On 07/09/14 22:57, lee wrote:
Ed Greshko ed.greshko@greshko.com writes:
On 07/09/14 19:41, lee wrote:
what is an "ll header"?
I'm trying to figure out why I have martian sources and got so far as to think that they are not created on my side. Yet the "ll header" might contain some useful information if I knew exactly how to interpret that information.
ll header stands for "Link Layer Header"
Thanks! What does the information given in it tell me? It looks like part of it could be a MAC address.
How can I find out what causes these messages?
The contents of the link header is dependent on the type of link. For ethernet, the header will simply contain the Destination and Source MAC addresses + a code to define the remainder of the packet. 0800 for IP, 86dd for IPv6, 0806 for ARP.
A martian is detected when the source MAC address has an associated IP address not expected on that interface. This usually means there is a misconfigured system on the LAN.