> Source: [sk115101](https://support.checkpoint.com/results/sk/sk115101)

# sk115101 - "IPv4: martian source X.X.X.X from 0.0.0.0, on dev ethX" appears repeatedly in /var/log/messages file on Linux OS machine

| Property | Value |
|----------|-------|
| Solution ID | sk115101 |
| Date Created | 2016-12-22 |
| Last Modified | 2020-09-15 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- * */var/log/messages* file on Linux OS machine repeatedly shows:  

  `kernel: [timestamp] IPv4: martian source <Network_Broadcast_Address> from 0.0.0.0, on dev eth<X>`

  *Example*:

  ```
  
  Dec 13 18:31:54 MyMachine kernel: [8320247.503965] IPv4: martian source 172.16.11.0 from 0.0.0.0, on dev eth0
  Dec 13 18:31:54 MyMachine kernel: [8320247.504014] ll header: 00000000: ff ff ff ff ff ff 00 00 00 00 96 01 08 00
  Dec 13 18:31:54 MyMachine kernel: [8320247.504052] IPv4: martian source 172.16.11.0 from 0.0.0.0, on dev eth0
  Dec 13 18:31:54 MyMachine kernel: [8320247.504093] ll header: 00000000: ff ff ff ff ff ff 00 00 00 00 96 01 08 00
  ```

* This Linux OS machine is connected to a Check Point cluster, on which CCP is configured in Broadcast mode per [sk20576](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk20576).

## Cause

When CCP on Check Point non-VSX cluster is configured in Broadcast mode per [sk20576](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk20576), the CCP packets are generated with the following addresses:

|-------------|-------------------|-----------------------------------|
| Address     | Source            | Destination                       |
| MAC Address | 00 00 00 00 XX YY | FF:FF:FF:FF:FF:FF                 |
| IP Address  | 0.0.0.0           | broadcast address for this subnet |

where:

* "XX" = 5th byte of CCP source MAC address = Value derived from `Cluster_Global_ID` / Value of `fwha_mac_magic`)
* "YY" = 6th byte of CCP source MAC address = `ID_of_Source_Member`

Explanation for the line "*IPv4: martian source 172.16.11.0 from 0.0.0.0, on dev eth0*":

* "`IPv4`" - IPv4 packet was received
* "`martian source`" - packet was received from a suspicious / unroutable source
* "`172.16.11.0`" - destination IP address of the received packet, which in this case is Broadcast
* "`from 0.0.0.0`" - source IP address of the received packet
* "`on dev eth0`" - packet was received on interface eth0

Explanation for the line "*ll header: 00000000: ff ff ff ff ff ff 00 00 00 00 96 01 08 00*":

* "`ll header`" - Link Layer (MAC Layer)
* "`ff ff ff ff ff ff`" - destination MAC address (Broadcast) of the received packet
* "`00 00 00 00 96 01`" - source MAC address of the received packet, where (refer to [sk25977](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk25977#Introduction - CCP addresses)):  
  * "`00 00 00 00`" - 1st, 2nd, 3rd, and 4th bytes of CCP source MAC address
  * "`96`" - 5th byte of CCP source MAC address = Value derived from `Cluster_Global_ID` / Value of `fwha_mac_magic`)
  * "`01`" (or "`00`") - 6th byte of CCP source MAC address = `ID_of_Source_Member`
* "`08 00`" - Ethernet frame

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content