On 07/09/14 22:57, lee wrote:
Ed Greshko <ed.greshko(a)greshko.com> writes:
> On 07/09/14 19:41, lee wrote:
>> what is an "ll header"?
>>
>> I'm trying to figure out why I have martian sources and got so far as to
>> think that they are not created on my side. Yet the "ll header" might
>> contain some useful information if I knew exactly how to interpret that
>> information.
> ll header stands for "Link Layer Header"
Thanks! What does the information given in it tell me? It looks like
part of it could be a MAC address.
How can I find out what causes these messages?
The contents of the link header is dependent on the type of link. For ethernet, the
header will simply contain the Destination and Source MAC addresses + a code to define the
remainder of the packet. 0800 for IP, 86dd for IPv6, 0806 for ARP.
A martian is detected when the source MAC address has an associated IP address not
expected on that interface. This usually means there is a misconfigured system on the
LAN.
--
If you can't laugh at yourself, others will gladly oblige.