IPS sensor event reporting showing source ip 10.5.5.5 victim ip 0.0.0.0- does 0.0.0.0 mean a broadcast?

[cminton_ERS]

We have a internal node  in the environment and  our IPS is catching in the event logs stating it is sending traffic to victim ip 0.0.0.0.  I am assuming that 0.0.0.0 means a broadcast, is this correct?

[rhermes · Accepted solution]

No, 0.0.0.0 is used as a summary address. If the signature was a port scan for example, the victim IP addresses may be too numerous to list, so Cisco uses the 0.0.0.0 address to indicate that is has summarized multiple addresses into that field.

- Bob

[cminton_ERS]

awesome thx!