Skip to main content
A
Anonymous_User
Contributor III
April 7, 2009
Question

relation between oversized file and AV

  • April 7, 2009
  • 7 replies
  • 8197 views
Hi all, I' m confused with oversized file " " pass" and " block" , and anti virus function, if the action is Pass, then does AV check less than threshold amount or greater amount? or i' m wrong and something else would happen, it makes me nervous, Best, Kamyar

    7 replies

    UkWizard
    UkWizard
    New Member
    April 7, 2009
    the file size if the maximum size that the AV will scan. so if you are downloading a 11MB file, and you have it set to 10MB, then it will allow it through unscanned if it is set to ' pass' . if its set to block, it will not allow you to download a file thats bigger than the setting, so this 11MB file would be blocked.
    A
    Anonymous_UserAuthor
    Contributor III
    April 7, 2009
    " the file size if the maximum size that the AV will scan. so if you are downloading a 11MB file, and you have it set to 10MB, then it will allow it through unscanned if it is set to ' pass' . " and the AV does not check the first 10 MB? Best, Kamyar
    Secure_IT_BE_Nick
    Secure_IT_BE_Nick
    New Member
    April 7, 2009
    That was also my idea. Looking for more info on that. Nick
    doshbass
    doshbass
    New Member
    April 8, 2009
    The AV will not check any of a large file. Fortinet AV works by buffering the file and then performing AV functions. If the file is too large, according to threshold, or larger that 2/3rds (I think) of the limit when compressed. It will bypass AV and the action selected will occur. To scan part of the file is not the Fortinet way as this implies stream based AV,which is little more than IPS. The Fortigate AV is considerably more advanced than this, and includes teh ability to uncompress GZIP files and identify custom unpackers etc. Check out http://blog.fortinet.com for some real in depth AV stuff
    UkWizard
    UkWizard
    New Member
    April 8, 2009
    Doshbass, I think it actually depends on the way the file is served, if the file size is provided back to the client (and thus also the firewall), then it seems to see its too big and bypass the AV scanning. If the size isnt reported (which seems to be case most of the time) then it does scan the file up to the threshold. At least, this is what i see when i test it.
    Eastwind
    Eastwind
    New Member
    July 26, 2009
    ORIGINAL: UkWizard Doshbass, I think it actually depends on the way the file is served, if the file size is provided back to the client (and thus also the firewall), then it seems to see its too big and bypass the AV scanning. If the size isnt reported (which seems to be case most of the time) then it does scan the file up to the threshold. At least, this is what i see when i test it.
    Hi UK Wizard, what is the benefit of scan the file up to the threshold? can virus be embedded anywhere in pdf or in any files, like start, middle or end of the file or in attachement? A lot of files or patches that we have to download are way larger than the threshold 12MB, what do u suggest ? is OS 4.0 better in scanning larger file that is scalable.
    doshbass
    doshbass
    New Member
    April 8, 2009
    I guess it may buffer, getting ready to scan, but it will not actually begin scanning until teh entire file is downloaded. So in the case of oversized file without a known size, then buffer buffer buffer buffer too big give. Only in 1s and 0s Oh and call me Dosh, tha bass bit is just a fomality
    A
    Anonymous_UserAuthor
    Contributor III
    April 8, 2009
    and can i increase the treshold amount (by default %10 RAM)? if so, how many do you recommend? Best, kamyar
    Secure_IT_BE_Nick
    Secure_IT_BE_Nick
    New Member
    April 8, 2009
    Just did the test.. Downloaded file of 15 mb, first 10mb download at 4mb/sec. then it drops to the speed of internet. Thus it' s scanning the first 10meg and then passes the rest.
    RickP
    RickP
    New Member
    April 8, 2009
    Thus it' s scanning the first 10meg and then passes the rest.
    It' s buffering the first 10 MB, but are you certain it' s also scanning it?
    MisterAG
    MisterAG
    New Member
    April 14, 2009
    Per a ticket that I opened up a few weeks ago, oversized files are indeed scanned inline after they are initially forwarded. We now buffer the first MB, they get forwarded to the host at LAN speeds, then the rest of the file comes in at Internet speed. I was surprised to see that the oversized files were scanned inline, but until I can find a source that says otherwise, I will believe the support rep.
    emnoc
    emnoc
    New Member
    April 23, 2009
    The person who said it buffers the file and then if it reaches the max size the file is pass or blocked based on the setting, is right. Since the Fortinet AV scanner has no ideal of the size of the file, it has to capture it ( the buffering patr ). So it' s not scanning the file up the max size but buffering it , so it can conduct the AV scanning. We discussed this in my fortinet security class awhile back and that' s how I recalled it. Also you have to protect yourself from exhausting memory , while doing these scans.
    Eastwind
    Eastwind
    New Member
    July 26, 2009
    ORIGINAL: emnoc The person who said it buffers the file and then if it reaches the max size the file is pass or blocked based on the setting, is right. Since the Fortinet AV scanner has no ideal of the size of the file, it has to capture it ( the buffering patr ). So it' s not scanning the file up the max size but buffering it , so it can conduct the AV scanning. We discussed this in my fortinet security class awhile back and that' s how I recalled it. Also you have to protect yourself from exhausting memory , while doing these scans.
    So are u saying the Fortinet will buffer the file first then scan whatever buffered next. So is it possible the embedded virus or trojan is located outside the 12MB then what happened?
    Terms & ConditionsAccessibility statement