martian source packets(ll header)再论 回首页 新编译linux内核，本地做了网桥，或者路由器上做了网桥，或者某台虚机的虚拟网卡接错虚拟交换机，或者做了NAT和其它包转发。。。有可能会出现下面的情况： Oct 31 23:32:10 emily user.warn kernel: martian source 255.255.255.255 from 192.168.108.10, on dev eth2 Oct 31 23:32:10 emily user.warn kernel: ll header: ff:ff:ff:ff:ff:ff:00:50:56:a4:8f:c4:08:00 Oct 31 23:32:10 emily user.warn kernel: martian source 255.255.255.255 from 192.168.118.10, on dev eth3 Oct 31 23:32:10 emily user.warn kernel: ll header: ff:ff:ff:ff:ff:ff:00:50:56:a4:8f:c5:08:00 Oct 31 23:33:10 emily user.warn kernel: martian source 255.255.255.255 from 192.168.118.10, on dev eth3 Oct 31 23:33:10 emily user.warn kernel: ll header: ff:ff:ff:ff:ff:ff:00:50:56:a4:8f:c5:08:00 Oct 31 23:33:10 emily user.warn kernel: martian source 255.255.255.255 from 192.168.108.10, on dev eth2 Oct 31 23:33:10 emily user.warn kernel: ll header: ff:ff:ff:ff:ff:ff:00:50:56:a4:8f:c4:08:00 解决方法（这个方法实际上屏蔽了日志输出，掩盖了网络结构上的一些问题，不是个好方法。） 在/etc/sysctl.conf文件中加入下面的配置： # Controls source route verification # 返回地址过滤关闭 # net.ipv4.conf.default.rp_filter = 0 # 关掉IP spoofing protection net.ipv4.conf.eth0.arp_filter = 0 # Do not accept source routing net.ipv4.conf.default.accept_source_route = 0 # 这里的eth0, eth1,...br0, br1 这些设备名，以具体情况来定义 # net.ipv4.conf.default.log_martians=0 net.ipv4.conf.lo.log_martians=0 net.ipv4.conf.eth0.log_martians=0 net.ipv4.conf.eth1.log_martians=0 net.ipv4.conf.eth2.log_martians=0 net.ipv4.conf.eth3.log_martians=0 net.ipv4.conf.br0.log_martians=0 net.ipv4.conf.br1.log_martians=0 net.ipv4.conf.all.log_martians=0 -------------------------------------------------------------------------------- 参考： A martian data packet is a network data packet that has an impossible source or destination IP, such as a packet that claims to have come from the broadcast address, 255.255.255.255. Another example of a martian packet would be if you received a packet from 192.168.0.1 through your networks external gateway. IPs in the range of 192.168.* are not routable through gateways, so this situation should never happen. Usually martians are just the result of network misconfigurations or glitches of some sort, but they can be caused by deliberate mangling of the IP packet, such as when trying to hide the real origin of the packets during an attack against a server. If you see just a few martian packet messages then there probably isn't anything to worry about, but if you see lots of them then take a closer look. Recent kernels print out the link level header of the packet along with the martian warning, and the header contains the destination and source MAC addresses. In the example below the destination MAC (for the server "aries") is 00:01:80:23:96:54, and the source MAC (the sender of the martian) is 00:e0:52:14:4d:9d. The "08:00″ at the end just indicates that this header is from an ipv4 over ethernet packet. Apr 29 09:33:54 aries kernel: martian source 207.44.228.62 from 80.3.32.5, on dev eth0 Apr 29 09:33:42 aries kernel: ll header: 00:01:80:23:96:54:00:e0:52:14:4d:9d:08:00 If you do see lots of martians being logged, or have some other reason to suspect that the server is being attacked, a good place to look is in the Apache error log file. You may be able to find log entries for the martian IP addresses that record attack attempts. For example, here is an error_log entry recording an attack attempt against the same server that logged the martian shown above. [Mon Apr 28 20:26:18 2003] [error] [client 80.3.32.5] request failed: erroneous characters after protocol string: GET /images/Smilies%20gold%2018×18/shocked.gif (.x81cxf3×8axffxffxfdb4xd6a2×1171x94xd7xffxfbx92lxffx8dxe2×05 x18Gvx8caP;"xxe1qx8cx1ax078Kx1cx0exb1×87 So don't worry too much about the martians, but be on guard lest they actually invade. 其实就是IP spoofing（IP欺骗），意思很明显了，就是： 1. 从外网来的源地址如果是内网地址（192.168.×.*,172.16.*,10.*）则是IP欺骗； 2. 从内网来的源地址如果是公网地址那也是IP欺骗