How to determine the reason "IPv4: martian source"?

K

kxx2014-09-27 17:35:59

linux

kxx, 2014-09-27 17:35:59

The network has a one-armed router: vlan100 (192.168.1.1) - looks into the local network; vlan200 (without address) - to the provider, and ppp0 (46.98.ab.cd) is raised on top of it; wlan0 (192.168.2.1) - to the second local network. dnsmasq, minidlna, transmission-daemon are bound to vlan100 and wlan0. There is a routing between 192.168.1.0 and 192.168.2.0. Everything works fine, but the following entries sometimes appear in kern.log:

Sep 21 11:52:37 localhost kernel: [141502.530681] IPv4: martian source 46.98.ab.cd from 192.168.1.1, on dev ppp0
Sep 21 11:52:37 localhost kernel: [141502.545566] ll header: 00000000: 45 00 00 34 b6 bf 40 00 38 06 6e dc c0 a8 01 01  [email protected]
Sep 21 11:52:37 localhost kernel: [141502.561992] ll header: 00000010: 2e 62 2d 1d ff fe bf 5a 09 f9 
.........
Sep 26 18:18:42 localhost kernel: [76902.890942] IPv4: martian source 46.98.ab.cd from 192.168.1.2, on dev ppp0
Sep 26 18:18:42 localhost kernel: [76902.905910] ll header: 00000000: 45 00 00 3c 0e 52 40 00 76 06 65 48 c0 a8 01 02  E..<[email protected]
Sep 26 18:18:42 localhost kernel: [76902.922279] ll header: 00000010: 2e 62 a1 15 37 a4 d1 15 c0 fe  
.......
Sep 26 21:17:20 localhost kernel: [87621.435341] IPv4: martian source 46.98.ab.cd from 192.168.1.106, on dev ppp0
Sep 26 21:17:20 localhost kernel: [87621.450404] ll header: 00000000: 45 00 00 81 69 c6 00 00 70 11 4f 1c c0 a8 01 6a  E...i...p.O....j
Sep 26 21:17:20 localhost kernel: [87621.466744] ll header: 00000010: 2e 62 a1 15 29 76 ea 60 00 6d 
......
Sep 26 23:40:20 localhost kernel: [96200.808965] IPv4: martian source 1.0.0.1 from 1.0.211.210, on dev vlan200
Sep 26 23:40:20 localhost kernel: [96200.823679] ll header: 00000000: ff ff ff ff ff ff 20 cf 30 f5 6a 39 08 06 00 01  ...... .0.j9....
Sep 26 23:40:20 localhost kernel: [96200.839326] ll header: 00000010: 08 00
........
Sep 27 01:31:29 localhost kernel: [102869.750797] IPv4: martian source 46.98.ab.cd from 192.168.1.3, on dev ppp0
Sep 27 01:31:29 localhost kernel: [102869.765808] ll header: 00000000: 45 00 00 81 17 19 00 00 70 11 a2 30 c0 a8 01 03  E.......p..0....
Sep 27 01:31:29 localhost kernel: [102869.782230] ll header: 00000010: 2e 62 a1 15 4a a3 ea 60 00 6d                    .b..J..`.m

46.98.ab.cd, 192.168.1.1, 192.168.2.1 - addresses of this server; 192.168.1.2, 192.168.1.3 - workstation and media player. All other addresses are absolutely left, mac-addresses are also not mine. iptables blocks all bogons. Debian on the server is freshly installed and regularly updated. In general, how to find out the reason for the Martian addresses and what to do?

Reply

Answer the question

In order to leave comments, you need to log in

2 answer(s)

C

Cool Admin, 2014-09-27
@ifaustrue

Check again the IPTables rules for masquerading, if everything is fine, then the packets are flying exactly from the side of the dip, I think you can score.

K

kxx, 2014-09-30
@kxx

Could these packets be caused by the presence of interfaces (eth0 and vlan200 based on it) without assigned addresses?