Trivial Linux (segunda edición) - Pregunta 6. Detección de marcianos llegando a nuestra máquina

La pregunta era ¿Como podemos habilitar un filtro para que los marcianos no entren a través de la red? y no me había fumado nada :D En las respuestas averiguamos que son los marcianos y como podemos habilitar un filtro para evitarlos.

Respuestas

---

El filtro se conseguía de la siguiente forma echo 1 > /proc/sys/net/ipv4/conf/ethX/rp_filter Y para que queden "retratados": echo 1 > /proc/sys/net/ipv4/conf/ethX/log_martians En debian basta definir a yes la variable spoofprotect en el archivo /etc/network/options La gente muy perezosa a la hora de traducir y no tanto a la hora de hacer copiar y pegar :)
http://foldoc.linuxguruz.org/foldoc.php?Martian---Packets∞ that turn up unexpectedly on the wrong network because of bogus routing entries. Also a packet which has an altogether bogus (non-registered or ill-formed) internet address, such as the test loopback interface [127.0.0.1]. Such a packet will come back labelled with a source address that is clearly not of this earth. "The domain server is getting lots of packets from Mars. Does that gateway have a martian filter?"

http://lists.suse.com/archive/suse-security/2000-Feb/0012.html---A∞ martian packet comes from a bogus IP address, i.e. one "not of this world". For example, there are some blocks of IP addresses that are reserved for systems not connected to the Internet (e.g. 10.0.0.0). If a machine is claiming to use such an address and can find a router that is willing to believe it, the result would be a martian packet.

http://www.tuxedo.org/~esr/jargon/html/entry/martian.html---A∞ packet sent on a TCP/IP network with a source address of the test loopback interface [127.0.0.1]. This means that it will come back labeled with a source address that is clearly not of this earth. "The domain server is getting lots of packets from Mars. Does that gateway have a martian filter?"

http://www.averillpark.net/OpenBSD/FW-HowTo.html---(the∞ martians list really should include the test network, 192.0.2.0/24 as well, but in our example, we're pretending it's globally routed space) 192.168.0.0/16, 172.16.0.0/12, and 10.0.0.0/8 are RFC 1918 private space. 127.0.0.0/8, 169.254.0.0/16, 240.0.0.0/4, 192.0.2.0/24, and 0.0.0.0/32 are special use space.
martians="{ 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, 240.0.0.0/4, 0.0.0.0/32 }"