That was a great answer, thank you very much, I am going to start checking what you suggested.
Roberto... --- Pierre Fortin <[EMAIL PROTECTED]> wrote: > On Mon, 8 Apr 2002 19:54:11 -0700 (PDT) Roberto > Armenteros > <[EMAIL PROTECTED]> wrote: > > > Since i upgraded to Mandrake 8.2 I am getting the > > following log message from the kernel. > > > > Apr 8 22:30:36 rarmente kernel: ll header: > > ff:ff:ff:ff:ff:ff:00:50:da:da:c7:57:08:00 > > > > Apr 8 22:32:36 rarmente kernel: martian source > > 255.255.255.255 from 127.0.0.1, on dev eth0 > > > > I use swatch to monitor my log files and it is > > constantly showing this messages. I would > appreciate > > if somebody gives me a hand to understand this > > message. > > > > Roberto > > Assuming both messages refer to the same packet, > you've got a machine > sending a wire broadcast (ff:ff:ff:ff:ff:ff) to the > local broadcast > (255.255.255.255) and claiming to be the loopback IP > (127.0.0.1) -- the > problem is that packets to/from the loopback must > never appear on a LAN. > The sender has an ethernet card with the MAC address > 00:50:da:da:c7:57... > > I don't see a vendor code (00:50:da) for this card > at > http://www.cavebear.com/CaveBear/Ethernet/vendor.html > so I can't tell you > who the vendor is. > > Hope the neighbouring machines on your eth0 is not > too big... if eth0 is > connected to a DSL, you'll have to work with your > local ISP to try to > locate it. > > If you want to try to find it yourself, you can ping > all the addresses in > your subnet (individually or with "ping -b > 255.255.255.255" -- add "-I > eth0" if you have other net adapters) and check the > ARP cache with "arp -a > | grep -i 00:50:da". If you get a hit, you will at > least know the real IP > | address of the offender. Caution, it *could* be > you... > > HTH, > Pierre > > > Want to buy your Pack or Services from MandrakeSoft? > > Go to http://www.mandrakestore.com > __________________________________________________ Do You Yahoo!? Yahoo! Tax Center - online filing with TurboTax http://taxes.yahoo.com/
Want to buy your Pack or Services from MandrakeSoft? Go to http://www.mandrakestore.com
