Re: Latest Viruses.

[Neil Herber]

It is rumored that on or about 2003-01-06 10:19 AM -0600, Chris Wagner wrote as follows:

So, that said,

does this mean that in this message header that the message came from our
mail server, since the time stamp appears to be earlier than the entry for
the mkc-65-30-67-139.kc.rr.com server?

====================================================================
Return-Path: [EMAIL PROTECTED]
Received: from 10.1.1.33 ([10.1.1.33] verified)
  by atchisonkansas.net (Stalker SMTP Server 1.8b9d14)
  with SMTP id S.0000198408; Sat, 04 Jan 2003 11:42:55 -0600
Received: from [207.241.128.21] (HELO smtp01.journey.com)
  by atchisonkansas.net (Stalker SMTP Server 1.8b9d14)
  with ESMTP id S.0000198407 for <[EMAIL PROTECTED]>;
 Sat, 04 Jan 2003 11:40:38 -0600
Received: from Cpuarwpsq (mkc-65-30-67-139.kc.rr.com
 [65.30.67.139])
    by smtp01.journey.com (Postfix) with SMTP id 313F97343B
    for <[EMAIL PROTECTED]>; Sat,  4 Jan 2003 13:05:32
 -0500 (EST)
====================================================================

I always understood that the headers were arranged in reverse order. That is, the one at the top is the last server to handle the mail and the one at the bottom was the first. The time tags are inserted by the servers themselves and there is no guarantee that their clocks are set correctly.

These headers indicate that the mail originated at "Cpuarwpsq (mkc-65-30-67-139.kc.rr.com [65.30.67.139])".
--
Neil

Neil Herber
Corporate info at http://www.eton.ca/
Eton Systems, 15 Pinepoint Drive, Nepean, ON, Canada K2H 6B1
Tel: (613) 829-4668


#############################################################
This message is sent to you because you are subscribed to
the mailing list <[EMAIL PROTECTED]>.
To unsubscribe, E-mail to: <[EMAIL PROTECTED]>
To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]>
To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]>
Send administrative queries to <[EMAIL PROTECTED]>