On Wed, 06 Jul 2016 04:26:43 -0400, Paul wrote:

Char Jackson wrote:
On Wed, 6 Jul 2016 02:41:35 -0000 (UTC), Henry Jones
wrote:

On Mon, 4 Jul 2016 17:20:54 -0700, Mike Easter wrote:

I would say/conclude it more strongly. On the basis of my observations,
I am already convinced that Pan is not sending a Date line. I see no
need for further investigation.
While Pan didn't seem to be sendnig a date in the proto article, 40Tude
does seem to be sending a date in the proto article. snip

Earlier in the thread, someone mentioned doing a packet capture using
tcpdump, and I'll add the Windows equivalent, Windump, just in case. I'm
surprised that the thread has continued this long without anyone doing
exactly that, since NNTP on port 119 is clear text. It seems that a packet
cap would remove all doubt and simply settle things once and for all.

As an old instructor used to say many years ago, packets don't lie.


This is what Wireshark with its included copy
of WinPCAP is for.

Personally, I prefer tcpdump on Linux because it's what I regularly use as
part of my job, but I otherwise agree with you. I use tcpdump for captures
and Wireshark if I need to do detailed analysis of a capture.

And yes, I have captured transactions
to News servers with it - every time the server
stops working :-) And port 119 is the only port
that makes sense, as it's plaintext and easily
readable. Even the summary window tells a tail,
and the process is not hard to follow.

Many of the commercial NSPs offer plaintext access on a handful of ports,
typically to get around corporate firewalls and proxy servers, but the NSPs
I've seen discussed in this thread probably only offer that access on port
119. That should be enough to see what's going on.

--

Char Jackson