On Mon, Nov 03, 2003 at 11:15:24 +0100, Ben Buxton wrote:
> John Clarke <[EMAIL PROTECTED]> uttered the following thing:
> > dropbear kernel: martian source 150.101.124.189 from 127.0.0.1, on dev eth1
> > dropbear kernel: ll header: 00:00:e2:14:a6:b6:00:90:1a:40:6c:d9:08:00
> What are the MAC addresses of your DSL modem and your linux
> box?
linux box:
[EMAIL PROTECTED] ~]$ /sbin/ifconfig eth1|grep HWaddr
eth1 Link encap:Ethernet HWaddr 00:00:E2:14:A6:B6
dsl modem:
[EMAIL PROTECTED] ~]$ /sbin/arp -n -i eth1
Address HWtype HWaddress Flags Mask Iface
150.101.124.190 ether 00:90:1A:40:6C:D9 C eth1
both of these addresses appear in the 'll header' message in the log.
a bit of digging (which i should have done first but i was too tired to
think straight - too many nights of four hours or less sleep) tells me
that the 'll header' is the ethernet frame header, which is:
struct ethhdr
{
unsigned char h_dest[ETH_ALEN]; /* destination eth addr */
unsigned char h_source[ETH_ALEN]; /* source ether addr */
unsigned short h_proto; /* packet type ID field */
} __attribute__((packed));
what confused me is the first message says 'martian source
150.101.124.189', so i was thinking it was linux that was to blame, but
that's actually the destination address.
> It seems that whichever has the MAC address given in the kernel
> message is sending a packet with a 127.0.0.1 source address and
> that is a no-no.
i knew that, what i didn't know was where it came from. now i know
it's the dsl modem, so i suppose all i can do is ignore it.
thanks ben.
cheers,
john
--
whois [EMAIL PROTECTED]
GPG key id: 0xD59C360F
http://kirriwa.net/john/
--
SLUG - Sydney Linux User's Group - http://slug.org.au/
More Info: http://lists.slug.org.au/listinfo/slug
