IBM Support

QRadar: Enabling LAN over USB for firmware updates can generate martian events

Troubleshooting


Problem

Leaving LAN over USB interface (usb0) feature enabled after firmware updates results in martian packets being repeatedly sent to the logs.

Symptom

Messages log spammed with "martian source x.x.x.x" from an interface with a "u" in it. The interface enp0s20u1u5 is a common source to see these packets from. The "u" signifies the USB interface (usb0).

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000CbVWAA0","label":"ATS-Infrasec"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Log InLog in to view more of this document

This document has the abstract of a technical article that is available to authorized users once you have logged on. Please use Log in button above to access the full document. After log in, if you do not have the right authorization for this document, there will be instructions on what to do next.

Document Information

Modified date:
03 May 2023

UID

ibm16983444