/etc/prelude-lml/ruleset/unsupported/zyxel.rules is in prelude-lml-rules 4.1.0-1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 | #####
#
# Copyright (C) 2003 Laurent Oudot <oudot.laurent@wanadoo.fr>
# All Rights Reserved
# This ruleset is currently unmaintained. Contact the Prelude
# development team if you would like to maintain it.
#
# This file is part of the Prelude-LML program.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2, or (at your option)
# any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License along
# with this program; if not, write to the Free Software Foundation, Inc.,
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
#
#####
# See this page for references : http://www.zyxel.com/support/supportnote/p650/app/syslog.htm
# ZyXEL router support for Prelude-LML
# (should work with most ZynOS network devices)
# 1) CDR log : (call messages)
#LOG:Feb 14 16:57:17 192.168.1.1 ZyXEL Communications Corp.: board 0 line 0 channel 0, call 18, C01 Incoming Call OK
#LOG:Feb 14 17:07:18 192.168.1.1 ZyXEL Communications Corp.: board 0 line 0 channel 0, call 18, C02 Call Terminated
# 2) Packet triggered log : (just for info)
#LOG:Jul 19 11:28:39 192.168.102.2 ZyXEL Communications Corp.: Packet Trigger: Protocol=1, Data=4500003c100100001f010004c0a86614ca849a7b08004a5c020001006162636465666768696a6b6c6d6e6f7071727374
#LOG:Jul 19 11:28:56 192.168.102.2 ZyXEL Communications Corp.: Packet Trigger: Protocol=1, Data=4500002c1b0140001f06b50ec0a86614ca849a7b0427001700195b3e00000000600220008cd40000020405b4
# 3) Filter log :
#LOG:Jul 19 14:44:09 192.168.1.1 ZyXEL Communications Corp.: IP[Src=202.132.154.1 Dst=192.168.1.33 UDP spo=0035 dpo=05d4]}S03>R01mF
regex=ZyXEL Communications Corp.: IP\[Src=([0-9\.]+) Dst=([0-9\.]+) ([A-Z]+) spo=([0-9A-Fa-f]+) dpo=([0-9A-Fa-f]+).*S(\d{2})>R(\d{2})(.)(.); \
classification.text=ZyXEL ip access; \
id=37000; \
revision=1; \
assessment.impact.completion = failed; \
assessment.impact.type = other; \
assessment.impact.severity = medium; \
assessment.impact.description= Someone probably tried to bypass filtering : $1 ($3 $4) -> $2 ($3 $5) ruleset $6 rule $7; \
source(0).node.address(0).category=ipv4-addr; \
source(0).node.address(0).address = $1; \
source(0).service.port = 0x$4; \
source(0).service.protocol = $3; \
target(0).node.address(0).category=ipv4-addr; \
target(0).node.address(0).address = $2; \
target(0).service.port = 0x$5; \
target(0).service.protocol = $3; \
last
#LOG:Jul 19 14:44:13 192.168.1.1 ZyXEL Communications Corp.: IP[Src=192.168.1.33 Dst=202.132.154.1 ICMP]}S03>R01mF
regex=ZyXEL Communications Corp.: IP\[Src=([0-9\.]+) Dst=([0-9\.]+) ([A-Z]+)\].*S(\d{2})>R(\d{2})(.)(.); \
classification.text=ZyXEL ip access; \
id=37001; \
revision=1; \
assessment.impact.completion = failed; \
assessment.impact.type = other; \
assessment.impact.severity = medium; \
assessment.impact.description= Someone probably tried to bypass filtering : $1 ($3) -> $2 ($3) ruleset $4 rule $5; \
source(0).node.address(0).category=ipv4-addr; \
source(0).node.address(0).address = $1; \
source(0).service.protocol = $3; \
target(0).node.address(0).category=ipv4-addr; \
target(0).node.address(0).address = $2; \
target(0).service.protocol = $3; \
last
# 4) PPP Log :
#LOG:Jul 19 11:43:25 192.168.1.1 ZyXEL Communications Corp.: ppp:LCP Starting
#LOG:Jul 19 11:43:43 192.168.1.1 ZyXEL Communications Corp.: ppp:IPCP Opening
#LOG:Jul 19 11:43:51 192.168.1.1 ZyXEL Communications Corp.: ppp:CCP Opening
#LOG:Jul 19 11:44:14 192.168.1.1 ZyXEL Communications Corp.: ppp:BACP Closing
regex=ZyXEL Communications Corp.: ppp:(LCP|IPCP|CCP|BACP) (Starting|Opening|Closing); \
classification.text=ZyXEL PPP $2; \
id=37002; \
revision=1; \
assessment.impact.type = other; \
assessment.impact.severity = low; \
assessment.impact.description=$2 $1 connection; \
last
|