On Mon, 8 Apr 2002 19:54:11 -0700 (PDT) Roberto Armenteros <[EMAIL PROTECTED]> wrote:
> Since i upgraded to Mandrake 8.2 I am getting the > following log message from the kernel. > > Apr 8 22:30:36 rarmente kernel: ll header: > ff:ff:ff:ff:ff:ff:00:50:da:da:c7:57:08:00 > > Apr 8 22:32:36 rarmente kernel: martian source > 255.255.255.255 from 127.0.0.1, on dev eth0 > > I use swatch to monitor my log files and it is > constantly showing this messages. I would appreciate > if somebody gives me a hand to understand this > message. > > Roberto Assuming both messages refer to the same packet, you've got a machine sending a wire broadcast (ff:ff:ff:ff:ff:ff) to the local broadcast (255.255.255.255) and claiming to be the loopback IP (127.0.0.1) -- the problem is that packets to/from the loopback must never appear on a LAN. The sender has an ethernet card with the MAC address 00:50:da:da:c7:57... I don't see a vendor code (00:50:da) for this card at http://www.cavebear.com/CaveBear/Ethernet/vendor.html so I can't tell you who the vendor is. Hope the neighbouring machines on your eth0 is not too big... if eth0 is connected to a DSL, you'll have to work with your local ISP to try to locate it. If you want to try to find it yourself, you can ping all the addresses in your subnet (individually or with "ping -b 255.255.255.255" -- add "-I eth0" if you have other net adapters) and check the ARP cache with "arp -a | grep -i 00:50:da". If you get a hit, you will at least know the real IP | address of the offender. Caution, it *could* be you... HTH, Pierre
Want to buy your Pack or Services from MandrakeSoft? Go to http://www.mandrakestore.com
