On Tuesday April 11 2006 23:17, Kelson wrote: > mouss wrote: > > - multiple "internal" hops at either sender or receiver (I have N > > Received headers added by my own MTA. and for mail fetched from an MSP, > > there are still more....). > > Actually, if I'm reading this right, it's the number of IP hops between > the sending server and the receiving server -- in other words, how many > lines you'd see if you were on the receiving server and ran traceroute > to the sending MTA.
Exactly. It is usually the number of hops a traceroute running on MTA would show when tracing route to the host from which it is receiving a message. (I say usually, because routes can be asymmetric, and we are actually observing a remaining TTL field value in the IP packet, taking into account an educated guess on the initial setting, based on detected OS type). Btw, a horizontal spread of 1 unit (in fig1) is an artificial white noise added to spread numerous dots somewhat for a better view. I guess we are somewhat lucky seeing a rather clearcut separation of nearby friendly and distant wild-world hosts, and can use IP distance to contribute a little score weight on distant hosts and subtract a little for nearby hosts. Mark
