Applying Custom Signatures - ZyXEL Communications ZyWall ATP series User Manual

Chapter 30 IDP
From the details about DNS query you see that the protocol is UDP and the port is 53. The type of DNS
packet is standard query and the Flag is 0x0100 with an offset of 2. Therefore enter |010| as the first
pattern.
The final custom signature should look like as shown in the following figure.
Figure 359 Example Custom Signature

30.3.3 Applying Custom Signatures

After you create your custom signature, it becomes available in an IDP profile (Configuration > Security
Service > IDP > Profile > Edit) screen. Custom signatures have an SID from 9000000 to 9999999.
Search for, then activate the signature, configure what action to take when a packet matches it and if
it should generate a log or alert in a profile. Then bind the profile to a zone.
ZyWALL ATP Series User's Guide
550