I have logging enabled on specific iptables packet drops. The rules I'm using are IP/port related only and this is what I can easily see in the logs, however occasionally I do get MAC address information logged as well. Like:
"....OUT=eth1 IN= MAC=00:26:a9:7b:c9:30:00:17:0f:ac:6a:80:08:00"...
These mac-addresses related logs are sporadic.
What I have noticed:
- these dropped/mac-logged communication are always inbound
- the source mac-address logged is the one of my default-gateway (Service Provider), although the source IPs are different.
- the destination mac (obvious but just to confirm) is the one of my interface
What I'm trying to understand:
- what is the iptables logic when deciding to capture in the logs "MAC addresses + IP/port" instead of "IP/port" only.
The MAC information is only logged for devices on your local network. It is actually a hex dump of the ethernet MAC header and consists of the source MAC address (00:26:a9:7b:c9:30), destination MAC address (00:17:0f:ac:6a:80) and ethernet frame type (08:00).