Thanks for the info fooler, you are correct. kern.warning.log.9:Jan 18 17:39:59 madugas kernel: UDP_IN IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:04:5a:e4:b5:3d:08:00 SRC=192.168.1.1 DST=255.255.255.255 LEN=576 TOS=0x00 PREC=0x00 TTL=64 ID=42 PROTO=UDP SPT=67 DPT=68 LEN=556
arp output: Address HWtype HWaddress Flags Mask Iface 192.168.1.1 ether 00:04:5A:E4:B5:3D C eth1 I dont know if its my linksys router or my linux box thats leaking this to the outside segment. (the 192.168.1.1 is linksys' internal interface). My linux box blocks all forwarding and has ip_forward set to "0" so I dont know if that can leak the 255.255.255.255 packet to outside. BTW the above kernel message was from the linux box (eth0=internet). I'll probably leave this alone.. but anyway thanks for that bit of info. jondz > > ----- Original Message ----- > From: "Hagibis Fan" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Thursday, March 20, 2003 11:28 PM > Subject: Re: [plug] martian source... > > > > If you have a dhcp server nearby, it could > > be related --maybe check the dst ports if they > > are 67 or 68. My linksys router ejects > > weird IPs like 255.255.255.255 for dhcp (i > > presume since ports are 67/68). > > that is not a weird ip address (255.255.255.255) :-> and take note > 255.255.255.0 (from previos post) is different from 255.255.255.255... > > 255.255.255.255 is otherwise known as *limited broadcast address* and not a > martian address > > dhcp client is using ip address 0.0.0.0 and udp port 68 for its source > address and ip address 255.255.255.255 and udp port 67 for its destination > address.. your linksys router wasnt configured as dhcp relay router > therefore drop this packet to avoid routing this packet outside from your > network segment... > > fooler. > > > _ > Philippine Linux Users Group. Web site and archives at http://plug.linux.org.ph > To leave: send "unsubscribe" in the body to [EMAIL PROTECTED] > > Fully Searchable Archives With Friendly Web Interface at http://marc.free.net.ph > > To subscribe to the Linux Newbies' List: send "subscribe" in the body to [EMAIL > PROTECTED] > _ Philippine Linux Users Group. Web site and archives at http://plug.linux.org.ph To leave: send "unsubscribe" in the body to [EMAIL PROTECTED] Fully Searchable Archives With Friendly Web Interface at http://marc.free.net.ph To subscribe to the Linux Newbies' List: send "subscribe" in the body to [EMAIL PROTECTED]
