Martian source in log files.

girishb — Fri, 29 Sep 2006 11:00:23 GMT

Hi,

In RHEL 3.0 Server Log files, I'm getting the following messages:

Sep 29 11:09:05 www9 sshd(pam_unix)[11310]: session opened for user root by (uid=0)
Sep 29 11:09:18 www9 kernel: martian source 192.168.10.655 from 192.168.11.2, on dev eth1
Sep 29 11:09:18 www9 kernel: ll header: ff:ff:ff:ff:ff:ff:00:11:22:fe:11:dc:00:90
Sep 29 11:09:19 www9 kernel: martian source 192.168.11.3 from 192.168.11.4, on dev eth1
Sep 29 11:09:19 www9 kernel: ll header: ff:ff:ff:ff:ff:ff:00:11:32:b1:f7:4c:08:09

What is causing this? How do I resolve!!

Please help. Its URGENT.

Thanks
Girish

Re: Martian source in log files.

Ivan Krastev — Fri, 29 Sep 2006 11:37:48 GMT

From a FAQ:

What does "kernel: martian source aabbccdd for 11223344, dev eth0" mean?

--
These are packets that Linux does not expect from the direction they came
from (i.e. packets from internal hosts coming in on the external interface).
The cause is probably a misconfigured machine on your LAN.
You can turn off logging those packets via
/proc/sys/net/ipv4/conf/*interface*/log_martians
which is documented in /usr/src/linux/Documentation/proc.txt

regards,
ivan

topic Re: Martian source in log files. in Operating System - Linux

Martian source in log files.

Re: Martian source in log files.