[prev in list] [next in list] [prev in thread] [next in thread] 

List:       dshield
Subject:    Re: [Dshield] little experiment
From:       "Abuse" <abuse () what4now ! com>
Date:       2005-03-02 5:40:28
Message-ID: 20050302054029.01C437070B () smtp1 ! pacifier ! net
[Download RAW message or body]

** Reply to message from "Johannes B. Ullrich" <jullrich@euclidian.com> on Tue,
01 Mar 2005 17:42:54 -0500

> > How do you get the "behind firewall address"?? 
> 
> its a little bit of javacode I found. Essentially, it tells your browser 
> to reload the page, but adds the IP address of your system to the end
> (you will see 'IP=1.2.3.4' at the end of the URL).

Strange.  I have JAVA enabled but my internal IP was not given, I am using
Mozilla v1.7.


> There are a couple of tricks to just display it locally with javascript. 
> But so far, I have only seen java code that was able to actually send it 
> to the server.
> 
> As others have commented, many e-mail clients (e.g. mine) add it to the 
> header, or mail servers add them if they are inside the natted network.
> 
> If someone knows how to tell thunderbird not to send the IP as part of 
> the 'helo', let me know ;-)

I don't know how Thunderbird works but here is what I did for my email client. 
Polarbar gets the IP of the machine it is running on and does a DNS lookup, if
it does not resolve it uses the IP for the HELO.  If it does resolve it uses
the resolved domain name for the HELO.  I added my machines IP to the HOSTS
file and put the domain name I wanted to use externally there.  Since this is a
laptop using DHCP at home I always get the same IP and when I travel, who knows
what IP comes up, I really don't care if the IP is used but if I did I could
change the HOSTS file.
-------------- Sponsor Message ------------------------------------
SANS Intrusion Immersion Training: Orlando, FL, February 3-9th
http://www.sans.org/orlando05

_______________________________________________
send all posts to list@lists.dshield.org
To change your subscription options (or unsubscribe), see: http://www.dshield.org/mailman/listinfo/list
[prev in list] [next in list] [prev in thread] [next in thread]