Re: Source Host 0.0.0.0

[Dante () WEBCTI COM (Dante Mercurio)]

Source 0.0.0.0 usually a BOOTP or DHCP request. Is it coming from the inside
or outside of your firewall? If it is on the inside, then is may be a print
server or something requesting an IP address with no one answering.
-Dante

-----Original Message-----
From: Frederic Ple [mailto:frederic.ple () MAIL DOTCOM FR]
Sent: Tuesday, January 04, 2000 3:11 AM
To: INCIDENTS () SECURITYFOCUS COM
Subject: Re: Source Host 0.0.0.0

> I am seeing alot of synfloods occuring from source ip
> 0.0.0.0 from my intrusion detection system.

Same for me.
My ISS Realsecure show me it happens especially between proxy servers and
internet web servers.
I have to check that