According to This Knowledge Base Article, the source IP being 0.0.0.0 is intended. Please read the KB for additional details.
Technical Support Engineer
McAfee. Part of Intel Security.
Please can you give me more details about this, and how can I modifie the filter to obtain the original IP address.