[vserver] Debungging martian packets

From: Raphael Bauduin <rblists_at_gmail.com>
Date: Tue 02 Jul 2013 - 14:12:24 BST
Message-ID: <CAONrwUEud-2M66FH5EBoPY3gXPdeiB1cXoEuKJOeybYiTKyevw@mail.gmail.com>


I am running vservers for years, and I had to migrate them from one
physical server to another.
I have a setup with a dummy interface (which I just read in the ML archive
is discouraged...).
I have replicated the setup, but I see martian packets on the public
interface, the destination of which being the private IP ( of
one of the vservers (activng as a reverse http proxy to other vservers):

[1563573.536936] martian source from $PUBLIC, on dev eth0
[1563573.536939] ll header: e8:40:f2:0a:e9:4e:6c:9c:ed:bb:6f:80:08:00

e8:40:f2:0a:e9:4e is the MAC address of the public interface
My understanding is that 6c:9c:ed:bb:6f:80 is the MAC address of the last
hop before the server, and that this is an IPv4 packet .

*After* seeing the problem and reading the mailing list archive, I have set
arp_ignore to 1 on all interfaces and arp_announce to 2 on the public

When I shutdown the vserver I saw these message, I didn't see the martian
packets anymore, but had this:

arpwatch: ethernet mismatch 6c:9c:ed:bb:bd:80
(00:07:b4:00:00:01) eth0

Do you have any suggestion as to what I can do to debug this?
tcpdump does not give more info (I guess the packet is dropped before
tcpdump sees it), relaxing the rp_filter (to 0) setting didn't change this.

# uname -a
Linux 2.6.32-5-vserver-amd64 #1 SMP Fri May 10 10:52:10 UTC 2013 x86_64

Thanks in advance!

Received on Tue Jul 2 14:12:35 2013

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Tue 02 Jul 2013 - 14:12:35 BST by hypermail 2.1.8