mega_stream

Anyone out there using content checking, such as websweeper or finjan to check web browsing content for malicious code?

I need to come up with a network solution to stop the likes of nimda through web browsing..

mega_stream

Got a Packetshaper on the pipe so will be able to gather some stats soon , looking at around 3000 potential web users though.

Its just required for http.

Cheers

JackClark

Why not roll it all into one, we do a rack mount that will handle your web traffic and scan POP and SMTP, as a guide this thing can scan 120,000 average size email msgs an hour.

Once you get some results I can get someone to spec product if you like.

JackClark

How much traffic?

JackClark

That's for Http, POP3 and SMTP.

David_Wallis

We use websweeper.. but it didnt get nimda... our networks team installed and configured it.. I'm now sort of taking responsibility for it(removed their admin rights..) it was configured to scan using netshield, but It was also running ods as well... hence using 1gb of ram, and making the internet slow...

Got to recommend what jack is on about as when I went to nai to do the course we got a demo of it... runs customized linux... zero admin if I remember rightly...

I was just starting to evaluate surfcontrol the other day but I dont think that can scan for viruses...

Let me know what you decide, as our internet gateways are our weak points at the moment.

David

mega_stream

I managed to get the httpurlpattern.cf file edited on our Raptor firewall today, added scan for *.ida and *.idq(string) and *.eml files on the http rule, tests show this seems to work a treat placed an eml file on a web server and I can't download it now

I'm going to install FinJan surfgate in the morning and test that on a 30 day eval I've been told websweeper needs a server per 500 users, FinJan state a reasonable server can handle 4000 users..

Jack what product do you sell? mail me if you want

Cheers

John

druddle

<BLOCKQUOTE><font size="1" face="Verdana, Arial">quote:<HR>Originally posted by JackClark:
<B>Why not roll it all into one, we do a rack mount that will handle your web traffic and scan POP and SMTP, as a guide this thing can scan 120,000 average size email msgs an hour.

Once you get some results I can get someone to spec product if you like.[/quote]

Jack

Can you let me know some more details about this box, like what it is, OS, etc. Am very interested !!

Dave

JackClark

mega_stream, I don't sell any products, I work in Product Management/Marketing as a general gob shi*e for McAfee part of Network Associates. I do visit our Slough - armpit of England - offices quite often, that place is infested with salesoids who'd love a chat.

Dave, full details of this box are available on our web site at

philc

seems part of the solution is instal the latest version of Internet Explorer (version 6.0 or if on an old OS, try IE 5.5 with SP2); they are claimed to be more resilient to attack ...... (?nimda wouldn't have got thru).

regards