What is an "ll header"?

[Ed Greshko]

On 07/09/14 22:57, lee wrote:
> Ed Greshko <ed.greshko at greshko.com> writes:
>
>> On 07/09/14 19:41, lee wrote:
>>> what is an "ll header"?
>>>
>>> I'm trying to figure out why I have martian sources and got so far as to
>>> think that they are not created on my side.  Yet the "ll header" might
>>> contain some useful information if I knew exactly how to interpret that
>>> information.
>> ll header stands for "Link Layer Header"
> Thanks!  What does the information given in it tell me?  It looks like
> part of it could be a MAC address.
>
> How can I find out what causes these messages?
>

The contents of the link header is dependent on the type of link.  For ethernet, the header will simply contain the Destination and Source MAC addresses + a code to define the remainder of the packet.  0800 for IP, 86dd for IPv6, 0806 for ARP.

A martian is detected when the source MAC address has an associated IP address not expected on that interface.  This usually means there is a misconfigured system on the LAN.

-- 
If you can't laugh at yourself, others will gladly oblige.