I believe I've achieved a table that routes packets from and to eth1/192.168.3.x through, and packets from and to eth0/192.168.1.x through (helpful source).

Question: when doing tracepath from (from within vserver), I'm getting kernel: [318535.927489] martian source from, on dev eth0 at or near the target IP, while intermediary hops go without (log below).

I don't understand why this packet is arriving on eth0, instead of eth1, even after reading this:

Note that you may see packets from non-routable IP addresses when running the traceroute or tracepath commands. While packets cannot be routed to these routers, packets sent between 2 routers only need to know the address of the next hop within the local networks, which could be a non-routable address.

Can someone explain that paragraph in human language? Based on short initial trials so far, everything else seems to work without causing martians. Is this contained to the nature of tracepath operation or do I have some other bigger routing problem that will cause work traffic breakage?

Side note: is it possible to inspect martian packet with tcpdump or wireshark or anything of the sort? I'm have not been able to get it to show up on my own.

vserver-20 / # tracepath -n
 1:                                           0.064ms pmtu 1500
 1:                                           1.076ms
 1:                                           1.259ms
 2:                                            1.908ms
 3:                                        2.595ms
 4:                                        2.136ms asymm  5
 5:                                        2.266ms asymm  6
 6:                                         2.390ms asymm  7
 7:  no reply
 8:  no reply
 9:  no reply

Host routing:

$ sudo ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet scope host lo
2: sit0: <NOARP> mtu 1480 qdisc noop state DOWN 
    link/sit brd
3: eth0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:24:1d:de:b3:5d brd ff:ff:ff:ff:ff:ff
    inet scope global eth0
4: eth1: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:0c:46:46:a3:6a brd ff:ff:ff:ff:ff:ff
    inet scope global eth1
    inet brd scope global secondary eth1  # linux-vserver instance

$ sudo ip route
default via dev eth0  metric 3 
unreachable  scope host dev eth0  proto kernel  scope link  src dev eth1  proto kernel  scope link  src

$ sudo ip rule
0:      from all lookup local 
32764:  from all to lookup dmz 
32765:  from lookup dmz 
32766:  from all lookup main 
32767:  from all lookup default

$ sudo ip route show table dmz
default via dev eth1  metric 4 dev eth1  scope link  metric 4

Gateway routing

# ip route dev tun0  proto kernel  scope link  src via dev tun0 dev br-dmz  proto kernel  scope link  src dev br-lan  proto kernel  scope link  src 
$ISP_NET/23 dev eth0.1  proto kernel  scope link  src $WAN_IP 
default via $ISP_GW dev eth0.1

Additional background

Options for non-virtualized network interface isolation?

3 Answers 3


If you receive the martian packet, wireshark should be able to show it.

I also see you've disabled loopback by setting an unreachable route for This isn't standards-compliant, and probably isn't that useful to do, but I doubt it has much to do with this problem.

The documentation paragraph simply means that you're likely to see RFC1918 addresses or other unreachable things in the traceroute since these addresses can be used between routers in many cases (eg. within one AS), but will be the address the router gives when the packet exceeds its TTL there. It doesn't mean you should expect martians. I also doubt it has anything to do with this particular packet.

The martian packet may have nothing to do with the traceroute. However, it might. It's often caused by a gateway not doing source nat when it ought to be, but it's also possible that you have a broken NAT rule somewhere translating the destination address of packets outbound from eth1 toward the IP of eth0. This seems most likely given the source of the packet. It also might mean that you're forgetting to do source NAT on outbound packets of yours at your gateway.

You should run a wireshark capture on eth1 and eth0 both, and try and find the packet in eth0 and see if you can correlate it with one from eth1. Also check your NAT rules.

  • Thanks for the insight. Since openrc -> systemd migration I've not managed to replicate the exact setup yet, but will be getting to it.
    – lkraav
    Mar 25, 2014 at 9:47

I believe that the "problem" is that both your interfaces are connected to the same network. At some point you're getting packets with source IP on your eth0 interface which causes the log_martians config entry to come in actino.

I'm pretty sure that you have rp_filter enabled and that this will go away if you disable it (e.g. /proc/sys/net/ipv4/conf/all/rp_filter), but read bellow:

This can be because of two reasons:

  1. You're receiving legitimate packets from your own network from this (i.e. the wrong) interface. In your case, in theory, all packets for subnet should be arriving in eth1 unless you have multipath routing, in which case you need to disable rp_filter.
  2. During your tracepath one of the intermediate links uses IP addresses from the subnet I.e. imagine that one of the intermediate ISPs between you and the destination uses IP addresses from that subnet on its routers. Because of the way traceroute works you'll be receiving ICMP TTL EXCEEDED packets with that source IP (since the router will be sending them). And since your default route is via eth0, the kernel will complain (because it's expecting everything from to arrive in eth1 - because of rp_filter).

There are multiple ways to troubleshoot this and yes you can tcpdump on that (e.g. tcpdump -ni eth0 'host').


I can answer your intermediate question. I have an /29 from which I route each /32 independently:

ip route add via

This way, I can use all eight /32 instead of losing one for the broadcast address and the other for the router interface on that subnet.

As for the wrong interface; can you show your NAT rules? Thank would be:

iptables -vnL -t nat

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .