Which algorithm is used for IP fragmentation ID?

[Fabian Wenk]

Hello Ian

Sorry, that I can not help on your initial question, but something 
with the e-mail you got is very strange.

On 04.09.2011 19:19, RW wrote:
> On Sun, 4 Sep 2011 18:04:37 +0200
> ian ivy wrote:
>
>>  Hello,
>>  Sorry, but link and images are unreached for me, so
>>  I do not have chance to review it. It seems that OpenDNS
>>  is blocking this site, probably due to some enabled filters.
>
> You replied to a spam.

At first, it looks like an ordinary out of office message, but 
then it is more then a spam or something else which tries to trick 
the reader into clicking an URL, which eventually could hurt your 
computer.

The answer you received had only be sent to you and not to the 
whole mailing list. It is strange, that it has the sender set to 
freebsd-security at freebsd.org.

Do you see some other e-mail address (or hostname / IP address) in 
the header lines of the e-mail? Or do you see the URL where the 
"click here" is pointing to (better do not click on them)?

If you could provide the details, then this "fake" subscriber can 
probably be removed and blocked by the list admins. It looks like 
this has some system, as I found the same question about this 
e-mail in archives of other mailing lists, eg. [1], [2] (several 
in the left pane) and [3] (even on full-disclosure, with faked 
sender address of the original sender).

   [1] 
http://www.mail-archive.com/django-users@googlegroups.com/msg125720.html
   [2] http://markmail.org/message/z2lxq5mf35cgow5l
   [3] 
http://lists.grok.org.uk/pipermail/full-disclosure/2011-August/082161.html


bye
Fabian