Forensics
message-id formatting Mar 16 2007 06:14AM
gdardick dardick net (2 replies)
Re: message-id formatting Mar 27 2007 08:16PM
Alexander Klink (alexander klink name)
Re: message-id formatting Mar 19 2007 08:52PM
Ansgar -59cobalt- Wiechers (bugtraq planetcobalt net) (1 replies)
Re: message-id formatting Mar 27 2007 06:50PM
Simson Garfinkel (simsong acm org) (1 replies)
Re: message-id formatting Mar 27 2007 07:01PM
Ansgar -59cobalt- Wiechers (bugtraq planetcobalt net) (2 replies)
Re: message-id formatting Mar 29 2007 04:01PM
Simson Garfinkel (simsong acm org) (2 replies)
Re: message-id formatting Mar 30 2007 11:46AM
Florian Weimer (fw deneb enyo de)
Re: message-id formatting Mar 29 2007 05:28PM
Ansgar -59cobalt- Wiechers (bugtraq planetcobalt net)
On 2007-03-29 Simson Garfinkel wrote:
> On Mar 27, 2007, at 12:01 PM, Ansgar -59cobalt- Wiechers wrote:
>> On 2007-03-27 Simson Garfinkel wrote:
>>> On Mar 19, 2007, at 1:52 PM, Ansgar -59cobalt- Wiechers wrote:
>>>> On 2007-03-16 gdardick (at) dardick (dot) net [email concealed] wrote:
>>>>> I am trying to find the format of mac.com message-ids. The
>>>>> following are examples of message-id's received in emails from
>>>>> mac.com.
>>>>>
>>>>> F39DF6D4-4C64-4C78-91E1-EB9EF83F492A (at) MAC (dot) COM [email concealed]
>>>>> 11DF7440-1BAC-4E05-9A6D-5F13C3DA7A53 (at) MAC (dot) COM [email concealed]
>>>>>
>>>>> Any ideas?
>>>>
>>>> I'm not sure if I understand your question correctly. Are you
>>>> looking for a regular expression to match those message-IDs?
>>>>
>>>> [0-9A-F]{8}-([0-9A-F]{4}-){3}[0-9A-F]{12}@MAC\.COM
>>>
>>> No. He's looking for a meaning of what they mean.
>>
>> Well, they're message-IDs, they don't mean anything by themselves.
>> They're just supposed to be unique identifiers for a given message
>> (e-mail, in particular).
>
> Actually, message-id's frequently have internal meaning, depending on
> where they are issued.

Maybe, but in that case the OP should have specified the context. Also
this interpretation doesn't explain why he said that he was trying to
"find the format" of these message-IDs.

> If Apple just wanted a random 128-bit number, they wouldn't put the
> dashes in it. There is internal structure --- a 32-bit number, three
> 16-bit numbers, and a 48-bit number. We just don't know what those
> numbers mean.

Another poster mentioned off-list that the left part might be a UUID, so
Apple may just have used a default method to create unique identifiers.

Regards
Ansgar Wiechers
--
"All vulnerabilities deserve a public fear period prior to patches
becoming available."
--Jason Coombs on Bugtraq

[ reply ]
RE: message-id formatting Mar 29 2007 03:48PM
Navroz Shariff (nshariff americanbible org) (1 replies)
Re: message-id formatting Mar 29 2007 03:58PM
Ansgar -59cobalt- Wiechers (bugtraq planetcobalt net)


 

Privacy Statement
Copyright 2010, SecurityFocus