ZyXEL Communications NXC5200 User Manual page 330

Chapter 21 IDP
21.7.2.2 Analyze Packets
Use the packet capture screen and a packet analyzer (also known as a network or
protocol analyzer) such as Wireshark or Ethereal to investigate some more.
Figure 146 DNS Query Packet Details
From the details about DNS query you see that the protocol is UDP and the port is
53. The type of DNS packet is standard query and the Flag is 0x0100 with an
offset of 2. Therefore enter |010| as the first pattern.
330
NXC5200 User's Guide