Path: utzoo!attcan!uunet!convex!killer!osu-cis!att!cbnews!tgt
From: tgt@cbnews.ATT.COM (Tim Thompson)
Newsgroups: news.admin
Subject: Re: Sombody is munging articles
Message-ID: <1601@cbnews.ATT.COM>
Date: 18 Oct 88 22:22:08 GMT
References: <3546@phri.UUCP> <24946@tut.cis.ohio-state.edu>
Reply-To: tgt@cbnews.ATT.COM (Tim Thompson)
Organization: AT&T Bell Laboratories, Columbus
Lines: 51

In article <24946@tut.cis.ohio-state.edu> karl@triceratops.cis.ohio-state.edu (Karl Kleinpaste) writes:
>Yup, I find that it was already abused by the time it reached
>tut.cis.ohio-state.edu.  That leaves a system in the partial Path:
>!mailrus!uwmcsd1!marque!uunet!munnari!mimir! as the guilty party.  The
>fact that the Path: ends bogusly is more than a little suspicious.
>
>--Karl


I found the following in the history file on 'att', as well as seeing it on 
the netnews server here in Columbus:

	<Oct.14.18.57.33.1988.16120@hardees.rutgers.edu>	10/15/88 01:27	comp.protocols.tcp-ip/607

	<Oct.14i18.57.33.1988.16120@hardees.rutgers.edu>	10/18/88 01:26	comp.protocols.tcp-ip/618 


Evidently, something somewhere munged the Message-Id. Looking at the
actual article headers yielded this: (formatting done for readability)

	Path: att!osu-cis!tut.cis.ohio-state.edu!rutgers!elbereth.rutgers.edu!
	      hardees.rutgers.edu!patterso
	From: patterso@hardees.rutgers.edu (Ross Patterson)
	Newsgroups: comp.protocols.tcp-ip
	Subject: Re: simultaneous connections
	Message-ID: <Oct.14.18.57.33.1988.16120@hardees.rutgers.edu>
	Date: 14 Oct 88 22:57:34 GMT
	References: <6467@spool.cs.wisc.edu>
	Organization: Rutgers Univ., CCIS
	Lines: 13

So the one from rutgers got here from rutgers via OSU. Nothing wrong along
this route.

	Path: att!osu-cis!tut.cis.ohio-state.edu!mailrus!uwmcsd1!marque!uunet!
	      munnari!mimir!
	From: patterso@hardees.rutgers.edu (Ross Patterson)
	Newsgroups: comp.protocols.tcp-ip
	Subject: Re: simultaneous connections
	Message-ID: <Oct.14i18.57.33.1988.16120@hardees.rutgers.edu>
	Date: 16 Oct 88 23:50:26 GMT
	Lines: 13
	xrganization: Rutgers Univ., CCIS

This, on the other hand, has been seriously munged. I've seen the posting 
from the person who stated that is was munged by the time it reached mailrus. 
Anywhere beyond mailrus is suspect - of course, with the truncated Path: 
header, it might not be any of them at all.


					Tim