Anti-Virus Malicious File Message; Anti-Virus Malicious Url Message - D-Link NetDefendOS User Manual

Chapter 6: Security Mechanisms
Figure 6.11. Anti-Virus Malicious File Message
For malicious URLs, the message displayed will be similar to the following:
Figure 6.12. Anti-Virus Malicious URL Message
Simultaneous Scans
There is no fixed limit on how many anti-virus scans can take place simultaneously in a single
NetDefend Firewall. However, the available free memory can place a limit on the number of
concurrent scans that can be initiated.
Protocol Specific behavior
Since anti-virus scanning is implemented through an Application Level Gateway (ALG), specific
protocol specific features are implemented in NetDefendOS. With FTP, for example, scanning is
aware of the dual control and data transfer channels that are opened and can send a request via
the control connection to stop a download if a virus in the download is detected.
Relationship with IDP
A question that is often posed is the "ordering" of Anti-virus scanning in relation to IDP scanning.
In fact, the concept of ordering is not relevant since the two scanning processes can occur
simultaneously and operate at different protocol levels.
If IDP is enabled, it scans all packets designated by a defined IDP rule and does not take notice of
higher level protocols, such as HTTP, that generate the packet streams. However, Anti-virus is
aware of the higher level protocol and only looks at the data involved in file transfers. Anti-virus
scanning is a function that therefore logically belongs in an ALG, whereas IDP does not belong
there.
Subscribing to the D-Link Anti-Virus Service
The D-Link anti-virus feature requires the purchase of a renewable subscription in order for it to
function. This includes regular updates of the Kaspersky SafeStream database during the
subscription period with signatures for the latest virus threats.
543