Re: kernel: martian source

Ben (newreaders@gmail.com) wrote:
> Hi
>
> I have messages like the following line in my log file, what can I do about 
> it?
>
> kernel: martian source [server IP] from 68.50.206.106, on dev eth0
>
> This happens after the IP 68.50.206.106 has been dropped by PortSentry.
>
> I have Swatch, PortSentry, Snort and GIPTables running on my CentOS 4.0 
> server.
>
> I contacted my ISP and they told me that I should be worried. I
> googled these keywords but did not find any information that I could
> use to fix this.
>
> Should I be worried?

Hi,

I will answered you quickly and with I know about this.
Martians packets are due to two things:
 - Some machines infected by one virus
 - DNS answered IP target to SYN attacks : 127.0.0.1

It was decided buy ISP when too many attacks[1] are intented to one
machine to answered to IP target by "127.0.0.1".

And, infected machines by virus spoof near network IP. So in your
network or IP Block, one or few machines are infected.

So: One infected machine spoof your IP adress. And to attack is target
ask to DNS IP address of this target. DNS server has seen this joke, and
to preserve target, answered: "127.0.0.1".
This virus is dumb, and create a packet with your address as from IP and
127.0.0.1 as To IP address. The packet is send and the machine take it
the packet in his head. And here, if one connection is strange, RST
packet must be send to sender: "you".

You receive one RST packet from 127.0.0.1.

Hope this can help you,

        ~Christophe

[1] : TCP handshake not terminated.