ZyXEL Communications ZYWALL USG 20 Manual page 756

Appendix A Log Descriptions
Table 244 ADP Logs
LOG MESSAGE
from <zone> to <zone>
[type=<type>] <message>
, Action: <action>,
Severity: <severity>
Enable ADP succeeded.
Disable ADP succeeded.
ADP rule <num> has been
deleted.
ADP rule <num> has been
moved to <num>.
New ADP rule has been
appended.
ADP rule <num> has been
inserted.
ADP rule <num> has been
modified.
ADP profile <name> has
been deleted.
ADP profile <name> has
been changed to <name>.
ADP profile <name> has
been created.
ADP profile <name> has
been modified.
Packet payload length
is over the maximum
system handle length
LAND attack packet.
Source IP is the same
as Destination IP.
756
DESCRIPTION
The ZyWALL detected an anomaly in traffic traveling
between the specified zones.
The <type> = {scan-detection(<attack>) | flood-
detection(<attack>) | http-inspection(<attack>) | tcp-
decoder(<attack>)}.
The <message> gives details about the attack, although the
message is dropped if the log is more than 128 characters.
The <action> is what the ZyWALL did with the packet.
The <severity> is the threat level (very low, low, medium,
high, or severe).
ADP was turned on.
ADP was turned off.
The specified ADP rule has been deleted.
The ADP rule with the specified index number (first num)
was moved to the specified index number (second num).
An ADP rule has been added to the end of the list.
An ADP rule has been inserted. <num> is the number of the
new rule.
The ADP rule of the specified number has been changed.
The ADP rule with the specified name has been removed.
An ADP rule's name has been changed from first <name> to
the second <name>.
An ADP profile with the specified name has been added.
The ADP rule with the specified name has been changed.
The ZyWALL's ADP feature detected a packet with a length
over 16000 bytes.
The ZyWALL's ADP feature detected traffic with the same IP
address set as both the source and the destination.
ZyWALL USG 20/20W User's Guide