Linux

Ask something
Discussion Locked

Where is martian from?

0 helpful
5 replies

by deyev

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Pls assist me to define martian source.
Here is log message:

martian source 255.255.255.255 from 1.2.3.4, on dev eth1

Here is my network design.
========================================
I have W2K with IP adresses:
eth0 Ext IP - 1.2.3.4/24
eth1 Int IP - 5.6.7.8/24

I have Linux box with IP address:
eth0 Ext IP - 1.2.3.5/24
eth1 Int IP - 5.6.7.9/24
=====================================
This is not permanent message in my log, however I want to understand what I done wrong. Maybe I need to disable some services on W2K?

Any suggestion welcome.

TIA

5 replies

by bfilmfan

martian errors are generated when anyone is trying to connect to you from the internet with private_range_of_ip_addresses !

The packets are impossible to route and are labelled as Martian.

by nico baggus

I wonder what your network looks like....,

First how are your systems connected..., I guess
that all four interfaces are plugged into one
HUB....

Trying to create two networks on one hub, this
will not exactly work, like the martian packet
shows.

The message tells you that you received on your
eth1 (ip address 5.6.7.9) a packet, broadcast
(255.255.255.255) by sender 1.2.3.4 that should
have been confined to the 1.2.3.0/24 network.

That's why I guess you only have one hub with
four wires that run to two systems pair wise.

To make this network behave as expected you need
at least 2 hubs. Or configure your switch with 2
vlans.

The NT system clearly sends some broadcast
packets, which is causing this is hard to tell
without seeing more info.
f.e. Broadcast implies a UDP message, or RIP but
not a session protocol like IPSEC or TCP.
You need to figure out the protocol used, and if
UDP the ports used. With the thus gained
knowledge the culprit can be identified.

To get this information you could try a command
like:

tcpdump -vvni eth1 host 255.255.255.255

or the like.
The packet data will tell you the port number
etc.
Some clues:

53 = DNS
67/68 = DHCP/BOOTP
137/138 Netbios NAME Query

A grep with the port value in the case to UDP
like

grep portno /etc/services

will give you a name for the port (in case of
udp/tcp)

A protocol number can be found/matched using
the /etc/protocols file.

Kind Regards,

This discussion is closed to new replies.