ servers (of any
sort -- including VPN destination) on their residetial acounts.
Over a decade of _running_ newsservers helps. As does the knowledge from
actually talking with a number of such bozos who _did_ 'referral spam'
through my systems.
Neon John - 19 Apr 2007 18:13 GMT
>>>Yes. you can put in any email address you want to.
>>>
[quoted text clipped - 5 lines]
>You don't know what you're talking about, or you are using a "different"
>meaning of 'spoof', than what network professionals mean by the term.
I don't know if I'm a professional or not but I did contribute to Karn
Kode (the first IP stack available open source under DOS). And ported
the BSD stack into various AT&T kernels. And set up cluster computing
to compete with IBM's midline long before either TCP/IP, sockets or
the internet entered the lexicon. And owned and operated one of the
first commercial ISPs in the country (dixie.com). I kinda thought I
did a pretty good job but I don't know if I was "professional" or not.
>The address listed in the headers is *guaranteed* to be the address of the
>machine that connected to Google.
Actually it isn't. All the spoofer has to do is be in the same subnet
so that his packets will be routed properly.
>Yes, it is possible that that machine was a 'relay', and not the 'point of
>origin'. But _HIGHLY_unlikely_, given the characteristics of the IP
[quoted text clipped - 6 lines]
>>>on that address. You get "cpe-66-67-135-136.rochester.res.rr.com". That is
>>>_residential_ service, in the Rochester, NY area.
I don't care about this guy, as he wasn't a spammer. I'm picking nits
with you.
All that DNS and IP address show is that he hit the cloud through a
roadrunner connection. That does NOT show where he was located.
Trivial example. I ran a long range WiFi link to an employee's house
across town for several years. Her packets showed up as hitting the
cloud here in downtown cleveland but most assuredly was NOT where she
was located.
Another trivial example. I have a dialup account with NetZero (not
the real company I have one with but that'll do) for traveling. I'm
sitting here in Cleveland but I want to spam. I dial up a CA POP and
connect over long distance. Your little reverse DNS shows me in CA.
Wrong.
Yet another trivial example. I put my laptop and my Wifi transceiver
in my car and drive to Chattanooga. I find an open hotspot and
transmit my spam. Reverse DNS tells you nothing about where I am or
who I am.
Slightly less trivial example. I have an open Wifi node and so does
my friend and neighbor. We arrange to interconnect so that he can
send traffic out my node and vice versa. He gets on the net via a hot
spot in, say, CA and tunnels in to his machine from there. He goes
out over the local WiFi to my machine and back onto the internet. His
packets originate in CA but they look like they came from behind my
NAT.
>>That doesn't show you where the OP is. It simply shows you where the
>>post hit the big Internet Cloud.
>
>I'll agree that it is not _absolutely_ certain, but i'll bet $1000 to your
>$1 that it _is_ the OP's actual location.
But we're not talking about the OP since he wasn't a spammer and had
no reason to hide his origins. You made the statement that
reverse-DNS could pin down the location of a spammer and I
demonstrated that you were wrong. I'm a little bored right now or I'd
not even bother to follow up like this.
>There are two ways the OP could be 'somewhere else'.
>Both require a degree of technical sophistication with regard to Internet
[quoted text clipped - 6 lines]
>The other involves a Federal felony. Someone going that route would't do
>just a single posting. They would hit -every- 'somewhat releant' newsgroup.
Really? I gave four scenarios above where no felony is involved.
Three require no collusion with anyone else.
>Over a decade of _running_ newsservers helps. As does the knowledge from
>actually talking with a number of such bozos who _did_ 'referral spam'
>through my systems.
Only a decade? Amateur piker.
John
---
John De Armond
See my website for my current email address
http://www.neon-john.com
Cleveland, Occupied TN
All great things are simple and many can be expressed in single words:
Freedom, Justice, Honor, Duty, Mercy, Hope. -Churchill