1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<TITLE> [Mageia-discuss] Odd entry in log file
</TITLE>
<LINK REL="Index" HREF="index.html" >
<LINK REL="made" HREF="mailto:mageia-discuss%40mageia.org?Subject=Re%3A%20%5BMageia-discuss%5D%20Odd%20entry%20in%20log%20file&In-Reply-To=%3C4FA85DEA.9090104%40Rock3d.net%3E">
<META NAME="robots" CONTENT="index,nofollow">
<META http-equiv="Content-Type" content="text/html; charset=us-ascii">
<LINK REL="Previous" HREF="007250.html">
<LINK REL="Next" HREF="007254.html">
</HEAD>
<BODY BGCOLOR="#ffffff">
<H1>[Mageia-discuss] Odd entry in log file</H1>
<B>imnotpc</B>
<A HREF="mailto:mageia-discuss%40mageia.org?Subject=Re%3A%20%5BMageia-discuss%5D%20Odd%20entry%20in%20log%20file&In-Reply-To=%3C4FA85DEA.9090104%40Rock3d.net%3E"
TITLE="[Mageia-discuss] Odd entry in log file">imnotpc at Rock3d.net
</A><BR>
<I>Tue May 8 01:42:34 CEST 2012</I>
<P><UL>
<LI>Previous message: <A HREF="007250.html">[Mageia-discuss] Odd entry in log file
</A></li>
<LI>Next message: <A HREF="007254.html">[Mageia-discuss] Odd entry in log file
</A></li>
<LI> <B>Messages sorted by:</B>
<a href="date.html#7251">[ date ]</a>
<a href="thread.html#7251">[ thread ]</a>
<a href="subject.html#7251">[ subject ]</a>
<a href="author.html#7251">[ author ]</a>
</LI>
</UL>
<HR>
<!--beginarticle-->
<PRE>
>><i> Well isn't that interesting. That Comcast IP is the address of the
</I>>><i> ISP gateway I use. Both of my firewall/gateway boxes that are logging
</I>>><i> martian packets are connected to similar Comcast routers. The routers
</I>>><i> are configured in bridge mode so the router DHCP service has no
</I>>><i> effect on my connection, but it might still be active on the router.
</I>>><i> Also each ISP router also has a wireless interface and that could
</I>>><i> still be active. My firewall doesn't block any private IPs coming
</I>>><i> from the Internet interface since the ISP routers would never forward
</I>>><i> them, so that explains how they get past the firewall.
</I>><i>
</I>><i> No, I think traceroute doesn't special-case internal IP addresses.
</I>><i> Your routing table is (correctly) set up to route traffic for anything
</I>><i> other than your known subnets to the external internet, and that's
</I>><i> exactly what traceroute is doing. It's your ISP's job to discard
</I>><i> internal address packets, not yours.
</I>><i>
</I>><i> But I think you're on to something with the ISP routers. Is there
</I>><i> some reason you don't just run the cable from the cable modem to the
</I>><i> external NIC on the gateway PC ? If you're willing to try that, and
</I>><i> the martians disappear, it's these routers.
</I>><i>
</I>><i> Try going into configuration on these routers, and see what their DHCP
</I>><i> servers are set up for, and whether the 192.168.3 subnet appears
</I>><i> anywhere in there. It's possible that one of your DHCP-using wireless
</I>><i> clients is getting an answer to its broadcast from these guys before
</I>><i> your internal router, and picking up a 192.168.3.2 IP address from them.
</I>
Well the Comcast cable modem was a dead end. I checked it and DHCP is
disabled, and even if it were enabled it uses a completely different
subnet. Besides, It would be coming in on eth2 and not eth0. I checked
the wireless router in the LAN and it uses the 192.168.3.0/24 subnet for
it's DHCP connections. It has a fixed IP of 192.168.0.100 on the LAN
interface so I don't know why these IPs would ever be seen by the
firewall/gateway box, but this looks like the most likely source.
Jeff
</PRE>
<!--endarticle-->
<HR>
<P><UL>
<!--threads-->
<LI>Previous message: <A HREF="007250.html">[Mageia-discuss] Odd entry in log file
</A></li>
<LI>Next message: <A HREF="007254.html">[Mageia-discuss] Odd entry in log file
</A></li>
<LI> <B>Messages sorted by:</B>
<a href="date.html#7251">[ date ]</a>
<a href="thread.html#7251">[ thread ]</a>
<a href="subject.html#7251">[ subject ]</a>
<a href="author.html#7251">[ author ]</a>
</LI>
</UL>
<hr>
<a href="https://www.mageia.org/mailman/listinfo/mageia-discuss">More information about the Mageia-discuss
mailing list</a><br>
</body></html>
|
