similar to: Did I get hacked?? strange log info...

Guys, good afternoon I'm using in my bond interfaces as active backup, in theory, should assume an interface (or work) only when another interface is down. But I'm just lost packets on the interface that is not being used and is generating packet loss on bond. What can that be? Follow my settings bond [root at xxxxx ~]# ifconfig bond0 ; ifconfig eth0 ; ifconfig eth1 bond0

[ sorry for cross-posting this to newbies and users, but I''m a bit desperate to get this resolved ] This is strange... I had this working before without any problems, and recently we started to have some odd issues. I can''t be sure exactly what has changed as I''m unfortunately not the only person with access to the server. {sigh} The problem is that I pretty much

Hi, I have a setup problem with Shorewall 4.0.6, which I can''t figure out why it is not working: I want to install a fireall with 2 extra interfaces : - My serv ("dmz") zone is a /28 subnet behind eth1, with a small number of SUN servers (IPs between ABC.DEF.75.1 and .13), one of which is a DHCP server for the 75 subnet. - The loc zone are PCs in the 75 subnet behind eth2

Hi all: I see a lot of the errors below in /var/log/messages on my firewall: Aug 1 00:47:44 munin kernel: [109008.257109] martian source 192.168.1.5 from 127.0.0.1, on dev eth1 Aug 1 00:48:44 munin kernel: [109068.257384] martian source 192.168.1.5 from 127.0.0.1, on dev eth1 Aug 1 00:49:44 munin kernel: [109128.257509] martian source 192.168.1.5 from 127.0.0.1, on dev eth1 Aug 1 00:50:44

Shorewall 4.5.1.1 I have 5 interfaces on a centos box, the first two are internal on two different subnets, the next two are two different ISP''s and the last one is a private network for testing and administration. The second internal subnet (eth1) is rejecting all the arp requests to it and I get the following in the log files ever second or two - May 16 05:28:54 services kernel:

Peace, I have messages like (on a centos 3.8 box) NET: 21 messages suppressed. martian source 10.255.255.255 from 10.0.0.138, on dev eth0 on my screen. In the same time it is being logged to a file. Are there any way to stop the logging of these messages on the console and still logged to a file (/var/log/messages) Thank you. Hameed

Hi I''m trying to monitor my multi ISP shorewall with swping, the script works fine, i can see in log when an ISP is down, the script restart shorewall and /etc/shorewall/isusable is called, however in the swping log after the shorewall restart i see again a route by ISP (even the ISP down), is it normal ? should i not see one route less? shorewall version 4.4.5.4-1. ****

We are seeing the following in our logs: Nov 25 16:21:41 fw kernel: martian source 139.142.66.253 from 10.0.0.199, on dev eth0 Nov 25 16:21:41 fw kernel: ll header: 00:a0:c9:60:0e:b2:00:02:7e:21:0e:dc:08:00 00:a0:c9:60:0e:b2 is the mac of our firewall interface on IP 139.142.66.253. 00:02:7e:21:0e:dc is the mac of our Cisco router on IP 10.0.0.1 10.0.0.199 is a Cisco switch - we have about

i am reaving lots of martian broadcats Nov 8 15:37:57 firewall kernel: [ 895.708393] martian source 192.168.0.3 from 192.168.0.1, on dev eth0 Nov 8 15:37:57 firewall kernel: [ 895.708399] ll header: ff:ff:ff:ff:ff:ff:90:f6:52:3f:65:c0:08:00 Nov 8 15:37:59 firewall kernel: [ 897.711647] martian source 192.168.0.3 from 192.168.0.1, on dev eth0 Nov 8 15:37:59 firewall kernel: [ 897.711654]

I have posted this question to the netfilter mailing list along with #ebtables, #iptables, and #netfilter. Nobody has really responded, so I''m led to believe that it is either incredibly complicated or *really* simple. Please, somebody throw me a bone here! Ok, on with the show... I have a bridge (br0) with two interfaces (eth1 and eth2). Neither br0, eth1, or eth2 have an

I have been working really hard configuring and researching very extensively, trying to figure why we are getting "Shorewall:FORWARD:DROP" packets. IPSEC works just fine without the iptable rules created by our shorewall configs but when starting shorewall and creating the iptables I noticed the packets are dropped. I know it is a config situation but I am totally racking my brain as

Hi All, As you probably all know :-) I''m trying to do the multi-isp thing. I''ve resolved my last issue with the route_rules as suggested by Tom and Jerry suggested. Lately I have been seeing "transient" (I say transient because the problem will persist for a while and then magically clear itself up some number of minutes later) situations where my gateway will log:

Hi, I''m trying to use Shorewall (3.0.6) to accomplish what I thought was going to be fairly simple. Unfortunately, I can''t get the dmz to work correctly, and I''m getting martians logged against the interface at issue. Any help I could get would be greatly appreciated! A picture of my physical setup is attached. I have also attached a shorewall dump. To make a long

I''ve set up a simple 2-interface Linux router using shorewall-perl 4.0.8 (and upgraded to 4.0.9). Everything works flawlessly. One small exception I have noticed (since I''m a new shorewall user I assume this is probably an error on my part). 1. Problem: With no "logmartians" entries in /etc/shorewall/interfaces, shorewall-perl sets

While using the linux bridge module in 2.6.10, the kernel seems to munge the source IP address of broadcast UDP packets if they come from "0.0.0.1", and sticks on an address of the linux host. I humbly submit that re-writing the source address of packets is not proper behavior for a bridge, even if those source addresses are not traditionally valid. Sure, 0.0.0.1 isn't a valid

Dear samba maintainers, Recently I was testing samba and ctdb with the glusterfs. Everything works well but I got some problems with file locking. When I exclusively lock a file from one Windows client the second client sees that this file is in use and doesn't allow access - this is correct. But when I move public IP to the second node these locks are lost and it is possible to access the

Hi, I've created a bridge using 2 interfaces and have a lot of messages as follows: nov 12 15:30:22 localhost kernel: br0: received packet on enp0s3 with own address as source address nov 12 15:30:22 localhost kernel: br0: received packet on enp0s3 with own address as source address And the operating systems is extremely slow Interfaces files : [root at localhost ~]# cat

In the help for rpart it says, "This differs from the tree function mainly in its handling of surrogate variables." And it says that an rpart object is a superset of a tree object. Both cite Brieman et al. 1984. Both call external code which looks like martian poetry to me. I've seen posts in the archives where BDR, and other knowledgeable folks, have said that rpart() is to be

------------[ cut here ]------------ kernel BUG at fs/ext3/fsync.c:50! invalid operand: 0000 [#1] CPU: 0 EIP: 0060:[<b0187d38>] Not tainted VLI EFLAGS: 00010296 (2.6.13.1) EIP is at ext3_sync_file+0x58/0xf0 eax: 00000068 ebx: bf4a479c ecx: b03cffac edx: b03cffac esi: b0398cfc edi: b2b8f1c8 ebp: c13bcf60 esp: c13bcf18 ds: 007b es: 007b ss: 0068 Process aptitude

Hello, My hoster updated its kernel packages... It contained some old problems that should have been fixed. My servers have now a wonderful 2.6.21.5 kernel + grsec running. Both are running Debian 4.0 (stable release). mx:/etc/shorewall# iptables --version iptables v1.3.6 mx:/etc/shorewall# uname -a Linux mx.network-hosting.com 2.6.21.5-grsec-xxxx-grs-ipv4-32 #1 SMP Fri Jul 27 17:18:23 CEST