log entry

[scottt]

I keep finding this in my message log:

martian source 0b0fa8c0 for ffffffff, dev eth1
ll header: ff ff ff ff ff ff 00 01 03 23 e7 95 08 00

Any ideas as to what this is?? or means?

Thanks,
Scully

[APHRODITE007]

Here's a shot in the dark !!but do you perhaps have an ipx network attached to one of your routers ?
cause that looks like an ipx net + node address - ie what is telling you is that an ipx device accessed your machine on ethernet device (no.)

from cisco experience thats what i would say it looks like - anyway !

[mychl]

I had that before. Try reconfiguring your 2nd NIC. Eth1... your system isn't sure whats connected to it. I would remove it, then reassign the internal IP, subnet, etc...

HTH

[scottt]

Thank you both I'll give that a try. That's a no on the ipx device. There are none on my network.

Cheers,
Scully

[Craig McPherson]

"Martian source" means a packet with a reserved, invalid, impossible, or suspicious IP address. If eth1 is an internal network using NAT, you'll want to turn off martian checking, since you're probably using a private address range (192.168/16 for example) that's considered "martian."

The name originally came from a joke in some of the old internet documentation -- the 127/8 IP range (which is used for loopback, as you know) is officially registered to the "University of Mars".