On Thu, 20 Jul 2000, Corvin Russell wrote:
Jul 20 12:20:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1
Just a first hint: By scanning the kernel 2.2.5 source tree I found the source of the log message above in net/ipv4/route.c
martian_source: #ifdef CONFIG_IP_ROUTE_VERBOSE if (IN_DEV_LOG_MARTIANS(in_dev) && net_ratelimit()) { /* * RFC1812 recommenadtion, if source is martian, * the only hint is MAC header. */ printk(KERN_WARNING "martian source %08x for %08x, dev %s\n", sa ddr, daddr, dev->name); if (dev->hard_header_len) { int i; unsigned char *p = skb->mac.raw; printk(KERN_WARNING "ll header:"); for (i=0; i<dev->hard_header_len; i++, p++) printk(" %02x", *p); printk("\n"); } } #endif
Maybe you would like to have a look at RFC1812 And from Documentation/proc.txt about the entries in subdirectories of /proc/sys/net/ipv4/conf
log_martians Log packets with source addresses with no known route to kernel log.
And from Documentation/Configure.help
CONFIG_IP_ROUTE_VERBOSE If you say Y here, which is recommended, then the kernel will print verbose messages regarding the routing, for example warnings about received packets which look strange and could be evidence of an attack or a misconfigured system somewhere. The information is handled by the klogd daemon which is responsible for kernel messages ("man klogd").
And "warnings about received packets which look strange and could be evidence of an attack" looks like a security issue, while "or a misconfigured system somewhere" is not. Cheers, Thomas |--------------------------------------------------------------------------| | Thomas Forbriger email: Thomas.Forbriger@geophys.uni-stuttgart.de | | Universitaet Stuttgart - Institut fuer Geophysik | | Richard-Wagner-Str. 44 D-70184 Stuttgart Germany | | Tel ++49 (711) 121-3593 or 3422 or 3424 or 3590 | Fax ++49 (711) 2361218 | | http://www.geophys.uni-stuttgart.de/thof | | "... there's nothing more bizarre than reality..." (M. Kindermann) |