I keep getting these messages in /var/log/messages :
Mar 8 23:17:25 saas1 kernel: martian source 169.254.1.1 from 169.254.95.118, on dev usb0
Mar 8 23:17:25 saas1 kernel: ll header: ff:ff:ff:ff:ff:ff:00:21:5e:de:1b:be:08:06
Over and over every 5 seconds there's another report exactly the same way.
I did a whois on 169.254.95.118 and get a strange message back also:
http://whois.arin.net/rest/nets;q=169.254.95.118?showDetails=true&showARIN=false
This is the "link local" block. It was set
aside for this special use in the Standards
Track document, RFC 3927 and was further
documented in the Best Current Practice
RFC 5735, which can be found at:
http://www.rfc-editor.org/rfc/rfc3927.txt
http://www.rfc-editor.org/rfc/rfc5735.txt
It is allocated for communication between hosts
on a single link. Hosts obtain these addresses
by auto-configuration, such as when a DHCP
server cannot be found.
A router MUST NOT forward a packet with an IPv4
Link-Local source or destination address,
irrespective of the router's default route configuration
or routes obtained from dynamic routing protocols.
A router which receives a packet with an IPv4
Link-Local source or destination address MUST NOT
forward the packet. This prevents forwarding of
packets back onto the network segment from which
they originated, or to any other segment.
Best Answer
If a host on a network cannot obtain a network address via DHCP, an address from 169.254.1.0 to 169.254.254.255 may be assigned pseudorandomly. So it's an interface without connection to the internet. That is what ARIN is telling you. If someone tries to send something to this address, it is called a martian packet.
What is plugged into usb0?