Martian source in log files.

[girishb]

Hi,

In RHEL 3.0 Server Log files, I'm getting the following messages:

Sep 29 11:09:05 www9 sshd(pam_unix)[11310]: session opened for user root by (uid=0)
Sep 29 11:09:18 www9 kernel: martian source 192.168.10.655 from 192.168.11.2, on dev eth1
Sep 29 11:09:18 www9 kernel: ll header: ff:ff:ff:ff:ff:ff:00:11:22:fe:11:dc:00:90
Sep 29 11:09:19 www9 kernel: martian source 192.168.11.3 from 192.168.11.4, on dev eth1
Sep 29 11:09:19 www9 kernel: ll header: ff:ff:ff:ff:ff:ff:00:11:32:b1:f7:4c:08:09

What is causing this? How do I resolve!!

Please help. Its URGENT.

Thanks
Girish

[Ivan Krastev]

From a FAQ:


What does "kernel: martian source aabbccdd for 11223344, dev eth0" mean?

--
These are packets that Linux does not expect from the direction they came
from (i.e. packets from internal hosts coming in on the external interface).
The cause is probably a misconfigured machine on your LAN.
You can turn off logging those packets via
/proc/sys/net/ipv4/conf/*interface*/log_martians
which is documented in /usr/src/linux/Documentation/proc.txt


regards,
ivan