Requester

When I look at my website logs, I can see where a request came from, e.g.,
that a page was requested by someone from ???.com.

My question is - how is this information A) included as part of the page
request, B) discovered by my webserver?

Thanks!

pemo wrote:
> When I look at my website logs, I can see where a request came from, e.g.,
> that a page was requested by someone from ???.com.
>
> My question is - how is this information A) included as part of the page
> request, B) discovered by my webserver?

A) the source IP address is included in every packet
B) reverse DNS lookup

also thereis X-Forwarder tag if some one is behind proxy server this show
the IP of person behind the proxy
--
Geeks Home
www.fahimzahid.com




"Allen Kistler" <(E-Mail Removed)> wrote in message
news:y2jlf.3337$(E-Mail Removed) m...
> pemo wrote:
> > When I look at my website logs, I can see where a request came from,
e.g.,
> > that a page was requested by someone from ???.com.
> >
> > My question is - how is this information A) included as part of the page
> > request, B) discovered by my webserver?
>
> A) the source IP address is included in every packet
> B) reverse DNS lookup

"Java Boy" <(E-Mail Removed)> wrote in message
news:4395feca$0$15783$(E-Mail Removed)...
> also thereis X-Forwarder tag if some one is behind proxy server this show
> the IP of person behind the proxy
> --
> Geeks Home
> www.fahimzahid.com
>
>
>
>
> "Allen Kistler" <(E-Mail Removed)> wrote in message
> news:y2jlf.3337$(E-Mail Removed) m...
>> pemo wrote:
>> > When I look at my website logs, I can see where a request came from,
> e.g.,
>> > that a page was requested by someone from ???.com.
>> >
>> > My question is - how is this information A) included as part of the
>> > page
>> > request, B) discovered by my webserver?
>>
>> A) the source IP address is included in every packet
>> B) reverse DNS lookup

So, it would be impossible to request a page, but 'pretend' they are, say,
bbc.co.uk?

"pemo" <(E-Mail Removed)> said:
>"Java Boy" <(E-Mail Removed)> wrote in message
>news:4395feca$0$15783$(E-Mail Removed). ..
>> also thereis X-Forwarder tag if some one is behind proxy server this show
>> the IP of person behind the proxy
>> --
>> Geeks Home
>> www.fahimzahid.com
>>
>>
>>
>>
>> "Allen Kistler" <(E-Mail Removed)> wrote in message
>> news:y2jlf.3337$(E-Mail Removed) m...
>>> pemo wrote:
>>> > When I look at my website logs, I can see where a request came from,
>> e.g.,
>>> > that a page was requested by someone from ???.com.
>>> >
>>> > My question is - how is this information A) included as part of the
>>> > page
>>> > request, B) discovered by my webserver?
>>>
>>> A) the source IP address is included in every packet
>>> B) reverse DNS lookup
>
>So, it would be impossible to request a page, but 'pretend' they are, say,
>bbc.co.uk?

If you have control to the DNS of an address block, you can set the reverse
DNS for any address to point to something.bbc.co.uk. It may help to then
do a forward lookup from the resulting name, and verify that it resolves
to the same IP address for which the rDNS query was made. But then, this
all takes time.
--
Wolf a.k.a. Juha Laiho Espoo, Finland
(GC 3.0) GIT d- s+: a C++ ULSH++++$ P++@ L+++ E- W+$@ N++ !K w !O !M V
PS(+) PE Y+ PGP(+) t- 5 !X R !tv b+ !DI D G e+ h---- r+++ y++++
"...cancel my subscription to the resurrection!" (Jim Morrison)

pemo wrote:
> "Java Boy" <(E-Mail Removed)> wrote in message
> news:4395feca$0$15783$(E-Mail Removed)...
>
>>also thereis X-Forwarder tag if some one is behind proxy server this show
>>the IP of person behind the proxy

>>
>>"Allen Kistler" <(E-Mail Removed)> wrote in message
>>news:y2jlf.3337$(E-Mail Removed). com...
>>
>>>pemo wrote:
>>>
>>>>When I look at my website logs, I can see where a request came from,
>>
>>e.g.,
>>
>>>>that a page was requested by someone from ???.com.
>>>>
>>>>My question is - how is this information A) included as part of the
>>>>page
>>>>request, B) discovered by my webserver?
>>>
>>>A) the source IP address is included in every packet
>>>B) reverse DNS lookup
>
> So, it would be impossible to request a page, but 'pretend' they are, say,
> bbc.co.uk?

I forgot about the X-Forwarded-For tag that some proxies (like squid)
can add. It's possible that someone can forge that tag. Then it's an
issue of which your web server uses, the IP address in the packet IP
header or the IP address in the tag.

It's harder to spoof the IP address in the header, because it's used to
route the reply back to the source. Someone would have to have
compromised the routing between you and bbc.co.uk to be able to fake a
connection from there. Or they could just hack your dns server to make
their IP address look like bbc.co.uk.

Allen Kistler <(E-Mail Removed)> said:
>pemo wrote:
>> So, it would be impossible to request a page, but 'pretend' they are, say,
>> bbc.co.uk?
>
>It's harder to spoof the IP address in the header, because it's used to
>route the reply back to the source. Someone would have to have
>compromised the routing between you and bbc.co.uk to be able to fake a
>connection from there. Or they could just hack your dns server to make
>their IP address look like bbc.co.uk.

No need to hack a DNS server (provided you control DNS server authoritative
for the given source IP address). Just create whatever rDNS entry there,
and it is "legitimate" (for some variant of "legitimate", of course).
--
Wolf a.k.a. Juha Laiho Espoo, Finland
(GC 3.0) GIT d- s+: a C++ ULSH++++$ P++@ L+++ E- W+$@ N++ !K w !O !M V
PS(+) PE Y+ PGP(+) t- 5 !X R !tv b+ !DI D G e+ h---- r+++ y++++
"...cancel my subscription to the resurrection!" (Jim Morrison)

"pemo" <(E-Mail Removed)> wrote in message
news:dn70th$53n$(E-Mail Removed)...

> So, it would be impossible to request a page, but 'pretend' they are, say,
> bbc.co.uk?

Unless you know that you can trust it, you can't trust it. If you had
complete control over bbc.co.uk personally and you did a forward lookup to
confirm the reverse, then you would know that you could trust someone who
from bbc.co.uk to actually be from there. But in general, you have no idea
who is accessing your web server unless you set up some form of
identification.

DS