14.2.2.2. Scanpath options

The following sections describe the options available for scanpaths. The options can be configured on the General, Trickle, Options tabs of the scanpath dialog.

Quarantine and oversized file options
Configuring quarantine policy

Figure 14.17. Configuring quarantine policy

Quarantine mode specifies when to store an infected in the quarantine. Always the original file is stored.

  • Always: Quarantine all objects rejected for any reason.

  • When rejected: Quarantine objects that could not be disinfected.

  • When modified or rejected: Quarantine only the original version of the files which were successfully disinfected. For example, if an infected object is found but it is successfully disinfected, the original (infected) object is quarantined. That way, the object is retained even if the disinfection damages some important information.

  • Never: Disable quarantining; objects rejected for any reason are dropped.

Bypass scanning of large files: By default, all files arriving to the scanpath are scanned. However, because of performance resons this might not be optimal, particularly if large files (for example, ISO images) are often downloaded through the firewall. Therefore it is possible to specify an Oversize threshold value and an Oversize action. If the Bypass scanning of large files checkbox is selected, then objects larger than Oversize threshold (in bytes) are not scanned, but accepted or rejected, as set in Oversize action. It is also possible to return an error message for oversized files.

Configuring trickle mode

Content filtering cannot be performed on partial files — the entire file has to be available on the firewall. Sending of the file to the client is started only if no virus was found (or the file was successfully disinfected). Instead of receiving the data in a continuous stream, as when connecting to the server “regularly”, the client does not receive any data for a while, then “suddenly” it starts to flow. This phenomena is not a problem for small files, since these are transmitted and checked fast, probably without the user ever noticing the delay, but can be an issue for larger files when the client application might time out. Another source of annoyance can be when the bandwidth of the network on the client and server side of the firewall is significantly different. In order to avoid time outs, a solution called trickling is used. This means that the firewall starts to send small pieces of data to the client so it feels that it is receiving something and does not time out. For further information on trickling, see the Virus filtering and HTTP Technical White Paper available at the Documentation Page at https://docs.balasys.hu/. CF supports the following trickling modes. These can be set on the Trickle tab of the scanpath editor dialog.

Configuring trickling

Figure 14.18. Configuring trickling

  • No trickling: Trickling is completely disabled. This may result in many connection timeouts if the processing is slow, or large files are downloaded on a slow network.

  • Percent: Determine the amount of data to be trickled based on the size of the object. Data is sent to the client only when CF receives new data; the size of the data trickled is the set percentage of the total data received so far.

  • Steady: Trickle fixed amount of data in fixed time intervals. Trickling is started only after the period set in Initial delay before the first packet. If the whole file is downloaded and processed within this interval, no trickling is used.

Tip

It is recommended to use the percent-based trickling method, because the chance of an operable virus trickling through the system unnoticed is higher when steady trickling is used.

Automatic decompression and error handling

CF can automatically decompress gzipped files and transmission and pass the uncompressed data to the modules. After the modules process the data, CF can recompress it and return it to PNS. To enable the automatic decompressing, select the Transparently decompress gzipped data checkbox. The compression level of the recompressed data can be set using the Recompression level spinbutton.

Note

Compression level of 5 or higher can significantly increase the load on the CPU.

The following actions can be set for the gzip headers through the Gzip header strip combobox:

  • Leave all gzip headers intact: Do not modify the headers.

  • Leave filename headers intact: Retain the headers containing filenames, remove all other ones.

  • Remove all gzip headers: Strip all headers.

In some cases it is possible that a module or CF cannot check an object for some reason (for example the file is corrupted, or the license of the module has expired). In such situations CF rejects all objects by default. Exemptions can be set for the errors described below: check the errors for which all objects should be accepted.

  • Corrupted file: The file is corrupt and cannot be decompressed. Certain virus scanning module handle encrypted or password-protected files as corrupted files.

  • Encrypted file: The file is encrypted or password-protected and cannot be decompressed.

  • Unsupported archive: The file is compressed with an unknown/unsupported compression method and cannot be decompressed.

  • Engine warning: The file is suspicious, heuristic virus scanning detected the file as possibly infected.

  • OS error: A low level error occurred (the module ran out of memory, or could not access the file for some reason).

  • Engine error: An internal error occurred in the module while scanning the file.

  • License error: The license of the module has expired.

Previous Up Next
 Home