Join Log in
Score:0
avatar Server

Tracking the IP and Physical address of the machine originating an email message

in flag
Muhammad Adeel Zahid

My organization is using Google's email services for the creation and management of their email accounts. Recently, an objectionable email was sent from a Gmail ID (presumably a fake account created specifically for this purpose) to many of our organization's email addresses.
Can we trace back the IP (both local and public) and the MAC address of the machine used to send this email? We suspect that this activity happened from within the organization. I do have access to our email server.

44
1 + 1
ip
in flag
NiKiZe
MAC address is never available in email headers, unless in some cases when it comes from IPv6 address, but this is unreliable at best, and would not do you any good. Check the email headers.
2
Reply
Score:2
Zac67 avatar Server
ru flag
Zac67

Possibly, the Received headers show the client's IP address. Received headers are added at the top, so the topmost is the newest. The server is on a public network, so it can only log the client's public address. However, most ISPs don't include client IP addresses into the Received header any more for privacy reasons. You could also ask Google for details from their log but I'm not sure they'd deliver.

MAC addresses are never included in any headers, so that won't work.

If the mail originated from your network and you're properly logging connection details then there might be a chance to pinpoint the source. Extract the exact ingress time stamp from the according Received header (the lowest=oldest one mentioning a gmail server). With that time stamp, check your firewall logs for a user accessing gmail via SMTP. If users do so using HTTPS you'd require detailed logs, requiring SSL inspection.

If you lack any of the above there's no way to find the source, I'm afraid.

0 + 0
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.