0

I'v tried to post/upload NNTP message to newsgroup with/without using TOR for analysis.

several thing caught my attention

0) I'v noticed missing NNTP headers when using TOR {Injection-Info Xref Importance} but not otherwise. (when not TOR they appear) where the hell, do these headers go, why do they vanish ???

1) TOR added header {X-TOR-Router X-Ufhash} when using TOR. I'v google'd on those https://www.google.ca/search?q=NNTP+X-TOR-Router+header&sxsrf=ACYBGNT21Ofwh3pSOoWS8Ilvr0ML0IIpVg:1571347769011&ei=Od2oXeoskYeCB_7cmZAP&start=170&sa=N&ved=0ahUKEwiqrdzMnqTlAhWRg-AKHX5uBvI4oAEQ8NMDCKQB&biw=1280&bih=913 https://www.google.ca/search?biw=1280&bih=913&sxsrf=ACYBGNQ0sa-yyKaPIdZf5mtOiio_swnPHA%3A1571347774827&ei=Pt2oXaeJMuWOggfm767oBw&q=NNTP+X-Ufhash+header&oq=NNTP+X-Ufhash+header&gs_l=psy-ab.3..33i160.55818.55818..61337...0.4..0.129.129.0j1......0....2j1..gws-wiz.......0i71.jWShnVZzd8E&ved=0ahUKEwinoL_PnqTlAhVlh-AKHea3C304qgEQ4dUDCAs&uact=5 and read RFC NNTP {0850 1036 2045 2231 2822 2980 3977 4642 5321 5322 5536 5537 6048} but could not find anything

2) the missing IP in the Path header which is replaced by "!..!..!" such as "my.usenet-privider.com!..!..!not-for-mail" for both computer newsreader and unix/linux shell (nntpfetch) downloaded articles whereas web downloaded articles http://al.howardknight.net/ all have the leading "...!" in front/leftmost and inside/middle

some have IP within the path => IP ...!goblin2!goblin.stu.neva.ru!ecngs!feeder2.ecngs.de!1.2.3.4.MISMATCH!feeder4.feed.my.usenet-privider.com!feed.my.usenet-privider.com!my.usenet-privider.com others don't ...!goblin2!goblin.stu.neva.ru!newsfeed.xs4all.nl!newsfeed9.news.xs4all.nl!feeder.usenetexpress.com!tr2.eu1.usenetexpress.com!feeder2.feed.my.usenet-privider.com!feed.my.usenet-privider.com!my.usenet-privider.com

3) the NNTP-X-Ufhash header empty in computer newsreader but present in both unix/linux shell (nntpfetch) downloaded articles and web downloaded articles http://al.howardknight.net/ it has a long identifier string;I'd like to know if I can query that string to know more. is there a app/program/script ???

4) headers are not in the same order in messages

Can someone explains what's going on, exactlty ???

thank's in advance

  • I don't think that is Tor doing that, but rather whatever NNTP server you're using is detecting that you're connecting to it over Tor and adding those headers for tracking purposes. – womble Oct 17 '19 at 23:49
  • this is what I think too. So I'm looking for a tool/script/app/program to query X-TOR-Router AND X-Ufhash NNTP header that would return some info ... thx – user2901196 Oct 19 '19 at 19:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.