ZyXEL Communications ZyWALL 310 - 42.3.4 Signature Search

Chapter 42 IDP Commands
ZyWALL Series CLI Reference Guide
355
42.3.4 Signature Search
Use this command to search for signatures in the named profile.
Note: It is recommended you use the web configurator to search for signatures.
42.3.4.1 Search Parameter Tables
The following table displays the command line severity, platform and class type equivalent values. If you
want to combine platforms in a search, then add their respective numbers together. For example, to
search for signatures for Windows NT, Windows XP and Windows 2000 computers, then type “12” as the
platform parameter.
Table 196 Signature Search Command
COMMAND DESCRIPTION
idp search signature my_profile name
quoted_string sid SID severity severity_mask
platform platform_mask classtype classtype_mask
service service_mask activate {any | yes | no}
log {any | no | log | log-alert} action
action_mask
Searches for signature(s) in a profile by the
parameters specified. The quoted string is any
text within the signature name in quotes, for
example, [idp search LAN_IDP name "WORM"
sid 0 severity 0 platform 0 classtype 0 service 0
activate any log any action] searches for all
signatures in the LAN_IDP profile containing the
text “worm” within the signature name.
show idp search signature my_profile name
quoted_string sid SID severity severity_mask
platform platform_mask classtype classtype_mask
service service_mask activate {any | yes | no}
log {any | no | log | log-alert} action
action_mask
Searches for signature(s) in a profile by the
parameters specified. The quoted string is any
text within the signature name in quotes, for
example, [idp search LAN_IDP name "WORM"
sid 0 severity 0 platform 0 classtype 0 service 0
activate any log any action] searches for all
signatures in the LAN_IDP profile containing the
text “worm” within the signature name.
Table 197 Severity, Platform and Class Type Command Values
SEVERITY PLATFORM CLASS TYPE
1 = Very Low
2 = Low
3 = Medium
4 = High
5 = Severe
1 = All
2 = Win95/98
4 = WinNT
8 = WinXP/2000
16 = Linux
32 = FreeBSD
64 = Solaris
128 = SGI
256 = Other-Unix
512 = Network-Device
1 = DoS
2 = Buffer-Overflow
3 = Access-Control
4 = Scan
5 = Backdoor/Trojan
6 = Others
7 = P2P
8 = IM
9 = Virtus/Worm
10 = Botnet
11 = Web-Attack
12 = Spam