From: Victor Julien <victor@nk.nl>
To: netfilter@lists.netfilter.org
Cc: Daniel Chemko <dchemko@smgtec.com>, Khanh Tran <khanh@slc.edu>
Subject: Re: virus scanning with iptables
Date: Fri, 10 Sep 2004 09:49:10 +0200 [thread overview]
Message-ID: <200409100949.10565.victor@nk.nl> (raw)
In-Reply-To: <7C9884991ADAE0479C14F10C858BCDF591E36E@alderaan.smgtec.com>
On Friday 10 September 2004 01:26, Daniel Chemko wrote:
> Khanh Tran wrote:
> > Is any using a virus scanning application with iptables? I'd like to
> > know if it's possible for me to detect viruses that go across my
> > iptables firewalls.
>
> There isn't currently a tool to perform Virus scanning of iptables data.
> The closest match would be snort-inline which can locate some virus
> signatures. Inline scanning of anything can have averse effects on the
> transmission. You'll quickly find that detailed scans require a lot of
> CPU usage. Just for monitoring network thoughtput with ntop, I'd max out
> my P4 CPU when backups kicked off.
We have developed a virusscanning preprocessor for Snort-inline about one
month ago. It will be in the upcoming Snort-inline 2.2.0 rc1 due to be
released this weekend (a patch for Snort-inline 2.1.3 is available at the
project site).
The ClamAV plugin scans the raw networkdata, an we have been successfully
detecting viruses in http, smtp, pop3, msn, imap, etc. Note however, that
scanning the raw data means we don't detect viruses in archives.
The cpu-load of the plugin seems to be ok...
>
> The better approach would be to implement transparent proxies of
> pertinent services like SMTP and use virus scanning addons. for them.
I agree with Daniel here, especially for stmp. For other stuff you can try the
above solution!
Regards,
Victor
next prev parent reply other threads:[~2004-09-10 7:49 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2004-09-09 23:26 virus scanning with iptables Daniel Chemko
2004-09-10 7:49 ` Victor Julien [this message]
-- strict thread matches above, loose matches on Subject: below --
2004-09-10 0:36 Khanh Tran
2004-09-10 15:34 ` Stephen J Smoogen
2004-09-10 15:54 ` rruegner
2004-09-10 15:50 ` Stephen J Smoogen
2004-09-10 16:37 ` Jose Maria Lopez
2004-09-09 23:09 Khanh Tran
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200409100949.10565.victor@nk.nl \
--to=victor@nk.nl \
--cc=dchemko@smgtec.com \
--cc=khanh@slc.edu \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox