martian destination and RAW iptable

martian destination and RAW iptable

[Yury Polyanskiy]

Hello everyone!

I wanted to filter out the annoying logs:

Jan 24 00:19:54 tetra kernel: martian destination 0.0.0.0 from 1.2.3.4, dev eth0

and issued the following:

#iptables -t raw -I PREROUTING -s 1.2.3.4 -d 0.0.0.0 -j DROP
#iptables -t raw -I PREROUTING -s 1.2.3.4 -j DROP

Amazingly, I'm still getting those pesky log messages. How is this possible?

# uname -a
Linux xxx.xxx.xxx.EDU 2.6.28 #1 SMP PREEMPT Fri Jan 16 00:41:03 EST
2009 i686 GNU/Linux

Thanks in advance for any of your ideas.

Best,
Yury

PS. Please CC me, I'm not on the list.

Re: martian destination and RAW iptable

[Mart Frauenlob]

Yury Polyanskiy wrote:
> Hello everyone!
>
> I wanted to filter out the annoying logs:
>
> Jan 24 00:19:54 tetra kernel: martian destination 0.0.0.0 from 1.2.3.4, dev eth0
>
> and issued the following:
>
> #iptables -t raw -I PREROUTING -s 1.2.3.4 -d 0.0.0.0 -j DROP
> #iptables -t raw -I PREROUTING -s 1.2.3.4 -j DROP
>
> Amazingly, I'm still getting those pesky log messages. How is this possible?
>
> # uname -a
> Linux xxx.xxx.xxx.EDU 2.6.28 #1 SMP PREEMPT Fri Jan 16 00:41:03 EST
> 2009 i686 GNU/Linux
>
>   
find /proc -name log_martians

set the one for your interface to `0'.

greets

mart

Re: martian destination and RAW iptable

[Yury Polyanskiy]

On Tue, Jan 27, 2009 at 9:19 PM, Mart Frauenlob
<mart.frauenlob@chello.at> wrote:
> Yury Polyanskiy wrote:
>>
>> Hello everyone!
>>
>> I wanted to filter out the annoying logs:
>>
>> Jan 24 00:19:54 tetra kernel: martian destination 0.0.0.0 from 1.2.3.4,
>> dev eth0
>>
>> and issued the following:
>>
>> #iptables -t raw -I PREROUTING -s 1.2.3.4 -d 0.0.0.0 -j DROP
>> #iptables -t raw -I PREROUTING -s 1.2.3.4 -j DROP
>>
>> Amazingly, I'm still getting those pesky log messages. How is this
>> possible?
>>
>
> find /proc -name log_martians
>
> set the one for your interface to `0'.
>

Thanks, but I was asking how is it possible that a packet slips
through the -s 1.2.3.4 -j DROP rule in PREROUTING.

Y

Re: martian destination and RAW iptable

[Yury Polyanskiy]

>>>
>>> I wanted to filter out the annoying logs:
>>>
>>> Jan 24 00:19:54 tetra kernel: martian destination 0.0.0.0 from 1.2.3.4,
>>> dev eth0
>>>
>>> and issued the following:
>>>
>>> #iptables -t raw -I PREROUTING -s 1.2.3.4 -d 0.0.0.0 -j DROP
>>> #iptables -t raw -I PREROUTING -s 1.2.3.4 -j DROP
>>>
>>> Amazingly, I'm still getting those pesky log messages. How is this
>>> possible?

The problem was in arp_process():

 814        if (arp->ar_op == htons(ARPOP_REQUEST) &&
 815            ip_route_input(skb, tip, sip, 0, dev) == 0) {

So the packet "arp who has 0.0.0.0 tell 1.2.3.4" triggered those log messages.

Sorry for spamming.

Best,
Yury