On 05/16/2012 10:07 AM, Jeremy Schaeffer wrote:
> Shorewall 4.5.1.1
>
> I have 5 interfaces on a centos box, the first two are internal on two
> different subnets, the next two are two different ISP's and the last one
> is a private network for testing and administration. The second internal
> subnet (eth1) is rejecting all the arp requests to it and I get the
> following in the log files ever second or two -
>
> May 16 05:28:54 services kernel: martian source 172.28.130.6 from
> 172.28.130.1, on dev eth1
> May 16 05:28:54 services kernel: ll header:
> ff:ff:ff:ff:ff:ff:00:a0:c8:83:d3:c8:08:06
>
> 172.28.130.1 is the router and 172.28.130.6 is eth1. Because of this the
> router is having issues getting traffic to it.
>
> Here is the rest of the ip information:
> 3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast
> state UP qlen 1000
> link/ether 00:1b:21:31:6b:00 brd ff:ff:ff:ff:ff:ff
> inet 172.28.130.6/24 brd 255.255.255.255 scope global eth1
---------------
> 4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast
> state UP qlen 1000
> link/ether 00:1b:21:31:6b:01 brd ff:ff:ff:ff:ff:ff
> inet 69.128.165.227/29 brd 255.255.255.255 scope global eth2
> inet 172.28.130.1/32 scope global eth2
---------------
eth1 and eth2 are on the same subnet (172.28.130.1 is defined as an
address on eth2). So packets from that IP address arriving on eth1 are
definitely Martians.
-Tom
--
Tom Eastep \ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \________________________________________________
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and
threat landscape has changed and how IT managers can respond. Discussions
will include endpoint security, mobile security and the latest in malware
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
