Re: Troche NTG, "martian source" w logach

["Road" <slacklist@interia.pl>]

U¿ytkownik "Puchacz" <puchacz101@poczta.onet.pl> napisa³ w wiadomo¶ci
c136jd$9b4$1@cyberbajt.pl">news:c136jd$9b4$1@cyberbajt.pl...
> Witam,
> Od czasu, gdy uruchomilismy bridge'a na DWLach 2000AP+ w syslogu mam
> taki oto smietnik, powtarzajacy sie doslownie co kilka sekund, wszystko
> dziala ok, tylko nie lubie smietnika w logach :)
>
> Objaw wyglada tak:
> Feb 19 21:08:27 gateway kernel: NET: 235 messages suppressed.
> Feb 19 21:08:27 gateway kernel: martian source 192.168.97.232
> from 127.0.0.1, on dev eth0     ^^^^^^^^^^^^^^
> Feb 19 21:08:27 gateway kernel: ll header:
> 00:01:02:b1:7c:d7:00:40:05:xx:xx:xx:0
>
> Pogooglowalem troche, ale zadnych sensownych informacji na ten temat nie
> znalazlem. Poczatek naglowka nie mam pojecia co oznacza, natomiast
> koncowka to mac bridge'a (apkow po obu stronach), IP z source sa
> zupelnie rozne, losowe i nie maja nic wspolnego z siecia.
>
> Jesli, ktos spotkal sie z czyms podobnym, lub chociaz wie co to znaczy,
> please help me, bo wymiekam przy tym.
>
> Z gory dzieki za pomoc,
>
> --
> [Rzeczywisto¶æ to fikcja...]
> Pawe³ "Puchacz" Purchalak
> puchacz101@poczta.onet.pl
> http://www.moded-kompz.net
>


Witam

     Comment from jlevie
            Date: 02/16/2004 06:03AM PST
           Comment


            A "martian packet" itself should not cause your server to crash,
but it may be a symptom of the cause. The term "martian" is used to describe
a packet with source or destination IP's for which there is no possible
route to send the packet to. These can be the result of a node with an
errant TCP/IP stack sending packets to the server with a bogus source IP, or
it could be something within the server generating packets with a bogus
destination IP.

            I believe the first line of the syslog data should read:

            Feb 15 03:38:54 mail1 kernel: martian source <server_ip_address>
for 127.0.0.1, on dev eth0

            Which would say that a packet was received with a real source IP
and an destination of 127.0.0.1. This is a logical impossibility and
probably indicates a network configuration error on the server.


how would I find out whats causing this problem?

First I'd suggest making sure that the machine's network configuration is
sane. Since this is a server it needs a fixed IP and should then be
configured similar to:

/etc/hosts
127.0.0.1    localhost.localdomain localhost
123.4.5.6    my-server.my-dom.tld my-server

'hostname' needs to return my-server.my-dom.tld
It is also possible that this could be caused by a misconfigured DNS. Checks
for that include:

'host 127.0.0.1' => localhost
'host localhost' => 127.0.0.1
'host my-server.my-dom.tld' => 123.4.5.6
'host 123.4.5.6' => my-server.my-dom.tld