Chapter 22 IDP Commands

example, to search for signatures for Windows NT, Windows XP and Windows 2000 computers, then type “12” as the platform parameter.

Table 106 Severity, Platform and Policy Type Command Values

SEVERITY

PLATFORM

POLICY TYPE

1

= Very Low

1

= All

1

= DoS

2

= Low

2

= Win95/98

2

= Buffer-Overflow

3

= Medium

4

= WinNT

3

= Access-Control

4

= High

8

= WinXP/2000

4

= Scan

5

= Severe

16

= Linux

5

= Backdoor/Trojan

 

 

32

= FreeBSD

6

= Others

 

 

64

= Solaris

7

= P2P

 

 

128

= SGI

8

= IM

 

 

256

= Other-Unix

9

= Virtus/Worm

 

 

512

= Network-Device

10

= Porn

 

 

 

 

 

 

11

= Web-Attack

 

 

 

 

 

 

12

= Spam

 

 

 

 

 

 

 

 

 

The following table displays the command line service and action equivalent values. If you want to combine services in a search, then add their respective numbers together. For example, to search for signatures for DNS, Finger and FTP services, then type “7” as the service parameter.

Table 107 Service and Action Command Values

SERVICE

SERVICE

ACTION

1

= DNS

65536 = SMTP

1

= None

2

= FINGER

131072 = SNMP

2

= Drop

4

= FTP

262144 = SQL

4

= Reject-sender

8

= MYSQL

524288 = TELNET

8

= Reject-receiver

16 = ICMP

1048576

= TFTP

16 = Reject-both

32 = IM

2097152

= n/a

 

 

64 = IMAP

4194304

= WEB_ATTACKS

 

 

128 = MISC

8388608

= WEB_CGI

 

 

256 = NETBIOS

16777216 = WEB_FRONTPAGE

 

 

512 = NNTP

33554432 = WEB_IIS

 

 

1024

= ORACLE

67108864 = WEB_MISC

 

 

2048

= P2P

134217728 = WEB_PHP

 

 

4096

= POP2

268435456 = MISC_BACKDOOR

 

 

8192

= POP3

536870912 = MISC_DDOS

 

 

16384 = RPC

1073741824 = MISC_EXPLOIT

 

 

32768 = RSERVICES

 

 

 

 

 

 

 

 

 

 

 

190

 

ZyWALL (ZLD) CLI Reference Guide