Hi CHO, These event are normal and generate by the ACE module from NS 7.0.
When several events comes up during the 'ACE.deltatime' from several source to the same destination IP and port. It seems that the attacker use spoofed IP. So ACE change the source IP to 0.0.0.0. Hope this help. Note : Depending how fast is your network you must tune your ACE.deltatime, see Advance Parameter Guide from NS 7.0 product documentation. Ben. ======== Internet Security Systems ========= Benjamin MARANDEL Senior Software Engineer 84, Av. du General Leclerc 92100 Boulogne FRANCE http://www.iss.net +33 (0) 1 55.38.00.88 http://xforce.iss.net ========== The Power to Protect ============ -----Message d'origine----- De�: CHO [mailto:[EMAIL PROTECTED] Envoy�: lundi 31 mars 2003 15:42 ��: [EMAIL PROTECTED] Objet�: [ISSForum] source 0.0.0.0 I am getting a lot of events comming from IP-Adress 0.0.0.0 Various events.... What can that be ? Is somebody in��here, try to crack the hell out of our net??? or is it just normal?? How can it appear in normal traffic? CHO-Chief Hacking Officer Wir ertrinken in Information, aber hungern nach WISSEN! Gesendet von http://mail.yahoo.de. Das DiBa-Tagesgeldkonto: 3,5% Zinsen ab dem ersten Euro + Tankgutschein nur noch bis 31.03. Lassen Sie Ihr Geld arbeiten! Bei t�glicher Verf�gbarkeit und kostenloser Kontof�hrung. _______________________________________________ ISSForum mailing list [EMAIL PROTECTED] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo
