[Dshield] little experiment
abuse at what4now.com
Tue Mar 1 23:04:57 GMT 2005
** Reply to message from "Brance Amussen :)_S" <brance at jhu.edu> on Tue, 1 Mar
2005 12:27:39 -0500
> I know it is a dumb question, and I swear I know the answer, but...
> How do you get the "behind firewall address"??
> I thought at one time I could see this in Ethereal, but just tried a grab
> and I don't see it..
It depends on how your email client sends the "HELO" to your email server (the
data in the HELO ends up in the "receive" header). Sometimes the email client
uses the IP assigned to the machine it is running on because it can not get the
external IP assigned to the gateway/router. Some email clients use the domain
name instead of using an IP address for the "HELO" and do not have that kind of
More information about the list