CA PIM: About audit.cfg for TCP port 0

Document ID : KB000113409
Last Modified Date : 10/09/2018
Show Technical Document Details
Question:
We may see the following event for TCP port number 0. 
=====
<Date&Time> P TCP (Inbound) 0 408 3 Windows-box
=====

*Windows-box is host name.

Even if we set Windows-box into host-name field in audit.cfg file like this, it is not filtered.
==audit.cfg==
TCP;0;Windows-box;*;*;*
===========
Home come?
Environment:
Windows 
CA PIM12.8
Answer:
Yes, it is correct behavior.
For TCP port number 0:
We can set only wild card(*)  into host-name field in audit.cfg file.
Also, even if we set Windows-box* into host-name field in audit.cfg file, it is same as *.
So if we can set Windows-box into host-name field in audit.cfg file, the rule is not effective.