Linux - SecurityThis forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
Breaking down the packet header in the log message, 00:30:84:73:71:ee:00:90:d0:8e:a1:6f:08:00:
destination MAC address: 00:30:84:73:71:ee
source MAC address: 00:90:d0:8e:a1:6f
ethertype: 08:00 (IP)
If you're on a network with other systems, see if you can find the machine that has a NIC with the MAC addres (00:90:d0:8e:a1:6f). Unfortunately, it looks like it belongs to a cable or DSL router, because Thomson/Alcatel is the manufacturer (see here for info on how I know that). Which if that's the case, then the packet likely originated from outside your network, probably from a neighbor on your cable or DSL network segment with a misconfigured/infected/borken system.
Last edited by Capt_Caveman; 03-28-2005 at 04:39 PM.
Originally posted by Capt_Caveman Unfortunately, it looks like it belongs to a cable or DSL router, because Thomson/Alcatel is the manufacturer (see here for info on how I know that). Which if that's the case, then the packet likely originated from outside your network, probably from a neighbor on your cable or DSL network segment with a misconfigured/infected/borken system.
Yes, I have an alcatel router at home, and it's connected to a DSL network.
But I thought DSL doesn't provide a broadcast network; how can that packet arrive otherwise?
Is there any way can I can stop this, or detect where it came from? (I guess not, the source matches my router, and destination is my own nic)
Thanks for the packet header info BTW, I never fully understood what those extra didgets did.
If the packet passed through the router (originated on the internet, arrived at your router, and was forwarded through the router), then the all the physical layer info (like MAC address) would be stripped off and replaced with the info of the router itself before it was sent to your linux box. In that way it would be indistinguishable from a packet sent by the router itself, to differentiate between the two you would need to capture some of the packets and look at the ttl value. That's why you can't use MAC filtering on the internet effectively, because the MAC address will always be that of your upstream router and not the original source MAC. Some SOHO routers will assign a private IP address to the NIC on the LAN side of the router, so obviously verify that the LAN NIC doesn't have the 10.0.0.100 address as well.
In principle you should never see packets from your neighbors or from the upstream routers belonging to your ISP, in fact anything with an IANA reserved private-use IP shouldn't be forwarded at all. In practice though, people do occasionally see traffic from misconfigured routers. Also some ISPs will send probe packets to your IP address for monitoring purposes (to see if you're still there). It might be more informative if you could capture some of the packets using tcpdump or ethereal. It's also a good idea to examine your router and see if it has any functions that block unsolicited packets (like "Block WAN requests"). If so, enable it.
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.