linux-kernel - "martian source" mixes up source and destination

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <jnh9tl$rth$1@dough.gmane.org>
Date:	Sat, 28 Apr 2012 20:37:57 +0300
From:	"Mantas M." <grawity@...il.com>
To:	linux-kernel@...r.kernel.org
Subject: "martian source" mixes up source and destination

After enabling the /proc/sys/net/ipv4/conf/all/log_martians sysctl, I've
been receiving the following messages on dmesg:

> martian source 255.255.255.255 from 192.168.1.115, on dev wlan0
> ll header: ff:ff:ff:ff:ff:ff:f4:6d:04:85:fc:d7:08:00
> martian source 192.168.1.255 from 192.168.1.115, on dev wlan0
> ll header: ff:ff:ff:ff:ff:ff:f4:6d:04:85:fc:d7:08:00
> martian source 192.168.1.255 from 192.168.1.115, on dev wlan0
> ll header: ff:ff:ff:ff:ff:ff:f4:6d:04:85:fc:d7:08:00
> <later>
> martian source 255.255.255.255 from 192.168.1.183, on dev eth0
> ll header: ff:ff:ff:ff:ff:ff:48:5d:60:e8:65:8f:08:00

However, the packets are *not* martians, but legitimate broadcast
UDP/IPv4 packets: they have the *destination* as 255.255.255.255 or
192.168.1.255, with the source being 192.168.1.115 (wlan0 on this
device) for the first three packets, and 192.168.1.183 (eth0) on the
fourth.

Linux 3.3.4-1-ARCH on Arch Linux

-- 
Mantas M. <grawity@...il.com>

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/