"Remote_address or Http_Remote_Address?"

[JakBeNymble]

Hi "Friends",

             I have been trying to work on some Filters for "Remote_address and Remote_host" filtering. *I know that You can't filter anything that's put on "after" that data leaves Your machine*.

But I thought that by adding some values, it might work toward further obscuring these items. I tried different values and checked them out on "Checker pages". Now what gets logged is two different headers, one is Remote_address(Actual Address), and Http_Remote_address(Proxo Fake Address). Here's what I was wanting to know, . .  

(1).I was wondering what is difference between Remote_address and Http_Remote_Address? And, . .

(2). Would the Sites know which of the two was the actual address?

As always I am grateful for Your insites, and delighted to learn.

I hope that You have a Great & Wonderful Day My Proxomitronic Friends!
Best Wishes,
"Jak"



 

[Jor]

Hi jak,

Remote_address and Http_Remote_Address ought to be the same header: as you can see with a sniffer, all HTTP headers are prefixed by HTTP.
So actually these would be Http_Remote_Address and Http_Http_Remote_Address -- the latter does not exist, as an HTTP header content (thus after the prefixed HTTP) may never start with another HTTP.

Should you find a situation where this header is actually reported, I would love to see the URL!

 

[JakBeNymble]

Hi "Jor",

         Thankx for the reply! Here is a checker page where it logs the "Proxo Remote-host & Remote-address", and "Ignores the  actual values". http://www5.airnet.ne.jp/menu/cgi-bin/ I supplied the URL and the checker resolved it to the IP.  (Nothing is Real in the Following, except for the Server Info)


privated

??y?[?W???e???m?F???B

? Thu Jul 25 08:33:30 JST 2002
REMOTE_HOST router.ca-cable.net <-<-<-*FAKE INFO*>
REMOTE_ADDR 63.127.192.186 <-<-<-*FAKE INFO*>

HTTP_VIA internet-pipeline.net, 1.1 www5.airnet.ne.jp:80 (Squid/2.1.PATCH2)
HTTP_FORWARDED internet-pipeline.net
HTTP_X_FORWARDED_FOR (none)
HTTP_FROM (none)
HTTP_CLIENT_IP 216.41.20.110
HTTP_SP_HOST (none)
HTTP_USER_AGENT Mozilla/7.0[FU M$ and IE] via proxy gateway CERN-HTTPD/3.0 libwww/2.17
HTTP_XONNECTION (none)
HTTP_REFERER http://www5.airnet.ne.jp/menu/cgi-bin/
HTTP_PROXY_CONNECTION (none)
HTTP_CACHE_INFO (none)
HTTP_CACHE_CONTROL max-age=0
HTTP_X_LOCKING (none)
REMOTE_PORT 4028
SERVER_SOFTWARE Apache/1.3.26 (Unix)
SERVER_NAME www5.airnet.ne.jp
GATEWAY_INTERFACE CGI/1.1

?

Here is another checker page, but it's not so easy to spoof. http://mickey.squares.net/env/checker.shtml This is a really good checker that shows alot of info.!

Again thankx for the Information! I hope that You have a Wonderful Evening!
Best Wishes,
"Jak"=:-)




Edited by - JakBeNymble on 25 Jul 2002  01:51:50

[sidki3003]

Hi Jak,

There isn't such a thing like Http_Remote_Address.

What's happening is this:

The checking sites use two techniques to get info about you,
outgoing headers and SSI (Server Side Includes).

Everything they got from the headers they prefix with a HTTP_ :
USER_AGENT becomes HTTP_USER_AGENT.
Those things we can manipulate unless they are generated by an external proxy.

SSI is a whole different thing. We can't do anything about that at all (except using an anon proxy).
In your example this method is used for REMOTE_HOST and REMOTE_ADDR.

Now of course you can take proxo and let it generate a new outgoing header "Remote_Address".
It will show up as HTTP_Remote_Address just like "Local_Jak" would show up as HTTP_Local_Jak.
But nobody would use this header since it's not documented.

sidki


 

[JakBeNymble]

Hi "SidKi3003",
             
               Thankx for the reply! That makes sense. I knew about the "SSI (Server Side Includes)", I just didn't know that was what it was called. I ran into SSI trying to make a Date_time Proxo Filter. Since it's server generated there was nothing that I could do to change it that I know of.
Thankx again for the information. To bad though there is nothing that can be done about remote_add. & remote_host except use an Anon Proxy. Well I gave it a shot anyways.
Take Care and I hope that You have a Great & Wonderful Day.
Best Wishes & Safe-Surfing,
"Jak"