Martian source message in /var/log/warn

Robhogg · 03-30-2006, 06:46 AM

I found a number of messages in SuSE 10's /var/log/warn similar to:

Code:

Mar 16 04:25:16 linux kernel: martian source <my ip addr> from 225.230.230.234, on dev eth0
Mar 16 04:25:16 linux kernel: ll header: 00:50:fc:fa:8c:1b:00:11:bc:a8:94:54:08:00

The dates and times vary, but the "from" IP is always the same. I can't, however, find this address listed in the firewall log.

This IP address appears in a post on another forum, associated with an AD-Aware warning of a possible browser hijack.

Rob.

Capt_Caveman · 03-30-2006, 07:38 AM

That address belongs to part of the IANA 224.0.0.0/4 multicast block. So it's likely a local system, either on your network or on a nearby system if you are using some type of shared subscriber connection (like broadband cable). Since it's a multicast address, looking it up by IP won't work. Use the MAC addresses provided by the kernel log message instead.