Arch Linux

Gullible Jones

Member

Registered: 2004-12-29

Posts: 4,863

My switch (ex-router) is spamming martian packets

Experimenting with a new firewall configuration, I noticed lots of these inundating my logs:

[150617.623158] IPv4: martian source 192.168.0.255 from 192.168.0.148, on dev eth1
[150617.623170] ll header: 00000000: ff ff ff ff ff ff 00 13 46 43 81 c6 08 00        ........FC....

Googling indicated that the IPs can't be trusted, but the MAC addresses should be valid. The relevant address in this case is 00 13 46 43 81 c6.

The MAC address turns out to be that of an ancient Dynex wired router, which I am using as a switch with the DHCP server turned off. (My actual router is an old PC running IPFire.) But if it's spamming martians like that, I'd hazard that it's still not configured properly for its new role.

What might be causing it to spam, and how can I put a stop to it?

debijan

Member

Registered: 2010-09-14

Posts: 37

Re: My switch (ex-router) is spamming martian packets

Hi Jones,

just provide an IP address to the ex-router which is allowed on the interface eth1 of your ip cop.
At the moment you've for example a 10.0.0.0/8 network expected on eth1 by ipcop, but the old router call in with 192.168.0.148 which isn't expected by ipcop there.
provide a 10.0.0.0/8 IP to the ex-router an you're fine.

Gullible Jones

Member

Registered: 2004-12-29

Posts: 4,863

Re: My switch (ex-router) is spamming martian packets

Thanks for the advice; however, I don't think that's the case. All the IPs on my network are 192.168.0.0/8. And 192.168.0.148 was actually the machine I logged the martians on (thus the bit about the IPs not being trustworthy)...

hunterthomson

Member

Registered: 2008-06-22

Posts: 794

Website

Re: My switch (ex-router) is spamming martian packets

All the IPs on my network are 192.168.0.0/8.

Is that a typo? Did you mean to type /24 ?

Private IPv4 subnets are...

Class-A 10.0.0.0/8
Class-B 172.16.0.0/16 -through- 172.32.255.255/16
Class-C 192.168.0.0/24

---
192.0.0.0 -through- 192.167.255.255
-and-
192.169.0.0 -through 192.255.255.255

Are all Public IPv4 addresses.

Last edited by hunterthomson (2013-03-09 12:56:55)

---

OpenBSD-current Thinkpad X230, i7-3520M, 16GB CL9 Kingston, Samsung 830 256GB
Contributor: linux-grsec

Gullible Jones

Member

Registered: 2004-12-29

Posts: 4,863

Re: My switch (ex-router) is spamming martian packets

Not a typo, just me having weak network-foo.