IDS: Network attack with Source IP 0.0.0.0

[avilt]

Hi,

I am getting large number of attacks in my IDS logs with the source IP 0.0.0.0

These are not broadcast signatures like DHCP or Netbios. How can I track the real source of this attack?

[hemendoz]

Would this work for you? Configure Policy Based Routing and route all source 0.0.0.0 packets to Null0 and log-input. Then do some investigative work to track the source.