What is an "ll header"?

[lee]

Ed Greshko <ed.greshko at greshko.com> writes:

> On 07/09/14 22:57, lee wrote:
>> Ed Greshko <ed.greshko at greshko.com> writes:
>>
>>> On 07/09/14 19:41, lee wrote:
>>>> what is an "ll header"?
>>>>
>>>> I'm trying to figure out why I have martian sources and got so far as to
>>>> think that they are not created on my side.  Yet the "ll header" might
>>>> contain some useful information if I knew exactly how to interpret that
>>>> information.
>>> ll header stands for "Link Layer Header"
>> Thanks!  What does the information given in it tell me?  It looks like
>> part of it could be a MAC address.
>>
>> How can I find out what causes these messages?
>>
>
> The contents of the link header is dependent on the type of link.  For
> ethernet, the header will simply contain the Destination and Source
> MAC addresses + a code to define the remainder of the packet.  0800
> for IP, 86dd for IPv6, 0806 for ARP.
>
> A martian is detected when the source MAC address has an associated IP
> address not expected on that interface.  This usually means there is a
> misconfigured system on the LAN.

Thanks again!  These packages would appear to be broadcasts from MAC
addresses I don't have.  I'll have to bother my ISP about it.


-- 
Fedora release 20 (Heisenbug)