topic Re: CSA: Event whose source address is 0.0.0.0 in Network Security

CSA: Event whose source address is 0.0.0.0

lcuchisanmillan — Sun, 10 Mar 2019 10:24:07 GMT

Has anyone an event whose source is 0.0.0.0 generated by an CSA 5.1?

Thank in advance and Merry Christmas,

Cristina

Re: CSA: Event whose source address is 0.0.0.0

attmidsteam — Sat, 30 Dec 2006 18:29:27 GMT

This is a repeated event that has the summary key set. You can modify this by altering how that signature summarizes (i.e. source and destination and source port and destination port)

Hope this helps and Happy New Year 🙂

Re: CSA: Event whose source address is 0.0.0.0

lcuchisanmillan — Mon, 08 Jan 2007 09:33:35 GMT

Could you be more precise? Could you explain me how to do this?

Thank you,

Cristina

Re: CSA: Event whose source address is 0.0.0.0

attmidsteam — Wed, 10 Jan 2007 15:07:06 GMT

In the Ciscoworks VMS IDS MC, click configuration->settings->sensor or group->5.x

Find your signature by id, select it, click tune, check override, scroll down to alert frequency->summary mode. If it is already set to summarize, change the summary key to 'attacker & victim addresses' for AxBx. This will avoid getting a 0.0.0.0 address for source or destination.

Re: CSA: Event whose source address is 0.0.0.0

lcuchisanmillan — Tue, 23 Jan 2007 09:26:52 GMT

I am working with CSA 5.1 no IDS 5.1(4)

Re: CSA: Event whose source address is 0.0.0.0

tsteger1 — Tue, 23 Jan 2007 18:44:53 GMT

What is the event and port?

The machine may be trying to connect to itself.

I would look at other alerts on the machine(s) getting this message and see what else might be happening.

Tom