I looked in the archives, but the previous posts on this topic didn't say for sure whether these log entries are benign (or not). Anyone care to hazard a guess at the interpretation of the following entries? Note that the machine generating these messages has a fixed private IP address of 192.168.15.225, runs Samba server and connects to the Internet (via wireless) through a SonicWall Tele3 appliance (if all of that info is helpful). Thanks! Jan 8 20:33:13 outside kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=wlan0 OUT= MAC= SRC=192.168.15.225 DST=192.168.15.255 LEN=259 TOS=0x00 PREC=0x00 TTL=64 ID=6763 DF PROTO=UDP SPT=138 DPT=138 LEN=239 Jan 8 20:33:13 outside kernel: martian source 192.168.15.255 from 192.168.15.225, on dev wlan0 Jan 8 20:33:13 outside kernel: ll header: ff:ff:ff:ff:ff:ff:00:80:c8:16:38:4a:08:00 Jan 8 20:33:13 outside kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=wlan0 OUT= MAC= SRC=192.168.15.225 DST=192.168.15.255 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=6764 DF PROTO=UDP SPT=137 DPT=137 LEN=76 Jan 8 20:33:13 outside kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=wlan0 OUT= MAC= SRC=192.168.15.225 DST=192.168.15.255 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=6765 DF PROTO=UDP SPT=137 DPT=137 LEN=76 Jan 8 20:33:13 outside kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=wlan0 OUT= MAC= SRC=192.168.15.225 DST=192.168.15.255 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=6766 DF PROTO=UDP SPT=137 DPT=137 LEN=76 Jan 8 20:33:13 outside kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=wlan0 OUT= MAC= SRC=192.168.15.225 DST=192.168.15.255 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=6767 DF PROTO=UDP SPT=137 DPT=137 LEN=76 Jan 8 20:33:13 outside kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=wlan0 OUT= MAC= SRC=192.168.15.225 DST=192.168.15.255 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=6768 DF PROTO=UDP SPT=137 DPT=137 LEN=76 Jan 8 20:33:13 outside kernel: martian source 192.168.15.255 from 192.168.15.225, on dev wlan0 Jan 8 20:33:13 outside kernel: ll header: ff:ff:ff:ff:ff:ff:00:80:c8:16:38:4a:08:00 Jan 8 20:33:13 outside kernel: martian source 192.168.15.255 from 192.168.15.225, on dev wlan0 Jan 8 20:33:13 outside kernel: ll header: ff:ff:ff:ff:ff:ff:00:80:c8:16:38:4a:08:00 Jan 8 20:33:13 outside kernel: martian source 192.168.15.255 from 192.168.15.225, on dev wlan0 Jan 8 20:33:13 outside kernel: ll header: ff:ff:ff:ff:ff:ff:00:80:c8:16:38:4a:08:00 Jan 8 20:33:13 outside kernel: martian source 192.168.15.255 from 192.168.15.225, on dev wlan0 Jan 8 20:33:13 outside kernel: ll header: ff:ff:ff:ff:ff:ff:00:80:c8:16:38:4a:08:00 Jan 8 20:33:13 outside kernel: martian source 192.168.15.255 from 192.168.15.225, on dev wlan0 Jan 8 20:33:13 outside kernel: ll header: ff:ff:ff:ff:ff:ff:00:80:c8:16:38:4a:08:00 Jan 8 20:33:14 outside kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=wlan0 OUT= MAC= SRC=192.168.15.225 DST=192.168.15.255 LEN=259 TOS=0x00 PREC=0x00 TTL=64 ID=6769 DF PROTO=UDP SPT=138 DPT=138 LEN=239 Jan 8 20:33:15 outside kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=wlan0 OUT= MAC= SRC=192.168.15.225 DST=192.168.15.255 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=6770 DF PROTO=UDP SPT=137 DPT=137 LEN=76 Jan 8 20:33:15 outside kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=wlan0 OUT= MAC= SRC=192.168.15.225 DST=192.168.15.255 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=6771 DF PROTO=UDP SPT=137 DPT=137 LEN=76 Jan 8 20:33:15 outside kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=wlan0 OUT= MAC= SRC=192.168.15.225 DST=192.168.15.255 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=6772 DF PROTO=UDP SPT=137 DPT=137 LEN=76 Jan 8 20:33:15 outside kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=wlan0 OUT= MAC= SRC=192.168.15.225 DST=192.168.15.255 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=6773 DF PROTO=UDP SPT=137 DPT=137 LEN=76 Jan 8 20:33:15 outside kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=wlan0 OUT= MAC= SRC=192.168.15.225 DST=192.168.15.255 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=6774 DF PROTO=UDP SPT=137 DPT=137 LEN=76 Jan 8 20:33:15 outside kernel: martian source 192.168.15.255 from 192.168.15.225, on dev wlan0 Jan 8 20:33:15 outside kernel: ll header: ff:ff:ff:ff:ff:ff:00:80:c8:16:38:4a:08:00 Jan 8 20:33:15 outside kernel: martian source 192.168.15.255 from 192.168.15.225, on dev wlan0 Jan 8 20:33:15 outside kernel: ll header: ff:ff:ff:ff:ff:ff:00:80:c8:16:38:4a:08:00 Jan 8 20:33:15 outside kernel: martian source 192.168.15.255 from 192.168.15.225, on dev wlan0 Jan 8 20:33:15 outside kernel: ll header: ff:ff:ff:ff:ff:ff:00:80:c8:16:38:4a:08:00 Jan 8 20:33:15 outside kernel: martian source 192.168.15.255 from 192.168.15.225, on dev wlan0 Jan 8 20:33:15 outside kernel: ll header: ff:ff:ff:ff:ff:ff:00:80:c8:16:38:4a:08:00 Jan 8 20:33:16 outside kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=wlan0 OUT= MAC= SRC=192.168.15.225 DST=192.168.15.255 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=6775 DF PROTO=UDP SPT=137 DPT=137 LEN=76 Jan 8 20:33:16 outside kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=wlan0 OUT= MAC= SRC=192.168.15.225 DST=192.168.15.255 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=6776 DF PROTO=UDP SPT=137 DPT=137 LEN=76 Jan 8 20:33:16 outside kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=wlan0 OUT= MAC= SRC=192.168.15.225 DST=192.168.15.255 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=6777 DF PROTO=UDP SPT=137 DPT=137 LEN=76 Jan 8 20:33:16 outside kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=wlan0 OUT= MAC= SRC=192.168.15.225 DST=192.168.15.255 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=6778 DF PROTO=UDP SPT=137 DPT=137 LEN=76 Jan 8 20:33:16 outside kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=wlan0 OUT= MAC= SRC=192.168.15.225 DST=192.168.15.255 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=6779 DF PROTO=UDP SPT=137 DPT=137 LEN=76 Jan 8 20:33:17 outside kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=wlan0 OUT= MAC= SRC=192.168.15.225 DST=192.168.15.255 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=6780 DF PROTO=UDP SPT=137 DPT=137 LEN=76 Jan 8 20:33:17 outside kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=wlan0 OUT= MAC= SRC=192.168.15.225 DST=192.168.15.255 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=6781 DF PROTO=UDP SPT=137 DPT=137 LEN=76 Jan 8 20:33:17 outside kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=wlan0 OUT= MAC= SRC=192.168.15.225 DST=192.168.15.255 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=6782 DF PROTO=UDP SPT=137 DPT=137 LEN=76 Jan 8 20:33:17 outside kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=wlan0 OUT= MAC= SRC=192.168.15.225 DST=192.168.15.255 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=6783 DF PROTO=UDP SPT=137 DPT=137 LEN=76 Jan 8 20:33:17 outside kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=wlan0 OUT= MAC= SRC=192.168.15.225 DST=192.168.15.255 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=6784 DF PROTO=UDP SPT=137 DPT=137 LEN=76 -- ______________________________________________________________ L. Mark Stone President Reliable Networks of Maine, LLC 477 Congress Street, 5th Floor Portland, ME 04107 Tel: (207) 772-5678 Cell: (917) 597-2057 Email: LMStone@RNoME.com Web: http://www.RNoME.com
The Thursday 2004-01-08 at 20:40 -0500, L. Mark Stone wrote:
Note that the machine generating these messages has a fixed private IP address of 192.168.15.225, runs Samba server and connects to the Internet (via wireless) through a SonicWall Tele3 appliance (if all of that info is helpful).
Thanks!
Jan 8 20:33:13 outside kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=wlan0 OUT= MAC= SRC=192.168.15.225 DST=192.168.15.255 LEN=259 TOS=0x00 PREC=0x00 TTL=64 ID=6763 DF PROTO=UDP SPT=138 DPT=138 LEN=239 Jan 8 20:33:13 outside kernel: martian source 192.168.15.255 from 192.168.15.225, on dev wlan0 Jan 8 20:33:13 outside kernel: ll header: ff:ff:ff:ff:ff:ff:00:80:c8:16:38:4a:08:00
To what is connected /dev/wlan0? Who has the above ethernet address? Try "arp -a" That will give you the machine sending those packets. -- Cheers, Carlos Robinson
On Fri, 2004-01-09 at 18:33, Carlos E. R. wrote:
The Thursday 2004-01-08 at 20:40 -0500, L. Mark Stone wrote:
Note that the machine generating these messages has a fixed private IP address of 192.168.15.225, runs Samba server and connects to the Internet (via wireless) through a SonicWall Tele3 appliance (if all of that info is helpful).
Thanks!
Jan 8 20:33:13 outside kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=wlan0 OUT= MAC= SRC=192.168.15.225 DST=192.168.15.255 LEN=259 TOS=0x00 PREC=0x00 TTL=64 ID=6763 DF PROTO=UDP SPT=138 DPT=138 LEN=239 Jan 8 20:33:13 outside kernel: martian source 192.168.15.255 from 192.168.15.225, on dev wlan0 Jan 8 20:33:13 outside kernel: ll header: ff:ff:ff:ff:ff:ff:00:80:c8:16:38:4a:08:00
To what is connected /dev/wlan0? Who has the above ethernet address? Try "arp -a"
That will give you the machine sending those packets.
Carlos, outside:/home/lmstone # arp -a ? (192.168.15.1) at 00:80:C8:0A:16:48 [ether] on wlan0 ? (192.168.15.150) at 00:40:10:17:4D:D1 [ether] on wlan0 ? (192.168.15.200) at 00:50:8B:CF:F1:74 [ether] on wlan0 You have new mail in /var/spool/mail/lmstone outside:/home/lmstone # 192.168.15.1 is a wireless access point (my machine, which has an IP of 192.168.15.225, has a wireless NIC). 192.168.15.150 is a Compaq server running SuSE Pro 9. 192.168.15.200 is a SonicWall Tele3 Firewall/VPN appliance that acts as the network gateway and which connects to the cable modem. The log file is from my machine; it looks to me like my machine is generating the broadcasts, not anything else on the LAN. Saludos, Mark -- ______________________________________________________________ L. Mark Stone President Reliable Networks of Maine, LLC 477 Congress Street, 5th Floor Portland, ME 04107 Tel: (207) 772-5678 Cell: (917) 597-2057 Email: LMStone@RNoME.com Web: http://www.RNoME.com
The Friday 2004-01-09 at 23:00 -0500, L. Mark Stone wrote:
On Fri, 2004-01-09 at 18:33, Carlos E. R. wrote:
The Thursday 2004-01-08 at 20:40 -0500, L. Mark Stone wrote:
Note that the machine generating these messages has a fixed private IP address of 192.168.15.225, runs Samba server and connects to the Internet (via wireless) through a SonicWall Tele3 appliance (if all of that info is helpful).
Thanks!
Jan 8 20:33:13 outside kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=wlan0 OUT= MAC= SRC=192.168.15.225 DST=192.168.15.255 LEN=259 TOS=0x00 PREC=0x00 TTL=64 ID=6763 DF PROTO=UDP SPT=138 DPT=138 LEN=239 Jan 8 20:33:13 outside kernel: martian source 192.168.15.255 from 192.168.15.225, on dev wlan0 Jan 8 20:33:13 outside kernel: ll header: ff:ff:ff:ff:ff:ff:00:80:c8:16:38:4a:08:00
To what is connected /dev/wlan0? Who has the above ethernet address? Try "arp -a"
That will give you the machine sending those packets.
Carlos,
outside:/home/lmstone # arp -a ? (192.168.15.1) at 00:80:C8:0A:16:48 [ether] on wlan0 ? (192.168.15.150) at 00:40:10:17:4D:D1 [ether] on wlan0 ? (192.168.15.200) at 00:50:8B:CF:F1:74 [ether] on wlan0
Ok. The machine sending the martian things is the one with the MAC address of "ff:ff:ff:ff:ff:ff:00:80:c8:16:38:4a:08:00". From the output of the arp command 192.168.15.1 has a similar ethernet mac address, but not quite the same. Could you double check your logs? At the same time as the command. If we accept it that it is the same, then it seems that is sending claiming to be 192.168.15.225 instead, if I read it correctly. I'm a bit thick today :-)
192.168.15.1 is a wireless access point (my machine, which has an IP of 192.168.15.225, has a wireless NIC).
Phisically diferent interfaces?
The log file is from my machine; it looks to me like my machine is generating the broadcasts, not anything else on the LAN.
Not quite. The kernel says it is a martian source because it is getting an IP from outside that it knows it is impossible, because it is it's own IP. The firewall says it is an invented IP (spoofed). So, it gives you the hardware address (MAC) so that you can manually check who is claiming to be you. On a side note... you could enable "snort" (rcsnort start): Snort - open source network intrusion detection system This a log of one of those martian packets (different type from yours): [**] [1:528:3] BAD TRAFFIC loopback traffic [**] [Classification: Potentially Bad Traffic] [Priority: 2] 10/18-21:16:13.730730 127.0.0.1:80 -> 212.166.94.225:1764 TCP TTL:127 TOS:0x0 ID:21132 IpLen:20 DgmLen:40 ***A*R** Seq: 0x0 Ack: 0x64C60001 Win: 0x0 TcpLen: 20 [Xref => url rr.sans.org/firewall/egress.php] You can look at that url for some more documentation on this. And, if they are frequent, you can use "ethereal" to log the packets and look at them. -- Cheers, Carlos Robinson
Carlos, Problem not solved, but I'm no longer concerned. Looking more carefully through the logs and an Ethereal trace, I see that the MAC addresses that show up as generating the errors are the ones for my wireless adapter and two more for the wireless router (running in access point mode). I just upgraded the firmware on the router, but I'm still getting the errors. So, since I now know that the Martians are friendly, I can rest easy! Thanks again for your hlp! Mark On Sat, 2004-01-10 at 11:18, Carlos E. R. wrote:
The Friday 2004-01-09 at 23:00 -0500, L. Mark Stone wrote:
On Fri, 2004-01-09 at 18:33, Carlos E. R. wrote:
The Thursday 2004-01-08 at 20:40 -0500, L. Mark Stone wrote:
Note that the machine generating these messages has a fixed private IP address of 192.168.15.225, runs Samba server and connects to the Internet (via wireless) through a SonicWall Tele3 appliance (if all of that info is helpful).
Thanks!
Jan 8 20:33:13 outside kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=wlan0 OUT= MAC= SRC=192.168.15.225 DST=192.168.15.255 LEN=259 TOS=0x00 PREC=0x00 TTL=64 ID=6763 DF PROTO=UDP SPT=138 DPT=138 LEN=239 Jan 8 20:33:13 outside kernel: martian source 192.168.15.255 from 192.168.15.225, on dev wlan0 Jan 8 20:33:13 outside kernel: ll header: ff:ff:ff:ff:ff:ff:00:80:c8:16:38:4a:08:00
To what is connected /dev/wlan0? Who has the above ethernet address? Try "arp -a"
That will give you the machine sending those packets.
Carlos,
outside:/home/lmstone # arp -a ? (192.168.15.1) at 00:80:C8:0A:16:48 [ether] on wlan0 ? (192.168.15.150) at 00:40:10:17:4D:D1 [ether] on wlan0 ? (192.168.15.200) at 00:50:8B:CF:F1:74 [ether] on wlan0
Ok. The machine sending the martian things is the one with the MAC address of "ff:ff:ff:ff:ff:ff:00:80:c8:16:38:4a:08:00". From the output of the arp command 192.168.15.1 has a similar ethernet mac address, but not quite the same. Could you double check your logs? At the same time as the command. If we accept it that it is the same, then it seems that is sending claiming to be 192.168.15.225 instead, if I read it correctly.
I'm a bit thick today :-)
192.168.15.1 is a wireless access point (my machine, which has an IP of 192.168.15.225, has a wireless NIC).
Phisically diferent interfaces?
The log file is from my machine; it looks to me like my machine is generating the broadcasts, not anything else on the LAN.
Not quite. The kernel says it is a martian source because it is getting an IP from outside that it knows it is impossible, because it is it's own IP. The firewall says it is an invented IP (spoofed). So, it gives you the hardware address (MAC) so that you can manually check who is claiming to be you.
On a side note... you could enable "snort" (rcsnort start):
Snort - open source network intrusion detection system
This a log of one of those martian packets (different type from yours):
[**] [1:528:3] BAD TRAFFIC loopback traffic [**] [Classification: Potentially Bad Traffic] [Priority: 2] 10/18-21:16:13.730730 127.0.0.1:80 -> 212.166.94.225:1764 TCP TTL:127 TOS:0x0 ID:21132 IpLen:20 DgmLen:40 ***A*R** Seq: 0x0 Ack: 0x64C60001 Win: 0x0 TcpLen: 20 [Xref => url rr.sans.org/firewall/egress.php]
You can look at that url for some more documentation on this.
And, if they are frequent, you can use "ethereal" to log the packets and look at them.
-- Cheers, Carlos Robinson --
L. Mark Stone President Reliable Networks of Maine, LLC 477 Congress Street, 5th Floor Portland, ME 04107 Tel: (207) 772-5678 Cell: (917) 597-2057 Email: LMStone@RNoME.com Web: http://www.RNoME.com
On Friday 09 January 2004 01:40 am, L. Mark Stone wrote:
I looked in the archives, but the previous posts on this topic didn't say for sure whether these log entries are benign (or not).
Anyone care to hazard a guess at the interpretation of the following entries?
Note that the machine generating these messages has a fixed private IP address of 192.168.15.225, runs Samba server and connects to the Internet (via wireless) through a SonicWall Tele3 appliance (if all of that info is helpful).
Thanks!
Jan 8 20:33:13 outside kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=wlan0 OUT= MAC= SRC=192.168.15.225 DST=192.168.15.255 LEN=259 TOS=0x00 PREC=0x00 TTL=64 ID=6763 DF PROTO=UDP SPT=138 DPT=138 LEN=239
Hmmm... The 192.168.15.255 address is the broadcast address for the 192.168.15.0/24 subnet, so you shouldn't really have an interface with that IP address. Thus, this box ('outside') is receiving a broadcast message from another box on that subnet. Actually, it looks like 'outside' is sending this packet. The SPT= and DPT= are Source and Destination Port - 138 is something to do with NETBIOS, so likely related to samba. Maybe 'outside' is broadcasting for any other smb servers on the network?
Jan 8 20:33:13 outside kernel: martian source 192.168.15.255 from 192.168.15.225, on dev wlan0 Jan 8 20:33:13 outside kernel: ll header: ff:ff:ff:ff:ff:ff:00:80:c8:16:38:4a:08:00
This is nothing to worry about too much. I've been investigating martian source packets for a month or so recently, and all I can discover is that they are Mostly Harmless. The MAC address of the offending machine is contained in the 'll header:...' line. As to why they occur or how to get rid of them, there seems to be no answer. The best I found is document RFC1812 (from www.w3c.org) : <QUOTE> 5.3.7 Martian Address Filtering An IP source address is invalid if it is a special IP address, as defined in 4.2.2.11 or 5.3.7, or is not a unicast address. An IP destination address is invalid if it is among those defined as illegal destinations in 4.2.3.1, or is a Class E address (except 255.255.255.255). A router SHOULD NOT forward any packet that has an invalid IP source address or a source address on network 0. A router SHOULD NOT forward, except over a loopback interface, any packet that has a source address on network 127. A router MAY have a switch that allows the network manager to disable these checks. If such a switch is provided, it MUST default to performing the checks. A router SHOULD NOT forward any packet that has an invalid IP destination address or a destination address on network 0. A router SHOULD NOT forward, except over a loopback interface, any packet that has a destination address on network 127. A router MAY have a switch that allows the network manager to disable these checks. If such a switch is provided, it MUST default to performing the checks. If a router discards a packet because of these rules, it SHOULD log at least the IP source address, the IP destination address, and, if Baker Standards Track [Page 96] RFC 1812 Requirements for IP Version 4 Routers June 1995 the problem was with the source address, the physical interface on which the packet was received and the Link Layer address of the host or router from which the packet was received. 5.3.8 Source Address Validation A router SHOULD IMPLEMENT the ability to filter traffic based on a comparison of the source address of a packet and the forwarding table for a logical interface on which the packet was received. If this filtering is enabled, the router MUST silently discard a packet if the interface on which the packet was received is not the interface on which a packet would be forwarded to reach the address contained in the source address. In simpler terms, if a router wouldn't route a packet containing this address through a particular interface, it shouldn't believe the address if it appears as a source address in a packet read from this interface. If this feature is implemented, it MUST be disabled by default. DISCUSSION This feature can provide useful security improvements in some situations, but can erroneously discard valid packets in situations where paths are asymmetric. </QUOTE> You can turn off the logging of these with: echo 0 > /proc/sys/net/ipv4/conf/<interface>/log_martians but I would expect that if you change the IP of 'outside' wlan0 you'll not see the errors. HTH Dylan -- "They that can give up essential liberty to obtain a little temporary safety, deserve neither liberty nor safety." -Benjamin Franklin
participants (3)
-
Carlos E. R. -
Dylan -
L. Mark Stone