Martian packets - type ARP - UCS Server - CentOS

SamUrai · ‎09-23-2021

Hello,

We recently enabled "martian" packet tracing on CentOS 7.9 running on UCS servers C240M4 (UCSM Integrated). Since then we have been seeing martian packets messages in "dmesg" occurring very frequently. The IP frame data revels that those are ARP packets ( 08 06 ). We do suspect that there is something not right on the network side. The IPs being reported are different.

[Thu Sep 23 08:57:35 2021] IPv4: martian source <IP> from <IP>, on dev bridge-fe-2
[Thu Sep 23 08:57:35 2021] ll header: 00000000: ff ff ff ff ff ff xx xx xx xx xx xx 08 06        .........62A..
[Thu Sep 23 08:57:35 2021] IPv4: martian source <IP> from <IP>, on dev bridge-be-2
[Thu Sep 23 08:57:35 2021] ll header: 00000000: ff ff ff ff ff ff xx xx xx xx xx xx 08 06        .........6.A..
[Thu Sep 23 08:57:35 2021] IPv4: martian source <IP> from <IP>, on dev bridge-3001-2
[Thu Sep 23 08:57:35 2021] ll header: 00000000: ff ff ff ff ff ff xx xx xx xx xx xx 08 06        ........D..@..
[Thu Sep 23 08:57:36 2021] IPv4: martian source <IP> from <IP>, on dev bridge-fe-1
[Thu Sep 23 08:57:36 2021] ll header: 00000000: ff ff ff ff ff ff xx         .xx xx xx xx xx 08 06........62A..
[Thu Sep 23 08:57:36 2021] IPv4: martian source <IP> from <IP>, on dev bridge-3001-1
[Thu Sep 23 08:57:36 2021] ll header: 00000000: ff ff ff ff ff ff xx xx xx xx xx xx 08 06        .........62A..

Does anyone know a possible cause of these messages?

Thanks

Kirk J · ‎09-27-2021

Do any of the source MACs match any VMs you've configured in your environment?

Having a guestVM attached to the wrong port group could trigger this pretty easily I think (IP and subnet don't match intended vlan).

Kirk...

SamUrai · ‎10-07-2021

Yes the IPs are configured in our environment. The VMs are in the correct VLAN AFAIK and have proper subnet mask configured. The "martian" probe is setup to monitor all interfaces on the host which includes "vnet" VM interfaces which are on the linux bridge configured. I think this maybe a cause of the problem as the ping response of the VMs seem suffer.. pkt loss and high RTA time. Disabled the probe, the problem is gone.