On Fri, 2004-01-09 at 18:33, Carlos E. R. wrote:
The Thursday 2004-01-08 at 20:40 -0500, L. Mark Stone wrote:
Note that the machine generating these messages has a fixed private IP address of 192.168.15.225, runs Samba server and connects to the Internet (via wireless) through a SonicWall Tele3 appliance (if all of that info is helpful).
Thanks!
Jan 8 20:33:13 outside kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=wlan0 OUT= MAC= SRC=192.168.15.225 DST=192.168.15.255 LEN=259 TOS=0x00 PREC=0x00 TTL=64 ID=6763 DF PROTO=UDP SPT=138 DPT=138 LEN=239 Jan 8 20:33:13 outside kernel: martian source 192.168.15.255 from 192.168.15.225, on dev wlan0 Jan 8 20:33:13 outside kernel: ll header: ff:ff:ff:ff:ff:ff:00:80:c8:16:38:4a:08:00
To what is connected /dev/wlan0? Who has the above ethernet address? Try "arp -a"
That will give you the machine sending those packets.
Carlos, outside:/home/lmstone # arp -a ? (192.168.15.1) at 00:80:C8:0A:16:48 [ether] on wlan0 ? (192.168.15.150) at 00:40:10:17:4D:D1 [ether] on wlan0 ? (192.168.15.200) at 00:50:8B:CF:F1:74 [ether] on wlan0 You have new mail in /var/spool/mail/lmstone outside:/home/lmstone # 192.168.15.1 is a wireless access point (my machine, which has an IP of 192.168.15.225, has a wireless NIC). 192.168.15.150 is a Compaq server running SuSE Pro 9. 192.168.15.200 is a SonicWall Tele3 Firewall/VPN appliance that acts as the network gateway and which connects to the cable modem. The log file is from my machine; it looks to me like my machine is generating the broadcasts, not anything else on the LAN. Saludos, Mark -- ______________________________________________________________ L. Mark Stone President Reliable Networks of Maine, LLC 477 Congress Street, 5th Floor Portland, ME 04107 Tel: (207) 772-5678 Cell: (917) 597-2057 Email: LMStone@RNoME.com Web: http://www.RNoME.com