The Wiert Corner – irregular stream of stuff

Jeroen W. Pluimers on .NET, C#, Delphi, databases, and personal interests

  • My badges

  • Twitter Updates

  • My Flickr Stream

  • Pages

  • All categories

  • Enter your email address to subscribe to this blog and receive notifications of new posts by email.

    Join 1,846 other followers

`ll header` in `martian source` is the Data Link Layer: 2 MAC addresses

Posted by jpluimers on 2019/06/03

The ll header field in a martian source message on linux is about the [WayBackEthernet frame – Wikipedia: Data Link Layer.

The first 6 hex digits are the source MAC address, the next are the destination MAC address:

May 10 08:59:24 linux kernel: IPv4: martian source 255.255.255.255 from 192.168.17.44, on dev eth1
May 10 08:59:24 linux kernel: ll header: 00000000: ff ff ff ff ff ff 00 0c 29 f7 0f fe 08 00 ........).....

In the above example:

  • Destination = MAC ff ff ff ff ff ff (broadcast, which corresponds with IPv4 target 255.255.255.255)
  • Source = MAC 00 0c 29 f7 0f fe (specific, which I could verify after checking out the machine having IPv4 192.168.17.44)
  • EtherType  08 00 (IPv4)

Some sources indicate it is a martian, as 255.255.255.255 is never a valid IP address, but [WayBack] Martian packet – Wikipedia: IPv4 disagrees.

References:

–jeroen

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

 
%d bloggers like this: