14

Most of the time when I perform any search on hardening of a linux box etc, in the list there is always a section of log of Martian packet(IP) without any further explanation.

net.ipv4.conf.all.log_martians =1
net.ipv4.icmp_ignore_bogus_error_responses =1

I have done some googling but it doesn't look like martians packets are source of attack or so. Can anyone shed the light ?

Thank you

16

A martian packet is a packet with a source address which is obviously wrong - nothing could possibly be routed back to that address.

An example would be if a packet on the public internet was discovered having a source address of 192.168.0.1 - an address belonging to one of the IANA reserved private address spaces. Another example could be a packet having a source address of 192.168.0.1 on a private network only utilizing the 10.0.0.0/8 private address space.

As such a packet is a waste of processing power and bandwidth wherever it appears, blocking it as early on as possible in a network could be considered a beneficial practice.

With regards to attacks, a martian packet says little about what an attack payload would be, beyond it consuming bandwidth and processing resources. However the source machine would be challenging to trace as the actual source address is not present (making martians an ideal complement to DOS/DDOS, assuming the packet is not discarded early on in the network path).

Misconfiguration or uncustomized default configurations are likely sources of martians.

I have great difficulty motivating why filtering martians would be a bad idea. As for logging it could be good at least for finding those not entirely uncommon misconfigurations, but it would be something for each organisation to decide. Unnecessary log clutter is also consumptive and a nuisance too.

More info here.

  • 1
    +1 The only reason I can think to log martian packets is to tip off network admins that there's a mis-configured router somewhere. Ideally the log should always be empty. If it's not, something isn't configured correctly (something is allowing the packets through instead of discarding them early). If your network isn't carefully managed, there's no reason to waste disk IO logging these. – stevendesu Jun 11 '18 at 19:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.