On Tue, 2011-09-06 at 17:41 +0200, Florian wrote: > Hi, > > When I turn log_martians on in my shorewall configuration I get > occasionally messages in my log file stating that some martian source > packages occurred. > > > >> martian source A.B.C.D from 0.0.0.0, on dev eth0 > >> ll header: ff:ff:ff:ff:ff:ff:00:10:83:35:8a:XX:08:00 > > where A.B.C.D is the IP address of the responsible DHCP server, which > is however not located within the same subnet (centrally managed DHCP > server, where every group has their So packets with 0 as the SOURCE IP > address will be considered to be martians when the default route is not out > of that interface. own subnet). > ... > > This package obviously uses the 0.0.0.0 source address to send an DHCP > Request package to the DHCP server. In my understanding of the RFCs > it's totally fine to use the 0.0.0.0 address as a source address. In > particular as this machine just started up, and has know knowledge > about any assigned ip address and thus HAS TO use the 0.0.0.0 source > address.
That's the way it works. > > Where is the misconception in my understanding? Your understanding is correct. > Why does the kernel / shorewall configuration complain about this package? Shorewall can turns RP filtering and logging on or off; beyond that, Shorewall has no control over how it works. When rp_filter is enabled on an interface, an incoming packet is considered to be a martian if the SOURCE IP address in the packet is not routed out of that interface. The IP stack reverses the SOURCE and DESTINATION IP addresses and looks up the appropriate route; if the route is out of a different interface, the packet is a martian. -Tom -- Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________
signature.asc
Description: This is a digitally signed message part
------------------------------------------------------------------------------ Special Offer -- Download ArcSight Logger for FREE! Finally, a world-class log management solution at an even better price-free! And you'll get a free "Love Thy Logs" t-shirt when you download Logger. Secure your free ArcSight Logger TODAY! http://p.sf.net/sfu/arcsisghtdev2dev
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
