I have just noticed that this signature has fired for 2 of our different clients but with the same source/ destination IP's. I would normally assume that this is either impossible or very strange.
I think that might be where the name of the signature comes from anyway?
In each case all IP addresses reported, were 0.1.0.4.
Is this a generic address that simply represents an internal unknown device?
Does the signature need tweaking on the sensor? How are we meant to advise the client of where this activity comes from?
And finally, does it require a TAC case to request an update from Cisco?
It slightly concerns me that this signature has an impact rating of high, and we've not noticed this before, and every instance has been ignored (not filtered, etc).
Any help would be appreciated.