LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices


Reply
  Search this Thread
Old 05-14-2018, 04:23 PM   #1
mfoley
Senior Member
 
Registered: Oct 2008
Location: Columbus, Ohio USA
Distribution: Slackware
Posts: 1,365

Rep: Reputation: 120Reputation: 120
Help interpret Received: from email header


I have the following Received: line in an email header (sendmail is email server):
Code:
Received: from [172.16.65.222] ([4.78.219.126])
        (authenticated bits=0)
        by mail.hprs.local (8.15.2/8.15.2) with ESMTPSA id w48Evhcf016855
        (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO)
        for <hotelwifi@ohprs.org>; Tue, 8 May 2018 10:57:44 -0400
The first one, 172.16.65.222, has a huge range: 172.16.0.0 - 172.31.255.255, and is "owned" by Internet Assigned Numbers Authority.

The 2nd address, 4.78.219.126, has an even bigger range: 4.0.0.0 - 4.255.255.255, and is "owned" by Level 3 Parent, LLC.

I was expecting to see an actual provider in here like Time-Warner, or WOW. This email was sent from a conference center. This is the only Received: line in the header. What am I looking at?
 
Old 05-14-2018, 09:06 PM   #2
frankbell
LQ Guru
 
Registered: Jan 2006
Location: Virginia, USA
Distribution: Slackware, Debian, Mageia, and whatever VMs I happen to be playing with
Posts: 13,470
Blog Entries: 18

Rep: Reputation: 3550Reputation: 3550Reputation: 3550Reputation: 3550Reputation: 3550Reputation: 3550Reputation: 3550Reputation: 3550Reputation: 3550Reputation: 3550Reputation: 3550
Is that the complete "received from" trail? It looks incomplete to me. Both those addresses look as if they are intermediate; neither looks like the origination address.

As an aside, whois is a big help in these sorts of inquiries. Try

Code:
$ whois ohprs.org
 
Old 05-15-2018, 05:02 AM   #3
TenTenths
Senior Member
 
Registered: Aug 2011
Location: Dublin
Distribution: Centos 5 / 6 / 7
Posts: 2,670

Rep: Reputation: 1000Reputation: 1000Reputation: 1000Reputation: 1000Reputation: 1000Reputation: 1000Reputation: 1000Reputation: 1000
Quote:
Originally Posted by mfoley View Post
The first one, 172.16.65.222, has a huge range: 172.16.0.0 - 172.31.255.255, and is "owned" by Internet Assigned Numbers Authority.
And is a private network range NOT a public routable range.

https://en.wikipedia.org/wiki/Reserved_IP_addresses / https://tools.ietf.org/html/rfc1918

So that line means that somewhere in transit the mail passed through servers on someones private network.
 
2 members found this post helpful.
Old 05-15-2018, 09:45 AM   #4
mfoley
Senior Member
 
Registered: Oct 2008
Location: Columbus, Ohio USA
Distribution: Slackware
Posts: 1,365

Original Poster
Rep: Reputation: 120Reputation: 120
Quote:
Originally Posted by frankbell View Post
Is that the complete "received from" trail? It looks incomplete to me. Both those addresses look as if they are intermediate; neither looks like the origination address.
Yes, that is the complete header.
Quote:
As an aside, whois is a big help in these sorts of inquiries.
I did do 'whois' which is where I got those "owned" by names. ohprs.org is me and is the final destination for the message.
Quote:
Originally Posted by TenTenths View Post
And is a private network range NOT a public routable range.

So that line means that somewhere in transit the mail passed through servers on someones private network.
Thanks for the link. I didn't realize 172. was private. So, in this case there is no way of knowing what the public IP of the sending site is, eh? The user sent this message from a conference center or hotel. I would have expected a downstream IP address which is the public one in front of those private ones. As frankbell noted, it's not a very complete Received: line. Is there something I can do on my (server) end to increase verbosity?

Last edited by mfoley; 05-16-2018 at 11:13 PM.
 
Old 05-15-2018, 02:28 PM   #5
scasey
Member
 
Registered: Feb 2013
Location: Tucson, AZ, USA
Distribution: CentOS 7.4
Posts: 850

Rep: Reputation: 257Reputation: 257Reputation: 257
Quote:
Originally Posted by mfoley View Post
The 2nd address, 4.78.219.126, has an even bigger range: 4.0.0.0 - 4.255.255.255, and is "owned" by Level 3 Parent, LLC.

I was expecting to see an actual provider in here like Time-Warner, or WOW.
level3 is an "actual provider"...

Is that the first (top-most) Received line? The top-most received line shows the server that delivered the email to you.
 
1 members found this post helpful.
Old 05-15-2018, 03:56 PM   #6
Habitual
LQ 5k Club
 
Registered: Jan 2011
Location: Yawnstown, Ohio
Distribution: High Sierra
Posts: 8,895
Blog Entries: 28

Rep: Reputation: Disabled
https://en.wikipedia.org/wiki/Classl...Domain_Routing

https://whatismyipaddress.com/trace-email
 
1 members found this post helpful.
Old 05-16-2018, 11:17 AM   #7
mfoley
Senior Member
 
Registered: Oct 2008
Location: Columbus, Ohio USA
Distribution: Slackware
Posts: 1,365

Original Poster
Rep: Reputation: 120Reputation: 120
Habitual: Thanks for that trace-email site. That is useful and I'll keep it for future use. However, it gives 4.78.219.126 as the source IP, which really tells me nothing. Doing a whois on that IP gives:
Code:
NetRange:       4.0.0.0 - 4.255.255.255
CIDR:           4.0.0.0/8
NetName:        LVLT-ORG-4-8
NetHandle:      NET-4-0-0-0-1
Parent:          ()
NetType:        Direct Allocation
OriginAS:       
Organization:   Level 3 Parent, LLC (LPL-141)
RegDate:        1992-12-01
Updated:        2018-02-20
Ref:            https://whois.arin.net/rest/net/NET-4-0-0-0-1

OrgName:        Level 3 Parent, LLC
OrgId:          LPL-141
Address:        100 CenturyLink Drive
City:           Monroe
StateProv:      LA
PostalCode:     71203
Country:        US
Although your (Habitual's) first link doesn't seem to assign anything special to the 4.0.0.0 - 4.255.255.255, this surely isn't an end ISP providers, right? "Direct Allocation" means:
Quote:
Direct Allocation: IP address space allocated directly from ARIN to an organization. The organization may reallocate or reassign that space to downstream customers.

https://www.arin.net/knowledge/database_text.html
I suppose I'll just have to consider 4.78.219.126 to be what I'm looking for with this question.
 
Old 05-16-2018, 02:14 PM   #8
scasey
Member
 
Registered: Feb 2013
Location: Tucson, AZ, USA
Distribution: CentOS 7.4
Posts: 850

Rep: Reputation: 257Reputation: 257Reputation: 257
Level 3 is a very large ISP provider. In fact, when visiting level3.com, I see "Level 3 is now Century Link."

Don't know when that happened...but as you hopefully know, Century Link is a long-standing ISP that has also gobbled up a couple of phone companies (like Mountain Bell/US West).

The "organization" to which ARIN has "directly allocated space" is Level 3/Century Link.

FWIW, I find level3 to be very responsive to abuse complaints, if that's the issue here.
 
Old 05-16-2018, 11:12 PM   #9
mfoley
Senior Member
 
Registered: Oct 2008
Location: Columbus, Ohio USA
Distribution: Slackware
Posts: 1,365

Original Poster
Rep: Reputation: 120Reputation: 120
OK, well I guess that answers my question. It didn't seem to me that level3 was the actual provider due to it being "very large". I thought that must be some class A regional pipline, but I guess level3 is the actual ISP provider! I didn't realize a single entity could own an entire Class A subnet.

No, this is not abuse related. Our office has been having occasional problem with employees at conferences getting blocked because the Center's ISP provider doesn't have correct A/PTR records and Sendmail generates "(may be forged)" warnings. If the mail server gets enough of these from a single IP it blocks it. I have created a script whereby conference goers can send a message to a specific local address from the Center and it will temporarily let any message through for that IP. This question resulted from my puzzlement as to what the actual sending IP was in this case. Now I can fix my script!
 
Old 05-17-2018, 01:38 PM   #10
Habitual
LQ 5k Club
 
Registered: Jan 2011
Location: Yawnstown, Ohio
Distribution: High Sierra
Posts: 8,895
Blog Entries: 28

Rep: Reputation: Disabled
Quote:
Originally Posted by mfoley View Post
I suppose I'll just have to consider 4.78.219.126 to be what I'm looking for with this question.
I live by this utility and that says Level3 Communications (or L3Comm, or just L3 colloquially) in
Dublin, Ohio

There are 1198 IPv4 prefixes announced by AS3356. Examples of prefixes are 4.0.0.0/9 and 4.0.0.0/8. There are 1070 IPv6 prefixes announced by AS3356. Examples of prefixes are 2001:450:2015::/48 and 2001:450:203d::/48.

AS = Address Space

L3 = CenturyLink for about 2 months now.

Last edited by Habitual; 05-17-2018 at 01:40 PM.
 
1 members found this post helpful.
Old 05-17-2018, 01:58 PM   #11
scasey
Member
 
Registered: Feb 2013
Location: Tucson, AZ, USA
Distribution: CentOS 7.4
Posts: 850

Rep: Reputation: 257Reputation: 257Reputation: 257
One of att.netís subnets is 12.0.0.0/4...they have others. Iím sure there are other examples.
 
Old 05-17-2018, 11:12 PM   #12
mfoley
Senior Member
 
Registered: Oct 2008
Location: Columbus, Ohio USA
Distribution: Slackware
Posts: 1,365

Original Poster
Rep: Reputation: 120Reputation: 120
Habitual/scasey: Who knew! I learned something. Habitual, the mail server in question is in Columbus, Ohio. Dublin is a suburb thereof. Thanks for that utility. I'll make use of it in the future.

Last edited by mfoley; 05-17-2018 at 11:13 PM.
 
Old 05-18-2018, 11:39 AM   #13
Habitual
LQ 5k Club
 
Registered: Jan 2011
Location: Yawnstown, Ohio
Distribution: High Sierra
Posts: 8,895
Blog Entries: 28

Rep: Reputation: Disabled
https://en.wikipedia.org/wiki/List_o...address_blocks

HP/Apple/DoD/Ford Motors/USPS/Comcast...

Who knew? I did.
Didn't get the memo?

So....
Quote:
Originally Posted by mfoley View Post
I have the following Received: line in an email header (sendmail is email server):
Code:
Received: from [172.16.65.222] ([4.78.219.126])
        (authenticated bits=0)
        by mail.hprs.local (8.15.2/8.15.2) with ESMTPSA id w48Evhcf016855
        (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO)
        for <hotelwifi@ohprs.org>; Tue, 8 May 2018 10:57:44 -0400
Soooo.... your Class C IP received an email from a Class A host at 4.78.219.126
I "know" this because
Code:
ipcalc -b <ip>
Quote:
Originally Posted by mfoley View Post
sendmail is the email server
is informational, but not an actionable detail.
My Toaster could be a "sendmail server"

But it your email server?
 
1 members found this post helpful.
Old 05-19-2018, 01:36 PM   #14
mfoley
Senior Member
 
Registered: Oct 2008
Location: Columbus, Ohio USA
Distribution: Slackware
Posts: 1,365

Original Poster
Rep: Reputation: 120Reputation: 120
Quote:
Originally Posted by Habitual View Post
https://en.wikipedia.org/wiki/List_o...address_blocks

Who knew? I did.
Didn't get the memo?
Well, aren't you the Master of the Universe!
Quote:
Soooo.... your Class C IP received an email from a Class A host at 4.78.219.126
I "know" this because
Code:
ipcalc -b <ip>
Another great utility I didn't know about or have. I've just downloaded it. THX.
Quote:
"sendmail is the email server" is informational, but not an actionable detail.
My Toaster could be a "sendmail server"
In this can not, but whenever I leave such details out they tend to prove important and elicit "why didn't you say the from the beginning" criticisms.
 
Old 05-21-2018, 11:44 AM   #15
Habitual
LQ 5k Club
 
Registered: Jan 2011
Location: Yawnstown, Ohio
Distribution: High Sierra
Posts: 8,895
Blog Entries: 28

Rep: Reputation: Disabled
Quote:
Originally Posted by mfoley View Post
but whenever I leave such details out they tend to prove important and elicit "why didn't you say the from the beginning" criticisms.
http://bit.ly/2s11372
 
  


Reply

Tags
email, header


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
bash: outputing the email content of the last email received? Xeratul Programming 1 03-01-2011 11:39 AM
[exim4] Remove header lines matching received client ip konddor Debian 1 10-23-2009 03:25 AM
Pipe'ing the ouput of 'cat' into 'mutt' (email) losses newlines when email received helptonewbie Linux - Newbie 2 08-28-2008 03:16 AM
email received with =20 at end cambie Linux - Server 3 01-03-2008 12:40 PM
What email program can work with email header on pop3 server TruongAn Linux - Software 0 01-13-2005 11:48 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Server

All times are GMT -5. The time now is 07:13 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration