Cisco Cisco Email Security Appliance C190 User Guide

Specify a parsing character or string and the number of network hops (or 
Received: headers) back to look. A hop is basically the message travelling from 
one machine to another (being received by the Cisco IronPort appliance does not 
count as a hop. See 

 for more 

information). AsyncOS looks for the first IP address following the first 
occurrence of the parsing character or string in the Received: header 
corresponding to the number of specified hops. For example, if you specify two 
hops, the second Received: header, working backward from the Cisco IronPort 
appliance is parsed. If the parsing character is not found, or if there is not a valid 
IP address found, the Cisco IronPort appliance uses the real IP address of the 
connecting machine.

If you specify an opening square bracket (

[

) and two hops for the following 

example mail headers, the IP address of the external machine is 7.8.9.1. However, 
if you specify an closing parenthesis (

)

) as the parsing character, a valid IP 

address will not be found. In this case, the Incoming Relays feature is treated as 
disabled, and the IP of the connecting machine is used (10.2.3.5).

In the example in 

 the incoming relays are:

Path A — 10.2.3.5 (with 2 hops when using received headers) and

Path B — 10.2.6.1 (with 2 hops when using received headers)

 shows example email headers for a message as it moves through several 

hops on its way to the Cisco IronPort appliance as in 

. This example 

shows extraneous headers (ignored by your Cisco IronPort appliance) which are 
present once the message has arrived in the recipient’s inbox. The number of hops 
to specify would be two. 

 shows the headers for the same email message, 

without the extraneous headers

Microsoft Mail Internet Headers Version 2.0

Received: from smemail.rand.org ([10.2.2.7]) by 

smmail5.customerdoamin.org with Microsoft 

SMTPSVC(5.0.2195.6713); 

Received: from ironport.customerdomain.org ([10.2.3.6]) by 

smemail.customerdoamin.org with Microsoft 

SMTPSVC(5.0.2195.6713); 

Received: from mta.customerdomain.org ([10.2.3.5]) by 

ironport.customerdomain.org with ESMTP; 21 Sep 2005 13:46:07 

-0700