Email Sender's IP tracking

[mightysuraj]

Hello All,

I've a doubt. I've read in previous messages that the ip address of the sender computer will show up in the header of the recieving email. I recieved an email from a friend when both him and me were online(Actually he was chatting with me). From the email headers I figured out his ip to be 202.xx.xx.xx. But when I asked him(I know him very well, to be trusted), he told me that his ip was actually 192.yy.yy.yy. When I did a WHOIS search on the both ips, I found both of them to be from INDIA. (Lemme shoot out a doubt.. In some threads I found that the first part ie.202. or 192. represents the country. Then how come both the ips are from India ?)
My friend was from a internet cafe with cable connection.
Well coming to the point...
What is the ip showing up in the email header if it is not his actual ip ? Is there any way we can find the actual ip of the sender, while he sends an email to us ?

Thanx in Advance.

[DjM]

Originally posted here by mightysuraj
What is the ip showing up in the email header if it is not his actual ip ? Is there any way we can find the actual ip of the sender, while he sends an email to us ?
Thanx in Advance.

The IP in the header is most likely the SMTP server that routed the e-mail from him to you. The 192 IP Address is an internal IP likely served up to him via DHCP in the internet cafe.

You cannot likely trace it back to him, only back to the provider.

Cheers:

[mightysuraj]

So, If he used a home cable connection(ie. not LAN), or dialup connection, could the email header contained his ip ??

[Tiger Shark]

If he's on cable or DSL what you saw was his routers address. The 192 address cannot be routed across the internet but it's what will show to him when he does an ipconfig. You got his address most likely but it's the public address - not the address of his machine.

[The Duck]

Tiger shark, I explained this to someone a couple of days ago...was it you?? lol. Anways, tiger shark hit it directly on the head. You can still trace the IP address of his router back to his ISP if it was a spammer you wanted to report or something.

[mightysuraj]

So, is there any way u can trace the ip of the sender ??

[The Duck]

Im confused, according to your location, your in India!!! So why do you act surprised when the WHO IS search led to India? Or is this friend of yours located somewhere else?

Yes you can trace his IP address, but its only usefull for finding his ISP and reporting an abuse. Thats a common way for people to knock out spammers and email abusers. My first advice to you is to not only use WHO IS searches, but also do a tracert in the command prompt on the IP address you found in the header. One of the last 2 hops will show his ISP. The reason why you wanna do a tracert and WHO IS search is because a WHO IS search sometimes will bring up a company that is basically the ISP of the ISP of your friend, or in this case the ISP of the ISP of the internet cafe, if you know what I mean.