OOPS :< - that didn't look to good - here it is a little easier on the eyes hopefully. Sorry for the repost
Found out some more info for this issue - forgot to mail to the list previously, but here is pretty much everything you ever wanted to know about those pesky martian packets: as you explained > martian source 3edb5d3f for 03db5d3f, dev eth1 3edb5d3f == 63.93.219.62 = source IP 03db5d3f == 63.93.219.3 = destination IP (may actually be your subnet broadcast address on the external interface - can't tell without gateway and subnet info tho) now for the header ll header: ff ff ff ff ff ff 00 30 c1 d8 b6 80 08 06 ff ff ff ff ff ff = destination MAC address - this equates to a binary of 11111111 11111111 11111111 11111111 11111111 11111111 or simply a broadcast to anything on the LAN with a MAC address - probably shouldn't be forwarded off the LAN in any case 00 30 c1 d8 b7 80 = Source MAC address Remaining characters define the ARP Protocol type: arp packet type 08:06 arp_hrd 00:01 /* Ethernet1*/ arp_prot 08:00 /* IP=0x800 */ arp_hlen 06 /* hlen = 6 */ arp_plen 04 /* plen = 4 */ arp_op 00:01 /* arp ARP_REQ*/ arp_sha 00:c0:7b:61:44:fe /* 123 */ arp_spa cc:b2:d7:7b /* 123 */ arp_tha 00:00:00:00:00:00 arp_tpa cc:b2:d7:13 /* 19 */ All info gathered from http://www.cpm.ru/service/manuals/pipeline/pipe130/6.0.0/usergde/filter.htm and http://lists.suse.com/archive/suse-linux-e/2000-Jul/0282.html Hope it helps a little Simon > >>From: "Michael D. Schleif" <[EMAIL PROTECTED]> >>Reply-To: [EMAIL PROTECTED] >>To: LEAF <[EMAIL PROTECTED]> >>Subject: [Leaf-user] Martians: please, help track this one down ??? >>Date: Mon, 29 Oct 2001 22:33:15 -0600 >> >> >>Yes, I know what martians are. Yes, I know how they can occur. >> >>No, I do not know how to locate and eradicate this one ;< >> >> martian source 3edb5d3f for 03db5d3f, dev eth1 >> ll header: ff ff ff ff ff ff 00 30 c1 d8 b6 80 08 06 >> >> 3edb5d3f == 63.93.219.62 >> 03db5d3f == 63.93.219.3 >> >>However, now that I know that it's there, on a network from which it >>cannot escape, *HOW* do I track it down? >> >>How do we interpret that second line? >> >>Am I right in assuming that the MAC address is buried somewhere in line >>2? >> >>Anybody have any suggestions on how to locate this ugly bugger? >> >>What do you think? >> >>-- >> >>Best Regards, >> >>mds _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp _______________________________________________ Leaf-user mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/leaf-user