LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)
-   -   martian source on boot up (https://www.linuxquestions.org/questions/linux-security-4/martian-source-on-boot-up-583932/)

mikieboy 09-11-2007 12:50 PM

martian source on boot up
 
I just noticed a martian source message on boot up:
Quote:

eth0: Media Link Off
eth0: Media Link On 100mbps full-duplex
martian source 255.255.255.255 from 192.168.1.1, on dev eth0
ll header: ff:ff:ff:ff:ff:ff:00:12:17:c6:fc:98:08:00
martian source 255.255.255.255 from 192.168.1.1, on dev eth0
ll header: ff:ff:ff:ff:ff:ff:00:12:17:c6:fc:98:08:00
martian source 255.255.255.255 from 192.168.1.1, on dev eth0
ll header: ff:ff:ff:ff:ff:ff:00:12:17:c6:fc:98:08:00
martian source 255.255.255.255 from 192.168.1.1, on dev eth0
ll header: ff:ff:ff:ff:ff:ff:00:12:17:c6:fc:98:08:00
NET: Registered protocol family 10
lo: Disabled Privacy Extensions
eth0: no IPv6 routers present
This is a new one to me. I'm on a home desktop system running through a wireless router.
Is my system under attack?

blackhole54 09-11-2007 07:53 PM

My understanding of "martian" packets were they were packets coming into an interface that is different than the interface the computer would use to send packets to that source address. For example if a packets comes in on eth0 with and source address of 192.168.5.123, but the routing table routes 192.168.5.0/24 out eth1.

The address specified, 255.255.255.255 is the general broadcast address. I am not sure why this is considered martian.

EDIT: I still don't know why these broadcast packets would be considered martian, but they could be coming from another computer on your network that is doing a DHCP request or from a MS Windows computer that just likes to broadcast some NETBIOS stuff.

nx5000 09-12-2007 06:07 AM

Rfc 1812,
Quote:

5.3.7 Martian Address Filtering

An IP source address is invalid if it is a special IP address, as
defined in 4.2.2.11 or 5.3.7, or is not a unicast address.
Only unicast adresses are allowed for source address. 255.255.255.255 is not a unicast address then it's considered invalid. Linux follows the standard.

Probably it's your wireless router that does strange things. What router is this?
Do you only have 1 ethernet adapter?

You can switch off these warnings with one of these:
net.ipv4.conf.all.log_martians = 0
net.ipv4.conf.default.log_martians = 0
net.ipv4.conf.lo.log_martians = 0
net.ipv4.conf.eth0.log_martians = 0
net.ipv4.conf.eth1.log_martians = 0
net.ipv4.conf.eth2.log_martians = 0
net.ipv4.conf.irda0.log_martians = 0

See your kernel documentation

zaubermaus 09-12-2007 10:28 AM

Use sysctl
 
You should probably use sysctl -w to set those log_martians values to make changes permanent.


All times are GMT -5. The time now is 03:29 AM.