We have a /28 block from our ISP. Let's say 220.127.116.11/28 with a gateway of 18.104.22.168. We are getting martian packets from another customer over at 22.214.171.124. They are sending broadcasts to 126.96.36.199. Should we be getting those packets? I don't understand broadcasting in this scenario.
martian source 188.8.131.52 from 184.108.40.206, on dev eth0 ll header: ff:ff:ff:ff:ff:ff:00:XX:f3:XX:69:ad:08:00
$ ifconfig eth0 eth0 Link encap:Ethernet HWaddr XX:XX:XX:XX:XX:XX inet addr:220.127.116.11 Bcast:18.104.22.168 Mask:255.255.255.240 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:15161982 errors:0 dropped:0 overruns:0 frame:0 TX packets:1627243 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:1028191733 (1.0 GB) TX bytes:140279903 (140.2 MB) Memory:fbde0000-fbe00000
Or maybe the interface is misconfigured? The Bcast is listed there as 22.214.171.124. If this is normal behavior I don't think the kernel should be spewing hundreds of these to syslog every minute.
These packets are constantly coming in 2-3 per second. I have captured them and they UDP src/dst port 15001: 10:00:91:13:00:00:39:22:23:02:00:00:00:00:00:01:3c:62:65:61:63:6f:6e:2f:3e