Herouth Maoz <[EMAIL PROTECTED]> writes: > Oct 18 20:12:01 Motti kernel: martian source 172.27.107.135 from 172.27.96.1, on > dev eth1 > Oct 18 20:12:01 Motti kernel: ll header: > ff:ff:ff:ff:ff:ff:00:0f:34:7b:c8:a0:08:06
Basically, "martians" are "packets with source addresses with no known route" (from Documentation/filesystems/proc.txt, Documentation/networking/ip-sysctl.txt in your resident kernel tree - this is in case you want to toggle logging). You can glean some information from the log: ff:ff:ff:ff:ff:ff is 255.255.255.255 - the broadcast address 00:0f:34:7b:c8:a0 is the MAC of the offending host 08:06 is the protocol - ARP, if memory serves. So you are getting ARPs to a broadcast address (that's OK) from an IP address that your Linux does not expect to send packets to eth1 (that's not OK). It can be a misconfiguration, e.g. an assignment of an external address to a LAN interface, or a mask issue, or it can be a result of address spoofing (someone is trying to do something nasty!). Is the MAC above on your LAN? > And here is the output of route: > > Destination Gateway Genmask Flags Metric Ref Use Iface > rtr7.c.actcom.n 172.22.96.1 255.255.255.255 UGH 0 0 0 eth1 > rtr7.c.actcom.n * 255.255.255.255 UH 0 0 0 ppp0 > 192.168.1.0 * 255.255.255.0 U 0 0 0 eth0 > 172.22.96.0 * 255.255.224.0 U 0 0 0 eth1 > 127.0.0.0 * 255.0.0.0 U 0 0 0 lo > default rtr7.c.actcom.n 0.0.0.0 UG 0 0 0 ppp0 > > If there is any additional data I can supply, please tell me. The table look OK to me, but I am not the sharpest or the most experienced here. It looks like 172.22.96.0/255.255.224.0 is your cable provider's network to which eth1 connects. That network connects you to actcom's gateway via ppp, and actcom routes you to the world. What is the default gateway for the other hosts on the LAN? What addresses are they assigned? -- Oleg Goldshmidt | [EMAIL PROTECTED] ================================================================= To unsubscribe, send mail to [EMAIL PROTECTED] with the word "unsubscribe" in the message body, e.g., run the command echo unsubscribe | mail [EMAIL PROTECTED]
