This would appear to be the Global Summary feature new in 3.0.
When the sensor starts seeing too many of one type of alarm it will go into a Global Summary mode, in which case it reports the addresses as all 0s as it's way of letting you know that it is happening for many different address combinations.
Check the details field and you should see the phrase Global Summary with a listing of how many alarms of that type the sensor is seeing.
According to the parameters listed by SigWizMenu it would go from Summary to Global Summary mode when the number of alarms reaches 200 (2 times the ChokeTheshold of 100) within 30 seconds (the Throttle Interval).
You change any of the above parameters for this signature using the SigWizMenu program, for example you could change the mode from Summary to FireOnce.
If the alarm is not a Global Summary mode alarm then we will have to investigate further.
If you believe the alarm is incorrectly going into Global Summary mode then we would need to investigate further.
To investigate we would need the log file entries for the alarm with the 0.0.0.0 ips and all other 2100 alarms prior to that alarm, and I would recommend opening a TAC case to track it and be able to send the files to the engineers without having to post them to this forum.
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...