ZyXEL Communications ZyWall USG 2000 User Manual page 515

Chapter 31 IDP
Next, check the content of the SMB header. Add |FF|SMB% and
'TransactionNmPipe' to the signature as the next patterns.
Figure 361 Custom Signature Example Pattern 2
Figure 362 Custom Signature Example Patterns 3 and 4
The final custom signature should look like as shown in the following figure.
515
ZyWALL USG 2000 User's Guide