You are here: Home > Networking

Who sent me that email?

This is the first of my networking articles. Just thought I'll put up whatever I learn for the benefit of others (hopefully it'll benefit others!)

When we connect to the Net through our modem by dialing a special number, we actually connect to our ISPs server (internet service provider). The ISP will assign us an IP address for as long as we are connected to the net. If you disconnect and reconnect, you'll be assigned a different IP (IP of the form aaa.bbb.ccc.ddd). When you reconnect, only the ccc.ddd portion of IP may vary.

There is a general (wrong) assumption that when we send emails using Yahoo or Hotmail etc. our identity is hidden. As far as the Internet is concerned, identity refers to your IP address (this is what identifies your computer when connected to the Net). If your IP address can be found, then you can also be found. How? Just contact the ISP and provide them with the IP address you want to track down (of course they'll only reveal such stuff if it's really required). They'll maintain a log of IP addresses which they've assigned and will be able to identify the user easily.

Not convinced? Let's take an example.

My IP address is:
I compose a mail using Yahoo email service from the account

The contents (what I type in the body of the email) are:

This is a trial mail to test the email headers.

After composing the message, I send it to myself (the message recipient is also

After a couple of minutes this email appears in my Inbox as "new mail".
When you open an email, you'll see something like this:

Over here my name is revealed. But that depends on how you configured your Yahoo settings (if you gave a different name in the settings then that name would appear in the From field).

So, how do I know who sent this email? Click on the option Full Headers at the top right side of the screen and voila; the history of the email will be revealed to you. You'll find something like below:

X-Apparently-To: via; Sat, 16 Oct 2004 18:11:16 -0700



from (HELO ( by with SMTP; Sat, 16 Oct 2004 18:11:16 -0700


from [] by via HTTP; Sat, 16 Oct 2004 18:11:15 PDT

Sat, 16 Oct 2004 18:11:15 -0700 (PDT)

"S.Subramanian" <> Add to Address Book

Test mail



text/plain; charset=us-ascii


This is a trial mail to test the email headers.

This is called an email header. Every time you send an email, the email program automatically creates some headers, attaches them to the content and sends the email.
Just forget about the fields beginning with X-. Let's concentrate on the remaining part. We should read headers from the bottom.

That's the email address of the recipient.

Subject: Test mail
This is the subject I used while composing the email.

I composed the email from the account

The next part is interesting:

Received: from [] by via HTTP; Sat, 16 Oct 2004 18:11:15 PDT

This denotes that this email was received by a yahoo server from the IP address (wow! That's the IP address of the machine from which I sent this email). Quite simple!

As we move further up we find another
Received: from (HELO ( by with SMTP; Sat, 16 Oct 2004 18:11:16 -0700

This is another transfer phase. The email is now passed from one yahoo server to another.

If an email passes through many mail servers, then you'll find many Received: fields in the email header. Basically, whenever a mail server gets your email, it'll attach a Received: field to the existing header and then forward the email to the next mail server.

How can we find our IP address?

Just use the command ipconfig at the DOS prompt. This will give you your IP address for the current session (when you use a dialup connection the ISP will generally assign a different IP to your machine each time-dynamic IP; but if you are on broadband connection- always hooked onto the Net then you'll have a fixed IP).

What if you want to find the name of a server from the IP address? There's a command called tracert which will give you the name of the PC. From the example below we deduce that the IP address corresponds to
Basically tracert will tell you the various routers through which your packet travels (a packet is just a piece of data which you send - and since the Internet is an interconnection of many networks, whenever you send data/packets they will be pass through many other systems before reaching their destination). Tracert stands for 'trace route'.


Tracing route to []
over a maximum of 30 hops:

1 137 ms 140 ms 150 ms []
2 133 ms 140 ms 148 ms []
3 137 ms 129 ms 141 ms []
4 160 ms 160 ms 150 ms []
5 169 ms 180 ms 170 ms []
6 369 ms 370 ms 367 ms
7 369 ms 370 ms 370 ms
8 371 ms 380 ms 380 ms []
9 379 ms 379 ms 381 ms []
10 380 ms 380 ms 380 ms []
11 380 ms 380 ms 380 ms []

Trace complete.