Some comments found on the net stated these were MAC addresses, while it appears those was too short. More, i couldn't find something that look like that in our servers MAC addresses. The light came after installing Pike's http://modules.gotpike.org/module_info.html?module_id using http://modules.gotpike.org/docs/UsingMonger.html.
kernel: martian source 6827efd8 for f738d456, dev ppp0
It's now more clear that my router bothers about one of Google's IP (220.127.116.11) talking to my ppp0 IP (18.104.22.168) on the ppp0 interface. Now, i can make more tests using ip route get pointed out by redax on #pike:
$ pike Pike v7.6 release 86 running Hilfe v3.5 (Incremental Pike Frontend) > IP.v4.Address(0x6827efd8); (1) Result: IP.v4.Address("22.214.171.124") > IP.v4.Address(0xf738d456); (2) Result: IP.v4.Address("247.56.212.86")
Fixing this is a different story, but i can now name what's wrong.
# ip route get 247.56.212.86 from 126.96.36.199 iif ppp0 RTNETLINK answers: Invalid argument