Wednesday, 16 September 2026. Twenty-one hundred. Zoom. Our little technical crew put on Belajar Bersama with Kiki Pramono, and the invite I dropped in the group was the honest kind: luangkan waktu, sharing santai. Which in this office still means someone will draw a packet path you cannot see, and you will pretend you always knew what Received meant.

The group chat was not a syllabus

I sent the invite at 18:56. Kiki said ok. Then I typed that I would invite Mas J***.

His reply was immediate and correct: buset mo ngapain lu.

I walked it back. Joke. I would bring Mas D** and whoever else could stay awake, so the knowledge did not sit in one desk like a family recipe. I piled on the over-serious bit—kalau dimanfaatkan dengan benar jadi amal jariyah—and he answered Amin2 like a man who has survived many office closings.

Then I asked if we needed a Zoom background. Or a speaker certificate. He offered warung remang-2 or a discotheque. I said fine, let my AI work. At 20:55 he pinged: mana backgroundnya. I yelled DISERIUSINNNN. He laughed. We joined anyway, on whatever default blur Zoom gives people who are not actually in a club.

That was the ceremony. Then he shared a screen that looked like a crime.

Headers first, feelings later

Kiki’s first move was not a framework. It was Show Original.

The pretty From line is theatre. The header is the receipt. Two things he kept pointing at:

  • X-Originating-IP — closer to where the send actually happened, not the costume domain.
  • Received — the hop list. Start from the bottom if you want the beginning of the trip.

He walked a live example. Domain looked like it belonged to a person in the room. Originating IP sat on another continent. Mail gateway had a name you can WHOIS. On the receiving side you might only see your own internal hop, which is a reminder: the last box you own is not the public internet. If you stop at a LAN address, you have not finished looking.

Side lesson that sounded like folklore and is actually ops: logs are a two-sided memory. Sender and receiver both have a copy. “Just delete it” is not a strategy unless both sides burn the same paper, which they will not. And if you are an admin, you do not quietly vacuum logs without a berita acara. That is not bureaucracy. That is how you keep a future investigation from accusing the vacuum.

WHOIS is a mood, not a button

After the domain, WHOIS. Sometimes the registrant is a brick wall. Sometimes the wall is only half-built: person hidden, hosting still visible, abuse mailbox still a real address.

Then you write to abuse with the original header and a timestamp, not a vibe. Foreign providers take days. Phone helps if you can say when, not around then. Different WHOIS sites lie differently; opening two is not paranoia.

IP WHOIS next. ASN, block, owner. Traceroute until the stars start (* * *)—that pause is often the fence, not the end of the universe. The ISP behind the fence is who you actually need to talk to. Geolocation tools are a sketch: some Indonesian mobile networks give you almost nothing useful, some give you a little, none of them replace a timestamped ask.

If it is a mobile provider, headers sometimes carry extra crumbs. Still not magic. Still need the clock.

APJII is not “please Google this IP”

The part that clicked for people who do not live in routing: APJII holds the allocation story for Indonesian IP space. Not a search engine. A legitimacy layer. Closer to “who is allowed to say this block is theirs” than “where is the hacker sitting.”

Domestic path, roughly: institution → APJII → ISP → their records → the user at that second. Cross-border: regional registries (APNIC in this neighbourhood, others if the block lives elsewhere), then the foreign ISP. If you already know the exchange from WHOIS, you do not always have to tour every office in sequence.

Speed follows what kind of crime you are claiming. Extraordinary cases move. Name-smearing tickets wait in the hallway. Mail from a .go.id, plus a letter that looks like a letter, still opens more doors than a Gmail written in panic.

He was blunt about access: security institutions can knock on APJII without borrowing a police cover letter. Other ministries often cannot. That is not a flex. That is the map.

The clock is the whole case

Static IP: boring, stays put for the contract. Dynamic IP: the plot. Home users, quota, modem restart—the address can change hands in seconds. That is why a request without date-hour-minute-second is a fanfic.

Retention is not one number. Some ISPs keep a week. Some two. After that the trail is not “classified.” It is gone. Cross a month boundary and you are arguing about a seat that someone else is already sitting in. Bring APJII if the timeline is messy. IPv6 logging is a separate headache: allocated on paper, not always supported on the box in the rack.

Two buildings, one lie you want to stop telling

Then the session drifted into our own plumbing, which is the part Zoom should have been boring and was not.

Two public blocks. Two data-centre ideas. Failover so a power tantrum in one city does not take the website down with it. One ISP link today; the adult version is at least two. Peering with a handful of networks. Transit as the bridge—without it you are an island with a very expensive fence. Direct peer with another ministry: traffic that does not have to take the scenic route through the whole internet.

Someone compared us with another big civilian network that has more ISPs and still looks less grown-up on IPv6. Office humour. Also a to-do list.

NAT, MAC, and the unfunny ending

CGNAT: many users behind one public address, and you still do not get to shrug. Allocation databases exist so “maybe one of these fifty people” is not the professional answer.

Inside a campus: NAT tables, ARP, MAC, then the machine. Event logs. Who logged in. When. If someone else used your work laptop, “I didn’t know” is a feeling, not a defence. Internal DHCP also forgets. Wait a week and the historical row may already be compost.

Paid proxy, VPN, neighbour Wi-Fi: they slow you down. They do not make the packet unborn. The last hop still wrote something. The receiver still has a Received line. Hop-by-hop is tedious. Tedious is the job.

Kiki told older war stories the way operators do at 21:00—ugly tools, money hiding in pictures, social engineering that starts with someone who already knows your birthday. I am not reprinting recipes. The point he wanted in the room was smaller: even when the fancy logs get wiped, something petty survives. A logout. A port. A timestamp that does not care about your narrative.

What I actually wrote down

  1. Show Original before you forward the panic.
  2. Timestamp or go home.
  3. APJII legitimises; it does not replace thinking.
  4. Dynamic IP plus late reporting is how cases die of natural causes.
  5. Subnetting first if you want BGP later. Packet literacy before “security influencer.”
  6. There is no single righteous path. There is a result that matches the clock.

He offered more sessions if we stay in network and security and do not turn it into a TED talk. Fair.

Closing line from the night, less poetic than it sounded on Zoom: in this job people do not vanish. They make the looking expensive. That is a different problem, and it is still a problem you can work.

The background never arrived. The certificate neither. Amal jariyah remains a group-chat theology. The header is still there in the morning.