查看/var/log/messages日志中有大量的如下log：
Jul 10 15:38:33 jxlx kernel: martian source 123.15.33.131 from 192.168.0.139, on dev eth1
Jul 10 15:38:33 jxlx kernel: ll header: 00:1a:64:d4:31:02:00:d0:04:01:9c:0a:08:00
A martian data packet is a network data packet that has an impossible source or destination IP, such as a packet that claims to have come from the broadcast address, 255.255.255.255. Another example of a martian packet would be if you received a packet from 192.168.0.1 through your networks external gateway.
IPs in the range of 192.168.* are not routable through gateways, so this situation should never happen. Usually martians are just the result of network misconfigurations or glitches of some sort, but they can be caused by deliberate mangling of the IP packet, such as when trying to hide the real origin of the packets during an attack against a server. If you see just a few martian packet messages then there probably isn’t anything to worry about, but if you see lots of them then take a closer look.
Recent kernels print out the link level header of the packet along with the martian warning, and the header contains the destination and source MAC addresses. In the example the destination MAC (for the server “aries”) is 00:1a:64:d4:31:02, and the source MAC (the sender of the martian) is 00:d0:04:01:9c:0a. The “08:00″ at the end just indicates that this header is from an ipv4 over ethernet packet.
If you do see lots of martians being logged, or have some other reason to suspect that the server is being attacked, a good place to look is in the Apache error log file. You may be able to find log entries for the martian IP addresses that record attack attempts.
So don’t worry too much about the martians, but be on guard lest they actually invade.
其实就是IP spoofing（IP欺骗），意思很明显，就是：
1. 从外网来的源地址如果是内网地址（192.168.*.*,172.16.*,10.*）则是IP欺骗；
2. 从内网来的源地址如果是公网地址那是IP欺骗
之所以会有记录这样的日志，是因为开启了IP spoofing protection。在/etc/sysctl.conf中：
# Enable IP spoofing protection, turn on source route verification
net.ipv4.conf.eth0.arp_filter = 1
#default 0
net.ipv4.conf.eth0.rp_filter = 1
net.ipv4.conf.lo.arp_filter = 1
#default 0
net.ipv4.conf.lo.rp_filter = 1
net.ipv4.conf.default.arp_filter = 1
#default 0
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.all.arp_filter = 1
#default 0
net.ipv4.conf.all.rp_filter = 1
#default 0
阅读(1309) | 评论(0) | 转发(0) |
