In the past month or so, I have been getting a flood of martian packets showing in my syslog. According to the log, the martian source is always one server, but the 'from' IP will be anything within the range of my blocks from either ISP, including the .255 broadcast. I do not get any martian logs for any other server.
Specifics... - Firewall is Ubuntu, kernel is 2.6.31-22-generic, shorewall is 4.2.10 - ISP1 is on eth0, ISP2 is on eth4, All servers are on DMZ, eth1. There is no switch or bridge between the interfaces except for shorewall. - The options for both ISPs specified in the interfaces file are "norfc1918,tcpflags,logmartians,nosmurfs,optional" The server stated in the logs has only two services running on it, and traffic appears to be flowing normally. I have compared my entries in rules and masq between entries for the other servers, and the entries for this server, and can find no problems. I have asked for help on freenode, but have not been able to solve the problem. Any further help would be much appreciated. As per requested, I have a couple of text files with information... http://sourpuss.net/temp/shorewall.log -- clippings from the log file of martian packets http://sourpuss.net/temp/shorewall.dump -- results from the 'shorewall dump' command There are three servers on the DMZ that handle similar traffic: 1 - responds on 10.0.0.1/10.0.0.201/10.0.0.209 2 - responds on 10.0.0.2/10.0.0.205/10.0.0.214 3 - responds on 10.0.0.9/10.0.0.203/10.0.0.211 (this is the one spawning the martian logs) (The multiple IP's are potentially for future packet marking to keep outbound traffic on the same ISP it came in from) ------------------------------------------------------------------------------ ThinkGeek and WIRED's GeekDad team up for the Ultimate GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the lucky parental unit. See the prize list and enter to win: http://p.sf.net/sfu/thinkgeek-promo _______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
