On Monday 04 June 2001 16:30, Phil Schrettenbrunner wrote:
Hello List,
seeing my Windows Firewall (ZoneAlarm) going crazy because of a PingScan, I switched to my Linux PC (SuSE 7.1) and startet ethereal to see whats goging one. Seeing tons of ICMP Echo request packages I took a look at my /var/log/messages (which has grown up to 8 MB so far) and I found the following entries (all the same, each second for about 18 min)
Jun 4 16:01:36 <myHost> kernel: martian source 0b6edec3 for ff6edec3, dev eth0 Jun 4 16:01:36 <myHost> kernel: ll header: ff ff ff ff ff ff 00 08 c7 ea 7b 85 08 00
[if i'm not mistaken] "Martian source" means the kernel received a packet that, according to routing table / netmask, cannot legally arrive there. This would happen, for instance, if you configured your network for 192.168.x.x and a packet claiming to be from 10.x.x.x arrived there, etc. Thus; a sanity-check. However, it is difficult to read because the IPnumbers are notated in hex and (for PC architectures) reversed as well. Decode as follows: Split the number in four 2digit pairs, then convert from hex to decimal: 0b => 11, 6e => 110, de => 222, c3 => 195 then reverse and add the dots: => 195.222.110.11 etc. So, the message reads something like: "Unexpected, illegal packet claiming to be from 195.222.110.11 destined for 195.222.110.255 detected on eth0." Whether someone is trying nasty stuff or it is just a misconfiguration I cannot tell because I don't know what your IP number REALLY is. Maybe someone just made a typo while configuring something. Maarten