Mailinglist Archive: opensuse-security (260 mails)

< Previous Next >
Re: [suse-security] Martian source
  • From: Thomas Forbriger <thof@xxxxxxxxxxxxxxxxxxxxxxxx>
  • Date: Thu, 20 Jul 2000 20:42:41 +0200 (MEST)
  • Message-id: <Pine.LNX.4.10.10007202033170.1025-100000@xxxxxxxxxxxx>
On Thu, 20 Jul 2000, Corvin Russell wrote:

>
> Jul 20 12:20:42 raven kernel: martian source 09da30d0 for ca3fd1d8, dev ppp1

Just a first hint:

By scanning the kernel 2.2.5 source tree I found the source of the log message
above in net/ipv4/route.c

>> martian_source:
>> #ifdef CONFIG_IP_ROUTE_VERBOSE
>> if (IN_DEV_LOG_MARTIANS(in_dev) && net_ratelimit()) {
>> /*
>> * RFC1812 recommenadtion, if source is martian,
>> * the only hint is MAC header.
>> */
>> printk(KERN_WARNING "martian source %08x for %08x, dev %s\n", sa
>> ddr, daddr, dev->name);
>> if (dev->hard_header_len) {
>> int i;
>> unsigned char *p = skb->mac.raw;
>> printk(KERN_WARNING "ll header:");
>> for (i=0; i<dev->hard_header_len; i++, p++)
>> printk(" %02x", *p);
>> printk("\n");
>> }
>> }
>> #endif

Maybe you would like to have a look at RFC1812

And from Documentation/proc.txt about the entries in subdirectories of
/proc/sys/net/ipv4/conf

>> log_martians
>> Log packets with source addresses with no known route to kernel log.

And from Documentation/Configure.help

>> CONFIG_IP_ROUTE_VERBOSE
>> If you say Y here, which is recommended, then the kernel will print
>> verbose messages regarding the routing, for example warnings about
>> received packets which look strange and could be evidence of an
>> attack or a misconfigured system somewhere. The information is
>> handled by the klogd daemon which is responsible for kernel messages
>> ("man klogd").

And "warnings about received packets which look strange and could be evidence
of an attack" looks like a security issue, while "or a misconfigured system
somewhere" is not.

Cheers,
Thomas

|--------------------------------------------------------------------------|
| Thomas Forbriger email: Thomas.Forbriger@xxxxxxxxxxxxxxxxxxxxxxxx |
| Universitaet Stuttgart - Institut fuer Geophysik |
| Richard-Wagner-Str. 44 D-70184 Stuttgart Germany |
| Tel ++49 (711) 121-3593 or 3422 or 3424 or 3590 | Fax ++49 (711) 2361218 |
| http://www.geophys.uni-stuttgart.de/thof |
| "... there's nothing more bizarre than reality..." (M. Kindermann) |


< Previous Next >
Follow Ups
References