[news.admin] Sombody is munging articles

roy@phri.UUCP (Roy Smith) (10/18/88)

	Somebody is munging articles pretty badly.  The following show up
at phri this morning.  Notice the general scrambling in the main text, as
well as the extra set of headers pasted on the end.  Even things like the
"Organization: " header getting turning into "xrganizaiton".  Almost looks
like uncorrected modem noise.  My guess is somebodies unbatch script went
crazy.

================start of included article================
Path: phri!cmcl2!nrl-cmf!ukma!tut.cis.ohio-state.edu!mailrus!uwmcsd1!marque!uunet!munnari!mimir!
From: patterso@hardees.rutgers.edu (Ross Patterson)
Newsgroups: comp.protocols.tcp-ip
Subject: Re: simultaneous connections
Message-ID: <Oct.14i18.57.33.1988.16120@hardees.rutgers.edu>
Date: 16 Oct 88 23:50:26 GMT
Lines: 13
xrganization: Rutgers Univ., CCIS

>I do not know whether any 20@aributed systems in the Internet take 
>advantag?

TK TCP design feature but at the time of its design,
>TCP held symmetry to be a highly valuable characteristicnet!hiVint Cerf

Doesn't the FTP "Three Party Model" depend on symetric, peer-peer
connections? There are several FTP's out there that support Three Party, not
to mention Braden & DeSchon's work on BFTP.

Ross Patterson
Center for Computer and Information Services
Rutgers University
#! rnews 733
Path: munnari!uunet!seismo!sundc!pitstop!sun!decwrl!labrea!rutgers!n
are4n!princeton!udel!mmdf
From: 97331812%
================end of included article================
-- 
Roy Smith, System Administrator
Public Health Research Institute
{allegra,philabs,cmcl2,rutgers}!phri!roy -or- phri!roy@uunet.uu.net
"The connector is the network"

karl@triceratops.cis.ohio-state.edu (Karl Kleinpaste) (10/18/88)

Yup, I find that it was already abused by the time it reached
tut.cis.ohio-state.edu.  That leaves a system in the partial Path:
!mailrus!uwmcsd1!marque!uunet!munnari!mimir! as the guilty party.  The
fact that the Path: ends bogusly is more than a little suspicious.

--Karl

emv@a.cc.umich.edu (Ed Vielmetti) (10/19/88)

In article <24946@tut.cis.ohio-state.edu> karl@triceratops.cis.ohio-state.edu (Karl Kleinpaste) writes:
>Yup, I find that it was already abused by the time it reached
>tut.cis.ohio-state.edu.  That leaves a system in the partial Path:
>!mailrus!uwmcsd1!marque!uunet!munnari!mimir! as the guilty party.  The

It's munched by the time it hits mailrus.  Why would an article from
rutgers propogate by way of uunet and munnari?  Doesn't make sense to me. 

tgt@cbnews.ATT.COM (Tim Thompson) (10/19/88)

In article <24946@tut.cis.ohio-state.edu> karl@triceratops.cis.ohio-state.edu (Karl Kleinpaste) writes:
>Yup, I find that it was already abused by the time it reached
>tut.cis.ohio-state.edu.  That leaves a system in the partial Path:
>!mailrus!uwmcsd1!marque!uunet!munnari!mimir! as the guilty party.  The
>fact that the Path: ends bogusly is more than a little suspicious.
>
>--Karl


I found the following in the history file on 'att', as well as seeing it on 
the netnews server here in Columbus:

	<Oct.14.18.57.33.1988.16120@hardees.rutgers.edu>	10/15/88 01:27	comp.protocols.tcp-ip/607

	<Oct.14i18.57.33.1988.16120@hardees.rutgers.edu>	10/18/88 01:26	comp.protocols.tcp-ip/618 


Evidently, something somewhere munged the Message-Id. Looking at the
actual article headers yielded this: (formatting done for readability)

	Path: att!osu-cis!tut.cis.ohio-state.edu!rutgers!elbereth.rutgers.edu!
	      hardees.rutgers.edu!patterso
	From: patterso@hardees.rutgers.edu (Ross Patterson)
	Newsgroups: comp.protocols.tcp-ip
	Subject: Re: simultaneous connections
	Message-ID: <Oct.14.18.57.33.1988.16120@hardees.rutgers.edu>
	Date: 14 Oct 88 22:57:34 GMT
	References: <6467@spool.cs.wisc.edu>
	Organization: Rutgers Univ., CCIS
	Lines: 13

So the one from rutgers got here from rutgers via OSU. Nothing wrong along
this route.

	Path: att!osu-cis!tut.cis.ohio-state.edu!mailrus!uwmcsd1!marque!uunet!
	      munnari!mimir!
	From: patterso@hardees.rutgers.edu (Ross Patterson)
	Newsgroups: comp.protocols.tcp-ip
	Subject: Re: simultaneous connections
	Message-ID: <Oct.14i18.57.33.1988.16120@hardees.rutgers.edu>
	Date: 16 Oct 88 23:50:26 GMT
	Lines: 13
	xrganization: Rutgers Univ., CCIS

This, on the other hand, has been seriously munged. I've seen the posting 
from the person who stated that is was munged by the time it reached mailrus. 
Anywhere beyond mailrus is suspect - of course, with the truncated Path: 
header, it might not be any of them at all.


					Tim

msmith@topaz.rutgers.edu (Mark Robert Smith) (10/19/88)

Actually, I suspect that mimir's neighbor munged it, by changing the
ID, and killing the Path line to just 'Path: '.  Then, mimir did it's
thing by adding: 'mimir!' to the existing, null path.  Then, it came
all of the way back from australia.
Mark
-- 
Mark Smith (alias Smitty) "Be careful when looking into the distance,
RPO 1604; CN 5063       that you do not miss what is right under your nose."
New Brunswick, NJ 08903    {backbone}!rutgers!topaz.rutgers.edu!msmith 
msmith@topaz.rutgers.edu      Dukakis/Bentsen on Nov. 8th!!!

jbrown@herron.uucp (Jordan Brown) (10/20/88)

> Path: phri!cmcl2!nrl-cmf!ukma!tut.cis.ohio-state.edu
	!mailrus!uwmcsd1!marque!uunet!munnari!mimir!
...
> #! rnews 733
> Path: munnari!uunet!seismo!sundc!pitstop!sun!decwrl!labrea!rutgers!n
> are4n!princeton!udel!mmdf

Looks to me like it got munched coming out of "munnari".  That was the
last system that saw the second Path: line as a header line and added
itself.  I'm mildly confused by the first Path: line, as it shows
munnari handing the message to uunet, but the second one shows it
going the other direction.

Looks like a message was munched (bytes lost) and the munching wasn't
detected... the byte count in the batch would be off, and once that
happens you're in deep yogurt.

jonathan@cs.keele.ac.uk (Jonathan Knight) (10/25/88)

Here's another munged article header.  The Path: ends somewhat oddly.
Perhaps this helps trace the Path chopper.

Path: kl-cs!ukc!mcvax!uunet!
From: prindle@NADC.ARPA (Frank Prindle)
Newsgroups: comp.sys.cbm
Subject: C Power (Power C) options (flags)
Message-ID: <POSTNEWS14280@NADC.ARPA>
Date: 21 Oct 88 18:12:18 GMT
Sender: prindle@nadc.arpa (Frank Prindle)
Lines: 25
-- 
  _____      Jonathan Knight,                || JANET: jonathan@uk.ac.keele.cs
    /        Department of Computer Science  || UUCP:  ...!ukc!kl-cs!jonathan
   / _   __  University of Keele, Keele,     |+-------------------------------
(_/ (_) / /  Staffordshire.  ST5 5BG.   U.K. ||      If in doubt, panic!