Thanks for that.

Dont think its anything like a spoof attack..the message is coming up every min or so. Do you think it could just be a single host sending broadcasts?

thanks again.

What is the actual syslog message from asa, it shoudl provide more info and give more clues on what udp port. what is your topology, who is in DMZ and what is on the outside, is your outside still your trusted network, I ask because from your post outside interface connects to core switch?

In any case if you wanted to find out the actual source host on the DMZ you ccould use capture command along with an acl and capture pakets to get a mac address from the capture results.

Regards