28 Oct
2022
28 Oct
'22
1:47 a.m.
Quoting Charles Polisher (chas(a)chasmo.org):
On 10/25/22 02:27, Gary wrote:
Hear, hear!
To clarify, for those who are unclear on the concept, a "Martian packet"
in this context is one that should never legitimately appear on the
public Internet (unless tunnelled), because it contains a source or
destination address that is reserved for special use by IANA. The
classic example is all IPs in RFC1918 RFC 5735, and RFC 6598. A
metacategory of "bogon IP" adds to that IPs from netblocks not yet
allocated by IANA or the Regional Internet Registries (ARIN, RIPE,
APNIC, etc.).
(Bogons = Martians + unallocated.)
Receiving a Martian / bogon packet means either the originating
equipment is badly malfunctioning / misconfigured _or_ someone is up to
no good.
https://www.team-cymru.com/bogon-reference
https://www.cyberciti.biz/faq/linux-log-suspicious-martian-packets-un-routa…
Looking at things geometrically is a nice idea.
It brings home to me the fact that there is a lot of ip-space out there that I should just
exclude.
Martians. You should exclude martians. Here's a starter set: