Anyone out there using content checking, such as websweeper or finjan to check web browsing content for malicious code?

I need to come up with a network solution to stop the likes of nimda through web browsing..

Got a Packetshaper on the pipe so will be able to gather some stats soon http://bbs.scoobynet.co.uk/wink.gif , looking at around 3000 potential web users though.

Its just required for http.

Cheers

Why not roll it all into one, we do a rack mount that will handle your web traffic and scan POP and SMTP, as a guide this thing can scan 120,000 average size email msgs an hour.

Once you get some results I can get someone to spec product if you like.

How much traffic?

That's for Http, POP3 and SMTP.

We use websweeper.. but it didnt get nimda... our networks team installed and configured it.. I'm now sort of taking responsibility for it(removed their admin rights..) it was configured to scan using netshield, but It was also running ods as well... hence using 1gb of ram, and making the internet slow...

Got to recommend what jack is on about as when I went to nai to do the course we got a demo of it... runs customized linux... zero admin if I remember rightly...

I was just starting to evaluate surfcontrol the other day but I dont think that can scan for viruses...

Let me know what you decide, as our internet gateways are our weak points at the moment.

David

I managed to get the httpurlpattern.cf file edited on our Raptor firewall today, added scan for *.ida and *.idq(string) and *.eml files on the http rule, tests show this seems to work a treat http://bbs.scoobynet.co.uk/smile.gif placed an eml file on a web server and I can't download it now http://bbs.scoobynet.co.uk/biggrin.gif

I'm going to install FinJan surfgate in the morning and test that on a 30 day eval I've been told websweeper needs a server per 500 users, FinJan state a reasonable server can handle 4000 users..

Jack what product do you sell? mail me if you want http://bbs.scoobynet.co.uk/wink.gif

Cheers

John

<BLOCKQUOTE><font size="1" face="Verdana, Arial">quote:<HR>Originally posted by JackClark:
<B>Why not roll it all into one, we do a rack mount that will handle your web traffic and scan POP and SMTP, as a guide this thing can scan 120,000 average size email msgs an hour.

Once you get some results I can get someone to spec product if you like.[/quote]

Jack

Can you let me know some more details about this box, like what it is, OS, etc. Am very interested !!

Dave

mega_stream, I don't sell any products, I work in Product Management/Marketing as a general gob shi*e for McAfee part of Network Associates. I do visit our Slough - armpit of England - offices quite often, that place is infested with salesoids who'd love a chat.

Dave, full details of this box are available on our web site at

seems part of the solution is instal the latest version of Internet Explorer (version 6.0 or if on an old OS, try IE 5.5 with SP2); they are claimed to be more resilient to attack ...... (?nimda wouldn't have got thru).

regards