Re: IP-less bridge as a martian source

[Jarek Poplawski <jarkao2@gmail.com>]

Ferenc Wagner wrote, On 10/22/2008 05:00 PM:

> Ferenc Wagner <wferi@niif.hu> writes:
> 
>> I expected an IP-less bridge interface to pick up no IP packets, but
>> apparently this isn't the case: broadcast packets with destination
>> address 255.255.255.255 are reported as martians by the 2.6.18
>> kernel, which I find counterintuitive (I know 2.6.18 is rather old,
>> but that's the one supported by Xen).
>>
>>   1. Is this the expected behaviour?


I think so, and this thread pertains to something similar:
http://marc.info/?l=linux-netdev&m=122456602708727&w=2

>>
>>   2. I tried to cut down the logs by explicit iptables drops, but
>>      didn't succeed.  Does martian detection happen before the
>>      netfilter rules?  (I know I can disable martian logging by
>>      interface, but wanted finer granularity.)


It's after netfilter's PREROUTING. (BTW, it's also after ingress
qdisc where you can try some filtering.)

Jarek P.