Real-time scanner

[Lawford]

Hi all,

According to some anti-virus vendors a full range of three-dimensional multi-level anti-virus system, the idea of doing business network in addition to the desktop / server anti-virus work, the message of anti-virus work, it also requires the deployment of the network border gateway anti-virus facilities. Gateway anti-virus products which generally include http, smtp, ftp, real-time virus filtering. It is an good idea to use Real-time scanner? Can anybody have any practical problems encountered . Please share some experience. Thanks .

[Snake08]

First of all, we should first understand the mechanism of virus detection. Bing Du is a code, the final shape which a file. Any of the on-line data stream must be re-formed document can be detected by anti-virus scanning engine. When you browse the page through http protocol is actually get a lot of html files, gif icon and script files, and finally to users everywhere document. Gateway anti-virus products to achieve http virus filter, http traffic must be reorganized in the data file, which is OSI7 layer reduction. To do this step, all current solutions are the use of proxy technology, whether it is self-proxy mode or icap are launched on the user browsing a web page when requested by the gateway anti-virus devices put on this page all the paging file and the gif first downloaded, scanned to give the user. Let us be clear, by way of the http proxy restore the flow of documents is a process to scan this file for viruses is another process that can separate the two processes.

[Spyrus]

I experienced a issue with Real-time scanner. First problem, internal LAN-based users, and do not want to carry out http virus scanning in the IE browser, set proxy, and if set proxy, and many do not support the agency's application will fail. To achieve http virus scanning, but also transparent to the user performance, in my earlier article, had introduced here is not to say, please see transparent HTTP gateway drug business solutions. The second problem is a direct reflection of the progress over http virus scanning, the user Department is very serious delay. Thanks .

[Milton.J]

I faced that i can put a page generally delay of not more than 5 seconds, while the default http timeout for 60 seconds (or 30 seconds?). Here we can come to count over http scanned into the theory of delay. Suppose a company's Internet-export 10Mb (first, whether exclusive or shared, has been a very possible), theoretical download speed of 1MB / S and more, we must take into account the interconnection of telecommunications and Netcom, as well as speed limits and other sites factors, generally from one-way random site to download up to 100KB / S has been very good. With the foregoing has been introduced virus scanning required by the gateway anti-virus scanning equipment first and then download the file to the user, we do not consider the ttl of the delay, visit the page so that only a few small gif file delay is less than k 1S, but if the user wants to download the patch or file, the file is 10MB, then how should we do? 10M B of the file to 100KB / S download speed theory to 100S in addition to the 10MB file virus scan, which will take time decompressed, the code matching scan time. 100S have the http timeout, and also that connections are broken. All the best.

[Steve123]

With the development of Internet technology, multi-protocol applications more and more, especially in IM programs, in order to ensure strong interoperability and network connectivity, can connect via http and communication. This has resulted in many, many msn chat data, as is taking the http protocol and the agent has to be scanned by the virus gateway, not only can not use msn or use is not smooth, but also increased the burden on the virus gateway. Meanwhile, the existing network of rampant viruses, many viral zombie will not stop in the LAN to send a large number of connection requests the external scattering, there are many use just 80 port access requests, a large number of external non-existent addresses 80 request, the agent and virus gateway can not ignore, but spend a lot of resources to answer these requests do not exist, but have no effect, the network layer network virus attacks can not be reduced to the file, the gateway http's This virus scan is powerless.

[Shen]

The face of this obvious contradiction, we can think of what tactics? That is in the http traffic through the proxy, through anti-virus gateway before they are network layer network can detect the virus attacks the devices one at a time, drop off a large number of non-normal http request and then to the gateway to handle. Yes, it can solve the above problems, but we spent much of the equipment, how much money here? Virus can detect the network equipment, we have http proxy gateway doing? Even if the http page, malicious code, we installed the client can detect anti-virus client, or through the black list of undesirable sites on the screen can be substantially reduced http access to the hidden dangers.