Re: Martian messages

2004-10-22 Thread Ilya Konstantinov
guy keren wrote: 1. Your peers on the cable network (e.g. if you decide to play Quake against your neighbour without connecting to the Internet), do people do that? There's no reason to doubt their intentions more than you doubt any Internet packet. 2. Your ISP's PPTP server. funny - i thoug

Re: Martian messages

2004-10-22 Thread guy keren
On Fri, 22 Oct 2004, Ilya Konstantinov wrote: > guy keren wrote: > > >>On the PPP interface, you cannot detect spoofed messages with this > >>method, since any IP coming from the Internet is legit. > > > >but, assuming that on the ppp0 you have a "true" IP address (i.e. not in > >one of the priva

Re: Martian messages

2004-10-22 Thread Ilya Konstantinov
guy keren wrote: On the PPP interface, you cannot detect spoofed messages with this method, since any IP coming from the Internet is legit. but, assuming that on the ppp0 you have a "true" IP address (i.e. not in one of the private IP ranges), then you simply would place an iptables rule denyi

Re: Martian messages

2004-10-22 Thread guy keren
On Fri, 22 Oct 2004, Ilya Konstantinov wrote: > Herouth Maoz wrote: > > > What you are saying is basically that I should just ignore these > > messages. This is annoying, though, because if someone attempts to > > spoof an address (which is what the martian messages

Re: Martian messages

2004-10-22 Thread Ilya Konstantinov
Herouth Maoz wrote: What you are saying is basically that I should just ignore these messages. This is annoying, though, because if someone attempts to spoof an address (which is what the martian messages are meant to reveal), I'll never be able to see the attempt through all the backg

Re: Martian messages

2004-10-21 Thread Herouth Maoz
ly that I should just ignore these messages. This is annoying, though, because if someone attempts to spoof an address (which is what the martian messages are meant to reveal), I'll never be able to see the attempt through all the background noise. Herouth ===

Re: Martian messages

2004-10-21 Thread Ilya Konstantinov
Oleg Goldshmidt wrote: Herouth Maoz <[EMAIL PROTECTED]> writes: Oct 18 20:12:01 Motti kernel: martian source 172.27.107.135 from 172.27.96.1, on dev eth1 Oct 18 20:12:01 Motti kernel: ll header: ff:ff:ff:ff:ff:ff:00:0f:34:7b:c8:a0:08:06 Basically, "martians" are "packets with source address

Re: Martian messages

2004-10-19 Thread Herouth Maoz
Quoting Oleg Goldshmidt <[EMAIL PROTECTED]>: > > ff:ff:ff:ff:ff:ff is 255.255.255.255 - the broadcast address > > 00:0f:34:7b:c8:a0 is the MAC of the offending host > > 08:06 is the protocol - ARP, if memory serves. > .. >Is the MAC above on your LAN? Not to my knowledge. There are only two machi

Re: Martian messages

2004-10-19 Thread Oleg Goldshmidt
Herouth Maoz <[EMAIL PROTECTED]> writes: > Oct 18 20:12:01 Motti kernel: martian source 172.27.107.135 from 172.27.96.1, on > dev eth1 > Oct 18 20:12:01 Motti kernel: ll header: > ff:ff:ff:ff:ff:ff:00:0f:34:7b:c8:a0:08:06 Basically, "martians" are "packets with source addresses with no known rou

Martian messages

2004-10-19 Thread Herouth Maoz
I asked this question on Whatsup and there was no help, I hope someone here can clue me in, given that I'm not exactly an expert network manager... I've switched from ADSL to cable yesterday, and although the network seems to work, I constantly get martian messages in the kernel