Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I keep getting these messages in /var/log/messages :

Mar  8 23:17:25 saas1 kernel: martian source from, on dev usb0
Mar  8 23:17:25 saas1 kernel: ll header: ff:ff:ff:ff:ff:ff:00:21:5e:de:1b:be:08:06

Over and over every 5 seconds there's another report exactly the same way.

I did a whois on and get a strange message back also:;q=

This is the "link local" block. It was set
aside for this special use in the Standards 
Track document, RFC 3927 and was further
documented in the Best Current Practice
RFC 5735, which can be found at:
It is allocated for communication between hosts 
on a single link. Hosts obtain these addresses 
by auto-configuration, such as when a DHCP 
server cannot be found.
A router MUST NOT forward a packet with an IPv4 
Link-Local source or destination address, 
irrespective of the router's default route configuration 
or routes obtained from dynamic routing protocols. 
A router which receives a packet with an IPv4 
Link-Local source or destination address MUST NOT 
forward the packet. This prevents forwarding of 
packets back onto the network segment from which 
they originated, or to any other segment.
share|improve this question

If a host on a network cannot obtain a network address via DHCP, an address from to may be assigned pseudorandomly. So it's an interface without connection to the internet. That is what ARIN is telling you. If someone tries to send something to this address, it is called a martian packet.

What is plugged into usb0?

share|improve this answer
I don't know what's plugged into USB0, it's on an offsite server. I might have to ask them what's going on with it. This was put together before I started working in my job but the guys there don't think that they were using a USB ethernet port. I might get one of the offsite guys to tell me what's physically plugged in. I can't figure it out with dmesg/lspci/lshw – edumike Mar 9 '11 at 22:20

You don't tell us what the IP address of USB0 is but I guess it's not in the link local subnet so packets arriving at usb0 from link local will be 'martian'. This is a widely quoted explantion

These are packets that Linux does not expect from the direction they came from (i.e. packets from internal hosts coming in on the external interface). The cause is probably a misconfigured machine on your LAN. You can turn off logging those packets via /proc/sys/net/ipv4/conf/interface/log_martians which is documented in /usr/src/linux/Documentation/proc.txt

share|improve this answer
So there's nothing else going wrong here? I'd rather I didn't get them at all be to honest, though I don't know what's causing them. – edumike Mar 9 '11 at 22:16
@edumike: There is likely something misconfigured on your network as it is sending packets to your machine when it shouldn't. You can try and track that machine down and fix it's configuration or you can just turn off logging as per pepoluan's answer. – Iain Mar 9 '11 at 22:22


You can turn off martian logging if you want:

echo 0 > /proc/sys/net/ipv4/conf/{all,default}/log_martians
share|improve this answer

I really would not turn off logging the martians: they typically are logged on production machines and this to protect against an aggression.

One hit every few seconds is probably a misconfigured machine, but on the day your server is attacked, you would have valuable info in the logs.

Best bet is, keep logging and look for a misconfigured machine if it is not too many machines to look at --it is likely to be a machine near.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.