Quoting Charles Polisher (chas@chasmo.org):
On 10/25/22 02:27, Gary wrote:
Looking at things geometrically is a nice idea. It brings home to me the fact that there is a lot of ip-space out there that I should just exclude.
Martians. You should exclude martians. Here's a starter set:
Hear, hear!
To clarify, for those who are unclear on the concept, a "Martian packet" in this context is one that should never legitimately appear on the public Internet (unless tunnelled), because it contains a source or destination address that is reserved for special use by IANA. The classic example is all IPs in RFC1918 RFC 5735, and RFC 6598. A metacategory of "bogon IP" adds to that IPs from netblocks not yet allocated by IANA or the Regional Internet Registries (ARIN, RIPE, APNIC, etc.).
(Bogons = Martians + unallocated.)
Receiving a Martian / bogon packet means either the originating equipment is badly malfunctioning / misconfigured _or_ someone is up to no good.
https://www.team-cymru.com/bogon-reference https://www.cyberciti.biz/faq/linux-log-suspicious-martian-packets-un-routab...