Hi,
I know this suject was brought up first in Jan, then in July again.
However, there is nothing in the way of documentation (I think I found
about three lapidary lines) to really let one know, as another
questioner wanted to, whether this is at all a security issue. Put
another way, what is the utility of this obscure kernel function? How
are we to use the information so gained?
Twice now I have had kernel messages like the following:
Jul 20 12:20:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1
Jul 20 12:20:42 raven kernel: ll header: 45 00 00 28
Jul 20 12:22:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1
Jul 20 12:22:42 raven kernel: ll header: 45 00 00 28
Jul 20 12:24:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1
Jul 20 12:24:42 raven kernel: ll header: 45 00 00 28
Jul 20 12:26:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1
Jul 20 12:26:42 raven kernel: ll header: 45 00 00 28
Jul 20 12:26:55 raven kernel: hdd: hdd4
Jul 20 12:28:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1
Jul 20 12:28:42 raven kernel: ll header: 45 00 00 28
Jul 20 12:29:44 raven kernel: hdd: hdd4
Jul 20 12:30:25 raven kernel: hdd: hdd4
Jul 20 12:30:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1
Jul 20 12:30:42 raven kernel: ll header: 45 00 00 28
Jul 20 12:32:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1
Jul 20 12:32:42 raven kernel: ll header: 45 00 00 28
Jul 20 12:34:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1
Jul 20 12:34:42 raven kernel: ll header: 45 00 00 28
Jul 20 12:36:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1
Jul 20 12:36:42 raven kernel: ll header: 45 00 00 28
The first time, I put it down to my accidentally having opened two
PPPoE connections at the sime time. Since I don't know the
intricacies of these things, I left it at that. This time, however,
the messages were interspersed with firewall messages (see below, for
the brave/generous). Note that again ppp1 is showing as registered in
addition to ppp0, though this time I had not started another PPPoE
session by mistake. Additionally, when I terminated the PPPoE session
(this should stop all of them) and ran a ps waux, I noticed three
other PPPoE processes running, though I had not started them.
Everything else is normal, at least in the sense that it has never
caused trouble before. Now at the same time you see the firewall
logging a bunch of dsl/cable modem user connection attempts (on ports
I could not identify). My first intuition is that these are entirely
unrelated to the martian messages, but without a true understanding of
these things or informative documentation I can't really tell.
This is probaly a trivial issue, so sorry for time-wasting. However
as it has come up more than once, perhaps someone knowledgeable could
provide a little information, for the record, as to how we might evaluate such
messages. If there are no such criteria, then I guess I will just
disable this logging "feature".
Thanks,
Corvin
Jul 20 12:18:21 raven kernel: IPv6 v0.8 for NET4.0 Jul 20 12:18:21 raven kernel: IPv6 over IPv4 tunneling driver
Jul 20 12:18:42 raven kernel: eth0: no IPv6 routers present
Jul 20 12:18:42 raven kernel: eth0: no IPv6 routers present
Jul 20 12:19:47 raven kernel: pppoe uses obsolete (PF_INET,SOCK_PACKET)
Jul 20 12:19:47 raven kernel: registered device ppp0
Jul 20 12:19:53 raven kernel: PPP BSD Compression module registered
Jul 20 12:19:53 raven kernel: PPP Deflate Compression module registered
Jul 20 12:20:08 raven kernel: eth0: no IPv6 routers present
Jul 20 12:20:08 raven kernel: eth0: no IPv6 routers present
Jul 20 12:20:13 raven kernel: registered device ppp1
Jul 20 12:20:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1
Jul 20 12:20:42 raven kernel: ll header: 45 00 00 28
Jul 20 12:22:21 raven kernel: Packet log: input DENY ppp0 PROTO=17 64.217.199.49:3407 216.209.63.6$
Jul 20 12:22:23 raven kernel: Packet log: input DENY ppp0 PROTO=17 64.217.199.49:3407 216.209.63.6$
Jul 20 12:22:25 raven kernel: Packet log: input DENY ppp0 PROTO=17 64.217.199.49:3407 216.209.63.6$
Jul 20 12:22:27 raven kernel: Packet log: input DENY ppp0 PROTO=17 64.217.199.49:3407 216.209.63.6$
Jul 20 12:22:29 raven kernel: Packet log: input DENY ppp0 PROTO=17 64.217.199.49:3407 216.209.63.6$
Jul 20 12:22:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1
Jul 20 12:22:42 raven kernel: ll header: 45 00 00 28
Jul 20 12:23:54 raven kernel: Packet log: input DENY ppp0 PROTO=17 64.13.212.96:1045 216.209.63.62$
Jul 20 12:23:56 raven kernel: Packet log: input DENY ppp0 PROTO=17 64.13.212.96:1045 216.209.63.62$
Jul 20 12:24:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1
Jul 20 12:24:42 raven kernel: ll header: 45 00 00 28
Jul 20 12:24:49 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.218.40.71:4042 216.209.63.62$
Jul 20 12:24:52 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.218.40.71:4042 216.209.63.62$
Jul 20 12:24:52 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.218.40.71:4042 216.209.63.62$
Jul 20 12:24:54 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.218.40.71:4042 216.209.63.62$
Jul 20 12:24:56 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.218.40.71:4042 216.209.63.62$
Jul 20 12:24:56 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.14.254.254:2329 216.209.63.6$
Jul 20 12:24:58 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.14.254.254:2329 216.209.63.6$
Jul 20 12:24:59 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.14.254.254:2329 216.209.63.6$
Jul 20 12:25:00 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.14.254.254:2329 216.209.63.6$
Jul 20 12:25:02 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.14.254.254:2329 216.209.63.6$
Jul 20 12:25:18 raven kernel: Packet log: input DENY ppp0 PROTO=17 64.188.39.98:3898 216.209.63.62$
Jul 20 12:25:20 raven kernel: Packet log: input DENY ppp0 PROTO=17 64.188.39.98:3898 216.209.63.62$
Jul 20 12:25:22 raven kernel: Packet log: input DENY ppp0 PROTO=17 64.188.39.98:3898 216.209.63.62$
Jul 20 12:25:24 raven kernel: Packet log: input DENY ppp0 PROTO=17 64.188.39.98:3898 216.209.63.62$
Jul 20 12:25:25 raven kernel: Packet log: input DENY ppp0 PROTO=17 64.217.199.49:4638 216.209.63.6$
Jul 20 12:25:25 raven kernel: Packet log: input DENY ppp0 PROTO=17 64.188.39.98:3898 216.209.63.62$
Jul 20 12:25:28 raven kernel: Packet log: input DENY ppp0 PROTO=17 63.201.90.0:4682 216.209.63.62:$
Jul 20 12:25:28 raven kernel: Packet log: input DENY ppp0 PROTO=17 63.201.90.0:4682 216.209.63.62:$
Jul 20 12:25:28 raven kernel: Packet log: input DENY ppp0 PROTO=17 63.201.90.0:4682 216.209.63.62:$
Jul 20 12:26:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1
Jul 20 12:26:42 raven kernel: ll header: 45 00 00 28
Jul 20 12:26:55 raven kernel: hdd: 98304kB, 196608 blocks, 512 sector size
Jul 20 12:26:55 raven kernel: VFS: Disk change detected on device ide1(22,68)
Jul 20 12:26:55 raven kernel: hdd: hdd4
Jul 20 12:28:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1
Jul 20 12:28:42 raven kernel: ll header: 45 00 00 28
Jul 20 12:29:42 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.1.233.183:2874 216.209.63.62$
Jul 20 12:29:44 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.1.233.183:2874 216.209.63.62$
Jul 20 12:29:44 raven kernel: VFS: Disk change detected on device ide1(22,68)
Jul 20 12:29:44 raven kernel: hdd: hdd4
Jul 20 12:29:46 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.1.233.183:2874 216.209.63.62$
Jul 20 12:29:48 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.1.233.183:2874 216.209.63.62$
Jul 20 12:29:50 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.1.233.183:2874 216.209.63.62$
Jul 20 12:29:58 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.12.158.209:3857 216.209.63.6$
Jul 20 12:30:00 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.12.158.209:3857 216.209.63.6$
Jul 20 12:30:02 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.12.158.209:3857 216.209.63.6$
Jul 20 12:30:04 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.12.158.209:3857 216.209.63.6$
Jul 20 12:30:06 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.12.158.209:3857 216.209.63.6$
Jul 20 12:30:25 raven kernel: VFS: Disk change detected on device ide1(22,68)
Jul 20 12:30:25 raven kernel: hdd: hdd4
Jul 20 12:30:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1
Jul 20 12:30:42 raven kernel: ll header: 45 00 00 28
Jul 20 12:32:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1
Jul 20 12:32:42 raven kernel: ll header: 45 00 00 28
Jul 20 12:33:19 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.19.92.38:1214 216.209.63.62:$
Jul 20 12:33:21 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.19.92.38:1214 216.209.63.62:$
Jul 20 12:33:23 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.19.92.38:1214 216.209.63.62:$
Jul 20 12:33:25 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.19.92.38:1214 216.209.63.62:$
Jul 20 12:33:27 raven kernel: Packet log: input DENY ppp0 PROTO=17 24.19.92.38:1214 216.209.63.62:$
Jul 20 12:33:53 raven kernel: Packet log: input DENY ppp0 PROTO=17 164.113.56.203:2642 216.209.63.$
Jul 20 12:34:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1
Jul 20 12:34:42 raven kernel: ll header: 45 00 00 28
Jul 20 12:36:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1
Jul 20 12:36:42 raven kernel: ll header: 45 00 00 28
--
Corvin Russell
On Thu, 20 Jul 2000, Corvin Russell wrote:
Jul 20 12:20:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1
Just a first hint: By scanning the kernel 2.2.5 source tree I found the source of the log message above in net/ipv4/route.c
martian_source: #ifdef CONFIG_IP_ROUTE_VERBOSE if (IN_DEV_LOG_MARTIANS(in_dev) && net_ratelimit()) { /* * RFC1812 recommenadtion, if source is martian, * the only hint is MAC header. */ printk(KERN_WARNING "martian source %08x for %08x, dev %s\n", sa ddr, daddr, dev->name); if (dev->hard_header_len) { int i; unsigned char *p = skb->mac.raw; printk(KERN_WARNING "ll header:"); for (i=0; i<dev->hard_header_len; i++, p++) printk(" %02x", *p); printk("\n"); } } #endif
Maybe you would like to have a look at RFC1812 And from Documentation/proc.txt about the entries in subdirectories of /proc/sys/net/ipv4/conf
log_martians Log packets with source addresses with no known route to kernel log.
And from Documentation/Configure.help
CONFIG_IP_ROUTE_VERBOSE If you say Y here, which is recommended, then the kernel will print verbose messages regarding the routing, for example warnings about received packets which look strange and could be evidence of an attack or a misconfigured system somewhere. The information is handled by the klogd daemon which is responsible for kernel messages ("man klogd").
And "warnings about received packets which look strange and could be evidence of an attack" looks like a security issue, while "or a misconfigured system somewhere" is not. Cheers, Thomas |--------------------------------------------------------------------------| | Thomas Forbriger email: Thomas.Forbriger@geophys.uni-stuttgart.de | | Universitaet Stuttgart - Institut fuer Geophysik | | Richard-Wagner-Str. 44 D-70184 Stuttgart Germany | | Tel ++49 (711) 121-3593 or 3422 or 3424 or 3590 | Fax ++49 (711) 2361218 | | http://www.geophys.uni-stuttgart.de/thof | | "... there's nothing more bizarre than reality..." (M. Kindermann) |
Hi Thomas,
Thanks very much for your help. I will carefully follow up on, and
digest, your pointers. If I can later offer a summary, I will.
Best,
Corvin
--
Corvin Russell
The only other clue, as I see now, is that the messages come at exactly 2-minute intervals. I have fetchmail running as a background process polling every 2 minutes. So this makes some sense of that.
--
Corvin Russell
Hi Corvin, For "martian source" partial reference jump to the following, it is illuminant!! =:`) "[SLE] martian source in dev eth0" from Carlos Illana (cillana@teleline.es) http://lists.suse.com/archives/suse-linux-e/2000-Jul/0221.html and related Eilert Brinkmann's (eilert@Informatik.Uni-Bremen.DE) reply: http://lists.suse.com/archives/suse-linux-e/2000-Jul/0282.html HTH Best regards, Eduardo Carriles [-- Better a smile than a flame --] (Long time SuSE-Linux [prefered distro] user). [-- Se me nota mucho? -- Notices me much?] [-- Have a lot of fun...] ---- Corvin Russell wrote:
Hi,
I know this suject was brought up first in Jan, then in July again. However, there is nothing in the way of documentation (I think I found about three lapidary lines) to really let one know, as another questioner wanted to, whether this is at all a security issue. Put another way, what is the utility of this obscure kernel function? How are we to use the information so gained?
Twice now I have had kernel messages like the following:
Jul 20 12:20:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1 Jul 20 12:20:42 raven kernel: ll header: 45 00 00 28 Jul 20 12:22:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1 Jul 20 12:22:42 raven kernel: ll header: 45 00 00 28 Jul 20 12:24:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1 Jul 20 12:24:42 raven kernel: ll header: 45 00 00 28 [snip...]
This is probaly a trivial issue,
Not so trivial, thought!! =:`)
so sorry for time-wasting. However as it has come up more than once, perhaps someone knowledgeable could provide a little information, for the record, as to how we might evaluate such messages. If there are no such criteria, then I guess I will just disable this logging "feature".
Better follow the previous links first. =8`)
Thanks,
Don't need to...
Corvin
[snip...] -- Corvin Russell
participants (3)
-
Corvin Russell -
Eduardo Carriles -
Thomas Forbriger