On our user TAP interface (a TAP that collects user trafic only), we see 1000's of TCP flood events from 0.0.0.0 to 0.0.0.0 ; port 0 to port 0; Zone user to Zone user. It is always Session ID of 0. I have tried to do packet captures, but I never seem to get anything. It also doesn't show in session browser (probably because the session is 0!) Anyone else see this? Any idea what this is?
Solved! Go to Solution.