-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Steffen Dettmer [mailto:steffen@dett.de] wrote: * Hella.Breitkopf@varetis.de wrote on Fri, Apr 20, 2001 at 20:16 +0200:
mash@myfuckingnet.com on Thu, Apr 19, 2001 at 10:41 +0200 had found the martians in his log files:
Apr 18 12:04:38 server kernel: martian source c799fea9 for c799fea9, dev eth0
Steffen Dettmer <steffen@dett.de> had some perl code to decode this:
* Hella.Breitkopf@varetis.de wrote on Fri, Apr 20, 2001 at 20:16 +0200 had thesis about that:
[THESIS 1] So are there two possibilities to write hex IP addresses and the found "martians" in the log files are written backwards (right to left)
I think that's it, and that's why the scripts is like is it. I wrote it when I got a martian from 192.168.1.255. But maybe this came from 255.1.168.192 - but this looks not familar... But I have never confirmed hat or whatever. The script may be wrong. Look at the kernel sources if unsure.
I haven't found any prove for one of these thesises - but would be very interested in resources proving one of the two.
*Steffen Dettmer* proved that the address logs are done in network byte order
But back to security. You told:
ff ff fe a9 is in my universe (if read from left to right) = 255.255.254.169
which makes me assume that 169.254.255.255 is not. A whois shows quickly:
Netname: LINKLOCAL
hum! Such a funny thing. But who should recognize LINKLOCAL in hex and network byte order! :) funny :) :)
So maybe there's some Win host getting bored and sending junk... To learn more about link local, use your favorite search engine. I've forgotten the story.
As I told, check for move laptops and such things.
I did not find the right RFC, but at least Microsoft and Apple dynamically assign 169.254/16 IP addresses to DHCP clients when their DHCP-requests time out (they call it "Plug-And-Play Networking"). Just my $0.02 Thomas -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com> iQA/AwUBOuHYnUJRmQkE7ThJEQKZoACgweEGeVjJdaDLpmfQrHUasWDCcPsAnRYG JtI4Nzzynh3H9ixHWZmGRXl4 =hkib -----END PGP SIGNATURE-----