topbanner_forum
  *

avatar image

Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
  • Thursday March 28, 2024, 4:43 pm
  • Proudly celebrating 15+ years online.
  • Donate now to become a lifetime supporting member of the site and get a non-expiring license key for all of our programs.
  • donate

Author Topic: Source IP not matching URL hostname  (Read 4659 times)

alpha-dog

  • Participant
  • Joined in 2009
  • *
  • default avatar
  • Posts: 2
    • View Profile
    • Donate to Member
Source IP not matching URL hostname
« on: May 08, 2009, 02:31 PM »
anyone seen this on pages that are largely flex-based?

Seems that the hostname doesn't match the source-IP.  Actually, the source IP address seems to be unaddressable on the public internet.   I'd think that the hostname would match the source, unless it's the case that the SWF is trying to broker messages from my machine back to the origin server.

thoughts?


alpha-dog

  • Participant
  • Joined in 2009
  • *
  • default avatar
  • Posts: 2
    • View Profile
    • Donate to Member
Re: Source IP not matching URL hostname
« Reply #1 on: May 09, 2009, 11:51 AM »
i'm going to attempt to answer my own question based on a theory.
I think that the SWF is attempting to communicate "back" to the infrastructure, and as a result, the reason i'm seeing my own IP as the SOURCE IP is that it's coming from the x-header.
Just a theory, though - hoping perhaps someone else has some insight.

thanks

mouser

  • First Author
  • Administrator
  • Joined in 2005
  • *****
  • Posts: 40,896
    • View Profile
    • Mouser's Software Zone on DonationCoder.com
    • Read more about this member.
    • Donate to Member
Re: Source IP not matching URL hostname
« Reply #2 on: May 10, 2009, 12:00 PM »
that might make some sense -- sometimes urlsnooper has to guess about the source ip or hostname i think.. if you go to advanced mode and actually click on the url found, it will show you on bottom the complete url in context -- from there you will see if the ip is actually part of the url, or if urlsnooper basically added the ip based on a guess from something scanned earlier.