This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Kernel log with martian sources!

 Hi,

Have a customer where they had a problem 14 days ago and now today.

 

Symptoms: All servers are disconnected and traffic is severely blocked, voIP calls are are stuttering a lot!!

 

I think it may be due to some network loops somewhere, even though spanning tree is configured, it goes on like 10-15 minutes and vanishes!

 

I need to find the source for this, but I have theese entries in the kernel log, what do they mean:

 

2017:08:23-10:09:28 fw01-2 kernel: [1363951.511344] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 fd 42 08 06 ...........B..
2017:08:23-10:09:28 fw01-2 kernel: [1363951.518172] IPv4: martian source 192.168.60.159 from 192.168.60.1, on dev eth2.21
2017:08:23-10:09:28 fw01-2 kernel: [1363951.518175] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 fd 42 08 06 ...........B..
2017:08:23-10:09:28 fw01-2 kernel: [1363951.524558] IPv4: martian source 192.168.60.159 from 192.168.60.1, on dev eth2.21
2017:08:23-10:09:28 fw01-2 kernel: [1363951.524561] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 fd 42 08 06 ...........B..
2017:08:23-10:09:28 fw01-2 kernel: [1363951.530714] IPv4: martian source 192.168.60.159 from 192.168.60.1, on dev eth2.21
2017:08:23-10:09:28 fw01-2 kernel: [1363951.530717] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 fd 42 08 06 ...........B..
2017:08:23-10:09:28 fw01-2 kernel: [1363951.535560] IPv4: martian source 192.168.60.159 from 192.168.60.1, on dev eth2.21
2017:08:23-10:09:28 fw01-2 kernel: [1363951.535563] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 fd 42 08 06 ...........B..
2017:08:23-10:09:28 fw01-2 kernel: [1363951.542855] IPv4: martian source 192.168.60.159 from 192.168.60.1, on dev eth2.21
2017:08:23-10:09:28 fw01-2 kernel: [1363951.542858] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 fd 42 08 06 ...........B..
2017:08:23-10:09:28 fw01-2 kernel: [1363951.547210] IPv4: martian source 192.168.60.159 from 192.168.60.1, on dev eth2.21
2017:08:23-10:09:28 fw01-2 kernel: [1363951.547213] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 fd 42 08 06 ...........B..
2017:08:23-10:09:28 fw01-2 kernel: [1363951.552676] IPv4: martian source 192.168.60.159 from 192.168.60.1, on dev eth2.21
2017:08:23-10:09:28 fw01-2 kernel: [1363951.552679] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 fd 42 08 06 ...........B..
2017:08:23-10:09:28 fw01-2 kernel: [1363951.559344] IPv4: martian source 192.168.60.159 from 192.168.60.1, on dev eth2.21
2017:08:23-10:09:28 fw01-2 kernel: [1363951.559347] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 fd 42 08 06 ...........B..
2017:08:23-10:09:28 fw01-2 kernel: [1363951.563687] IPv4: martian source 192.168.60.159 from 192.168.60.1, on dev eth2.21
2017:08:23-10:09:28 fw01-2 kernel: [1363951.563689] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 fd 42 08 06 ...........B..

 

Help is greatly appreciated! :-)



This thread was automatically locked due to age.
  • Martin, how did this work out?  What does the VLAN Interface definition on dev eth2.21 look like?  Did you try moving the device with 192.168.60.59 to a different port on the managed switch?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA