Web Traffic Scanning

Introduction

Web Traffic Scanning is the process which GFI WebMonitor performs on data objects which are downloaded through the ISA Server.

During Web Traffic Scanning, GFI WebMonitor performs the following functions on the downloaded data objects:

1. Extracts the HTTP Content-Type signature as advertised in the HTML code.

2. Detects the real filetype of the object by analyzing the first sets of bytes downloaded against a filetype signature database.

3. Uses the advertised HTTP Content-Type and detected real filetype data to block malicious or unwanted files.

Figure 5 - GFI WebMonitor scan web traffic using the supported anti-virus scanning engines

4. Checks for viruses using the supported virus scanning engines.

5. Checks for spyware and adware using the supported virus scanning engines.

6. Checks for Trojans using the supported virus scanning engines.

To configure the Web Traffic Scanning options go to Configuration } Web Traffic Scanning node. Options which can be configured include:

Enable/Disable in its entirety the Web Traffic Scanning engine.
Enable/Disable virus scanning engine(s) used to scan downloaded data objects for malware.
Configuration of which data objects are to be allowed, blocked and scanned for malware through the selected anti-virus engine(s).
Configuration of user exceptions: data objects downloaded by these users will not be passed through the Web Traffic Scanning processing engine.
Configuration of website exceptions: data objects downloaded from these sites will not be allowed through the Web Traffic Scanning processing engine.