LinuxQuestions.org
LinuxAnswers - the LQ Linux tutorial section.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
LinkBack Search this Thread
Old 03-28-2005, 06:56 AM   #1
yapp
Member
 
Registered: Apr 2003
Location: Netherlands
Distribution: SuSE (before: Gentoo, Slackware)
Posts: 613

Rep: Reputation: 30
martian source from my own IP?


In 'dmesg' I noticed these warnings:

Code:
martian source 10.0.0.100 from 10.0.0.100, on dev eth0
ll header: 00:30:84:73:71:ee:00:90:d0:8e:a1:6f:08:00
I'm wondering what causes them, 10.0.0.100 is my own IP-address.
I'm using SuSE 9.2
 
Old 03-28-2005, 04:37 PM   #2
Capt_Caveman
Senior Member
 
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658

Rep: Reputation: 57
Breaking down the packet header in the log message, 00:30:84:73:71:ee:00:90:d0:8e:a1:6f:08:00:

destination MAC address: 00:30:84:73:71:ee
source MAC address: 00:90:d0:8e:a1:6f
ethertype: 08:00 (IP)

If you're on a network with other systems, see if you can find the machine that has a NIC with the MAC addres (00:90:d0:8e:a1:6f). Unfortunately, it looks like it belongs to a cable or DSL router, because Thomson/Alcatel is the manufacturer (see here for info on how I know that). Which if that's the case, then the packet likely originated from outside your network, probably from a neighbor on your cable or DSL network segment with a misconfigured/infected/borken system.

Last edited by Capt_Caveman; 03-28-2005 at 04:39 PM.
 
Old 03-29-2005, 06:20 AM   #3
yapp
Member
 
Registered: Apr 2003
Location: Netherlands
Distribution: SuSE (before: Gentoo, Slackware)
Posts: 613

Original Poster
Rep: Reputation: 30
Quote:
Originally posted by Capt_Caveman
Unfortunately, it looks like it belongs to a cable or DSL router, because Thomson/Alcatel is the manufacturer (see here for info on how I know that). Which if that's the case, then the packet likely originated from outside your network, probably from a neighbor on your cable or DSL network segment with a misconfigured/infected/borken system.
Yes, I have an alcatel router at home, and it's connected to a DSL network.
But I thought DSL doesn't provide a broadcast network; how can that packet arrive otherwise?
Is there any way can I can stop this, or detect where it came from? (I guess not, the source matches my router, and destination is my own nic)

Thanks for the packet header info BTW, I never fully understood what those extra didgets did.

Last edited by yapp; 03-29-2005 at 06:22 AM.
 
Old 03-29-2005, 11:16 AM   #4
Capt_Caveman
Senior Member
 
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658

Rep: Reputation: 57
If the packet passed through the router (originated on the internet, arrived at your router, and was forwarded through the router), then the all the physical layer info (like MAC address) would be stripped off and replaced with the info of the router itself before it was sent to your linux box. In that way it would be indistinguishable from a packet sent by the router itself, to differentiate between the two you would need to capture some of the packets and look at the ttl value. That's why you can't use MAC filtering on the internet effectively, because the MAC address will always be that of your upstream router and not the original source MAC. Some SOHO routers will assign a private IP address to the NIC on the LAN side of the router, so obviously verify that the LAN NIC doesn't have the 10.0.0.100 address as well.

In principle you should never see packets from your neighbors or from the upstream routers belonging to your ISP, in fact anything with an IANA reserved private-use IP shouldn't be forwarded at all. In practice though, people do occasionally see traffic from misconfigured routers. Also some ISPs will send probe packets to your IP address for monitoring purposes (to see if you're still there). It might be more informative if you could capture some of the packets using tcpdump or ethereal. It's also a good idea to examine your router and see if it has any functions that block unsolicited packets (like "Block WAN requests"). If so, enable it.
 
Old 03-30-2005, 06:36 PM   #5
Krugger
Member
 
Registered: Oct 2004
Posts: 229

Rep: Reputation: 30
That packet makes some windows go beserk. As the destination and origin are the same windows would start speaking to himself and generally slow down.

That was an old nuke that affects some recent versions of windows, when used in mass to syn flood.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are Off
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
martian source messages win32sux Linux - Security 2 08-26-2004 05:33 PM
martian source saavik Linux - Networking 0 07-02-2003 02:47 AM
martian source baffling me? Pcghost Linux - Networking 3 04-01-2003 08:43 PM
what does martian source mean? saavik Linux - Security 4 06-04-2002 08:34 AM
Martian source! Why now? Jon- Linux - Networking 1 03-05-2002 06:14 PM


All times are GMT -5. The time now is 04:26 PM.

Main Menu
 
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: @linuxquestions
Open Source Consulting | Domain Registration