`ll header` in `martian source` is the Data Link Layer: 2 MAC addresses
Posted by jpluimers on 2019/06/03
The ll header field in a martian source message on linux is about the [WayBack] Ethernet frame – Wikipedia: Data Link Layer.
The first 6 hex digits are the source MAC address, the next are the destination MAC address:
May 10 08:59:24 linux kernel: IPv4: martian source 255.255.255.255 from 192.168.17.44, on dev eth1
May 10 08:59:24 linux kernel: ll header: 00000000: ff ff ff ff ff ff 00 0c 29 f7 0f fe 08 00 ........).....
In the above example:
- Destination = MAC
ff ff ff ff ff ff(broadcast, which corresponds with IPv4 target255.255.255.255) - Source = MAC
00 0c 29 f7 0f fe(specific, which I could verify after checking out the machine having IPv4192.168.17.44) - EtherType
08 00(IPv4)
Some sources indicate it is a martian, as 255.255.255.255 is never a valid IP address, but [WayBack] Martian packet – Wikipedia: IPv4 disagrees.
References:
- [WayBack] Martian Packet Messages · System Overlord
- [WayBack] EtherType – Wikipedia
- [WayBack] Re: kernel: martian messages
- [WayBack] networking – kernel martian source to and from same IP – Unix & Linux Stack Exchange
- [WayBack] How to disable the default drop of martian packets?
–jeroen
The Wiert Corner - irregular stream of stuff 
Leave a comment