Ed Greshko <ed.greshko(a)greshko.com> writes:
On 07/09/14 22:57, lee wrote:
> Ed Greshko <ed.greshko(a)greshko.com> writes:
>
>> On 07/09/14 19:41, lee wrote:
>>> what is an "ll header"?
>>>
>>> I'm trying to figure out why I have martian sources and got so far as to
>>> think that they are not created on my side. Yet the "ll header"
might
>>> contain some useful information if I knew exactly how to interpret that
>>> information.
>> ll header stands for "Link Layer Header"
> Thanks! What does the information given in it tell me? It looks like
> part of it could be a MAC address.
>
> How can I find out what causes these messages?
>
The contents of the link header is dependent on the type of link. For
ethernet, the header will simply contain the Destination and Source
MAC addresses + a code to define the remainder of the packet. 0800
for IP, 86dd for IPv6, 0806 for ARP.
A martian is detected when the source MAC address has an associated IP
address not expected on that interface. This usually means there is a
misconfigured system on the LAN.
Thanks again! These packages would appear to be broadcasts from MAC
addresses I don't have. I'll have to bother my ISP about it.
--
Fedora release 20 (Heisenbug)