On Mon, Jul 24, 2006 at 03:43:12PM +0100, martin f krafft wrote:
> also sprach Jamie L. Penman-Smithson <[EMAIL PROTECTED]> [2006.07.24.1535
> +0100]:
> > > Security Events
> > > =-=-=-=-=-=-=-Jul 22 22:48:40 wall kernel: martian source 84.72.30.149
> > > from 127.0.0.1, on dev wan
> > >
> > > ----- End forwarded message -----
> >
> > I vote no.. If you want to ignore these messages, use local rules instead.
>
> Okay. Could you explain to me what these messages are? Maybe I am
> just not getting it. It seems that martians are attempts of
> spoofing, but the above message only leads me to conclude there's
> some weird routing issue going on. It's a crap log message for one,
> given that "source" and "from" mean the same thing, really.
This message would occour in the following circumstances:
(fib_frontend.c:fib_validate_source(...))
/* Given (packet source, input interface) and optional (dst, oif, tos):
- (main) check, that source is valid i.e. not broadcast or our local
address.
- figure out what "logical" interface this packet arrived
and calculate "specific destination" address.
- check, that packet arrived from expected physical interface.
*/
I dunno. We dont want to get a message every time someone trys to send from
127.0.0.1, but
it seems pretty anomalous.
--
Todd Troxell
http://rapidpacket.com/~xtat
_______________________________________________
Logcheck-devel mailing list
[email protected]
http://lists.alioth.debian.org/mailman/listinfo/logcheck-devel
