netdev - Re: IP-less bridge as a martian source

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <874p2m76sx.fsf@tac.ki.iif.hu>
Date:	Wed, 05 Nov 2008 12:26:06 +0100
From:	Ferenc Wagner <wferi@...f.hu>
To:	Jarek Poplawski <jarkao2@...il.com>
Cc:	netdev@...r.kernel.org
Subject: Re: IP-less bridge as a martian source

Ferenc Wagner <wferi@...f.hu> writes:

> Jarek Poplawski <jarkao2@...il.com> writes:
>
>> On Sun, Nov 02, 2008 at 12:55:56AM +0100, Ferenc Wagner wrote:
>> 
>>> If I ping -b 255.255.255.255 on a virtual machine with IP
>>> 193.225.14.155, whose virtual interface is a port of br891:
>>> 
>>> martian source 255.255.255.255 from 193.225.14.155, on dev br891

May be of interest, but on the other host (which currently does not
run the virtual machine running the above ping command, so the same
bridge is present but without the virtual interfaces), logged an extra
__ratelimit message preceeding the martian:

[288953.880497] __ratelimit: 102 messages suppressed
[288953.880585] martian source 255.255.255.255 from 193.225.14.155, on dev br891
[288953.880640] ll header: ff:ff:ff:ff:ff:ff:00:16:3e:01:00:00:08:00

If I ping again, no further __ratelimits emerge, and tcpdump shows a
single ICMP packet, the echo request.
-- 
Regards,
Feri.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html