Re: kernel: martian source

Hope this helps
From:
http://www.absoluteastronomy.com/encyclopedia/M/Ma/Martian_packet.htm

" In a computer network, packets with source addresses not routable
by some computer on a network segment are referred to as
martians or "packets from Mars", on the grounds that they are of no
evident "terrestrial" (i.e. normal) source. Martian packets can arise
from network equipment malfunction, misconfiguration of a host, or
simple coexistence of two logical networks on a single physical
layer. For instance, if the IP networks 192.168.34.0/24 and
10.2.3.0/24 operate on the same Ethernet segment, packets from
10.2.3.4 are Martians to the computer at 192.168.34.9, and vice
versa."

--
Mihai Amarandei-Stavila - Xmco Partners
Consultant Sécurité / Test d'intrusion

tel  : 33 1 47 34 68 61
web  : http://www.xmcopartners.com
Villa Gabrielle 75015 PARIS
Pers. Blog  : http://secinternship.blogspot.com




Ben wrote:

> Hi
>
> I have messages like the following line in my log file, what can I do about it?
>
> kernel: martian source [server IP] from 68.50.206.106, on dev eth0
>
> This happens after the IP 68.50.206.106 has been dropped by PortSentry.
>
> I have Swatch, PortSentry, Snort and GIPTables running on my CentOS 4.0 server.
>
> I contacted my ISP and they told me that I should be worried. I
> googled these keywords but did not find any information that I could
> use to fix this.
>
> Should I be worried?
>
> Thanks,
> Ben
>
>