On 05/07/2012 04:47 PM, Maarten Vanraes wrote:
my martians are mostly from: hosts in subnet of my public IP, or
internal ranges from modems, and mostly broadcasts or arp stuff. i
think this 192.168.3.1 stuff is likely someone in your ISP subnet that
is doing bad natting and is trying to get out (much like you pinging
192.168.3.x which is going outside your public ip, that'll get
martians on someone elses pc for instance
But his case doesn't involve promiscuous traffic. The kernel message
specifies the endpoints as 192.168.3.2 and a google server. I'm not
prepared to believe that a google server is sending packets to
192.168.3.2, or even if it were, that it would make it through every
backbone router and be seen by his kernel. So, it's got to be something
on his LAN that thinks it's 192.168.3.2 trying to send to the google
server. Since he has fixed IPs in other subnets for most systems, it's
got to be the DHCP users. So, either the DHCP server he intends them to
use is misconfigured, or they are getting to some other DHCP server that
is configured to give out 192.168.3.2 addresses, which would probably be
the case if it was running on a box that had assigned itself 192.168.3.1.
