Subject: Debungging martian packets
From: Raphael Bauduin <rblists@gmail.com>
Date: Tue, 2 Jul 2013 15:12:24 +0200
Tue, 2 Jul 2013 15:12:24 +0200
Hi,

I am running vservers for years, and I had to migrate them from one
physical server to another.
I have a setup with a dummy interface (which I just read in the ML archive
is discouraged...).
I have replicated the setup, but I see martian packets on the public
interface, the destination of which being the private IP (10.12.12.2) of
one of the vservers (activng as a reverse http proxy to other vservers):

[1563573.536936] martian source 10.12.12.2 from $PUBLIC, on dev eth0
[1563573.536939] ll header: e8:40:f2:0a:e9:4e:6c:9c:ed:bb:6f:80:08:00

e8:40:f2:0a:e9:4e is the MAC address of the public interface
My understanding is that 6c:9c:ed:bb:6f:80 is the MAC address of the last
hop before the server, and that this is an IPv4 packet .

*After* seeing the problem and reading the mailing list archive, I have set
arp ignore to 1 on all interfaces and arp announce to 2 on the public
interface.

When I shutdown the vserver I saw these message, I didn't see the martian
packets anymore, but had this:

arpwatch: ethernet mismatch 37.59.44.254 6c:9c:ed:bb:bd:80
(00:07:b4:00:00:01) eth0


Do you have any suggestion as to what I can do to debug this?
tcpdump does not give more info (I guess the packet is dropped before
tcpdump sees it),  relaxing the rp filter (to 0) setting didn't change this.

# uname -a
Linux  2.6.32-5-vserver-amd64 #1 SMP Fri May 10 10:52:10 UTC 2013 x86 64
GNU/Linux


Thanks in advance!

Raphaël


Hi,

I am running vservers for years, and I had to migrate them from one physical server to another.
I have a setup with a dummy interface (which I just read in the ML archive is discouraged...).
I have replicated the setup, but I see martian packets on the public interface, the destination of which being the private IP (10.12.12.2) of one of the vservers (activng as a reverse http proxy to other vservers):

[1563573.536936] martian source 10.12.12.2 from $PUBLIC, on dev eth0
[1563573.536939] ll header: e8:40:f2:0a:e9:4e:6c:9c:ed:bb:6f:80:08:00

e8:40:f2:0a:e9:4e is the MAC address of the public interface
My understanding is that 6c:9c:ed:bb:6f:80 is the MAC address of the last hop before the server, and that this is an IPv4 packet .

*After* seeing the problem and reading the mailing list archive, I have set arp ignore to 1 on all interfaces and arp announce to 2 on the public interface.

When I shutdown the vserver I saw these message, I didn't see the martian packets anymore, but had this:

arpwatch: ethernet mismatch 37.59.44.254 6c:9c:ed:bb:bd:80 (00:07:b4:00:00:01) eth0


Do you have any suggestion as to what I can do to debug this?
tcpdump does not give more info (I guess the packet is dropped before tcpdump sees it),  relaxing the rp filter (to 0) setting didn't change this.

# uname -a
Linux  2.6.32-5-vserver-amd64 #1 SMP Fri May 10 10:52:10 UTC 2013 x86 64 GNU/Linux


Thanks in advance!

Raphaël