OS 13.1: Martian Source problem in a pure IPv4 lan

Hi there,

In my network I am using the private subnet 192.168.2.0/24

On my Linux Gateway/Proxy etc. I find a lot of entries in the System log which all have this here in common:
Martian Source 192.168.0.255 from 192.168.0.20 on dev enp5s12
II header : my PC’s nic

This is very strange as

  1. I don’t use 192.168.0.0/24 at all.
  2. It was send from my pc (MAC address) but the setup looks ok.
  3. Is use on my PC Linux with a VirtualBox with Windows 7 but also configured for 192.168.2.0/24 and the virtual Mac address is different

The density of the “martian attacks” is about 2-3 “attacks” per second, which makes the system log look a bit overloaded.
After changing from OS 12.3 which only ran for a few days to 13.1 I had recently a crash of the at this time fully functional teamviewer and google earth. I can’t run both programs any longer and even a reinstall did not help. Could this be related to the martian story ?

Any ideas what’s wrong there and how I could fix this problem ?

TIA for any hints/ideas, Joe

Update info:

Had the idea to switch in Yast->Network Settings from Network Manager to ifup … and from this moment on I had no more martian sources …
After around 10 minutes without any martian attacks I switched back to Network Mangager and the Martians came back in the same second.

Have compared both setups, have even changed the Network Manager setup in the hope, that whatever is wrong in its setup, it would be repaired by chance if I change something … nada, nix, nothing.

So obviously my Network Manager suffers from DID (Dissociative identity disorder); it lives in 2 different worlds/networks 192.168.2.0/24 (the real world) and in 192.168.0.0/24 (the wrong one,Network managers imagination somewhere on Mars I guess ;))

So have you guys any idea how I can treat my Network Manager and heal it from being DIDI ? :slight_smile:

In general I prefer the network manager over that flup thing, as it has a usable gui.

TIA, Joe

Hi Joe,

192.168.0.255 looks like a broadcast address.
What happens if you try to ping to the address 192.168.0.20? It has to be in use somewhere in your network/setup.

Can you post the output of the ping command here?

Start with showing output of “ip addr list” when NM is active.

I use NM and do not have multiple networks.

arvidjaar,

the result ist as follows:

ip addr list with Network Manager:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 30:85:a9:90:d9:b8 brd ff:ff:ff:ff:ff:ff
inet 192.168.2.21/24 brd 192.168.2.255 scope global eth0
valid_lft forever preferred_lft forever
inet 192.168.0.20/24 brd 192.168.0.255 scope global eth0
valid_lft forever preferred_lft forever

ip addr list without Network Manager:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 brd 127.255.255.255 scope host lo
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 30:85:a9:90:d9:b8 brd ff:ff:ff:ff:ff:ff
inet 192.168.2.27/24 brd 192.168.2.255 scope global eth0
valid_lft forever preferred_lft forever

joopberis,

the ping results in:

ping 192.168.0.20
PING 192.168.0.20 (192.168.0.20) 56(84) bytes of data.
64 bytes from 192.168.0.20: icmp_seq=1 ttl=64 time=0.043 ms
64 bytes from 192.168.0.20: icmp_seq=2 ttl=64 time=0.045 ms
64 bytes from 192.168.0.20: icmp_seq=3 ttl=64 time=0.034 ms
64 bytes from 192.168.0.20: icmp_seq=4 ttl=64 time=0.032 ms
64 bytes from 192.168.0.20: icmp_seq=5 ttl=64 time=0.032 ms
^C
— 192.168.0.20 ping statistics —
5 packets transmitted, 5 received, 0% packet loss, time 3999ms
rtt min/avg/max/mdev = 0.032/0.037/0.045/0.006 ms

Without Network Manager ping did not work, got no response.

Cheers, Joe

So Networkmanager apparrently assigns the address 192.168.0.20 and an address in the 192.168.2.0 range (probably from DHCP) to your eth0 interface.

Can you open Networkmanager, go to the wired tab and click on edit?
Then, click on Basic Settings button and select additional addresses from the pull down menu. Is 192.168.0.20 listed there?

joopberis,

100 points !!! There was indeed a 2. address listed, though I have no idea where it came from. Mhhhh, could have been eventually my son playing on my pc … I deleted this entry and the martian invasion was banned ! :good:lol!

Thanks a lot !

Cheers Joe

Glad to hear it was resolved. Time to get junior his own account and no access to the root password. :wink:
Fortunately your machine has been saved from the Martians. :slight_smile:

If you don’t mind, please click the star at the bottom of this post. Thanks :good:

Hi,

found out how this ip number got set:

I first have to apologise for false accusation to my son. It was me who has set that ip number.

BUT the circumstances are remarkable:

If one sets in Network manager the mode under IPv4 Address to “Manual”, writes there an IP address and switches afterwards to mode “Automatic (DHCP)”, the entered ip address is kept (good), get’s hidden and** stays active (not good as not obvious) **!

This is how a martian invasion can be created !

Cheers , Joe