[GRLUG] Rogue packet triggering reboot!

[Michael Mol]

On Monday, October 17, 2016 04:54:56 PM Adam Tauno Williams wrote:
> On Mon, 2016-10-17 at 14:52 -0500, L. V. Lammert wrote:
> > This SEEMS to indicate that a packet received on a public IF that has
> > no open ports triggered a reboot:
> > Oct 14 17:31:36 <machine> kernel: IPv4: martian source 206.197.251.9
> > from 60.24.136.201, on dev br3
> > Oct 14 17:31:36 <machine> kernel: ll header: 00000000: 00 e0 81 cd 21
> > b1 00 b0 c2 88 54 1c 08 00        ....!.....T...
> > Oct 14 17:31:44 <machine> systemd[1]: Received SIGINT.
> > <reboot in process>
> 
> A full EIGHT SECONDS later?  I would not automatically correlate these
> two events.
> 
> If the interface has no open ports why not discard all inbound traffic?

The "martian source" refers to a routing error.

Perhaps br3 is only for VMs, and has an interface on the VM host for routing 
guest traffic out? A VM guest may be originating traffic using one of his public 
IPs for a source address. Possibly as part of a NAT punching technique? Or 
perhaps he assigned the public IP to the guest without informing the host that 
that particular IP could be found there?

Oh, hey, looking up the WHOIS, now I know his first name! :P

-- 
:wq
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 455 bytes
Desc: This is a digitally signed message part.
URL: <http://shinobu.grlug.org/pipermail/grlug/attachments/20161017/edfbabea/attachment-0001.sig>