David Ishmael wrote:
>
> I've got ipchains running on one of the local Linux servers and have all
> denied packets being logged. The logs look like:
>
> kernel: ll header: ff ff ff ff ff ff 00 a0 c9 06 37 1c 08 00
>
> I know I've seen this before but can't remember what the workaround for it
> was.
A machine which has the mac address, 00:a0:c9:06:37:1c, is sending out
broadcasts, ff ff ff ff ff ff, across your network. Just try and track
down the machine with the mac #. If you use the iproute2 package you
will receive an extra line with the sender's and recipient's ip in hex
format with the interface, eth0, eth1, etc. that's getting hit. Commonly
known as "martian sources". A common problem related to this is the
misconfiguration of ethernet cards with multiple interfaces, if you use
a cable modem and receive these types of messages from misconfigured
machines on the ISP's network from other users, and so forth.
--
Patrick Benson
Stockholm, Sweden
-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]
