relation between oversized file and AV

[#1]

Hi all, I' m confused with oversized file " " pass" and " block" , and anti virus function, if the action is Pass, then does AV check less than threshold amount or greater amount? or i' m wrong and something else would happen, it makes me nervous, Best, Kamyar

[RickP]

Thus it' s scanning the first 10meg and then passes the rest.

It' s buffering the first 10 MB, but are you certain it' s also scanning it?

[Secure_IT_BE_Nick]

Can' t find a source at the moment, but it was covered during my FCNSP training also.

[MisterAG]

Per a ticket that I opened up a few weeks ago, oversized files are indeed scanned inline after they are initially forwarded. We now buffer the first MB, they get forwarded to the host at LAN speeds, then the rest of the file comes in at Internet speed. I was surprised to see that the oversized files were scanned inline, but until I can find a source that says otherwise, I will believe the support rep.

[emnoc]

The person who said it buffers the file and then if it reaches the max size the file is pass or blocked based on the setting, is right. Since the Fortinet AV scanner has no ideal of the size of the file, it has to capture it ( the buffering patr ). So it' s not scanning the file up the max size but buffering it , so it can conduct the AV scanning. We discussed this in my fortinet security class awhile back and that' s how I recalled it. Also you have to protect yourself from exhausting memory , while doing these scans.

[Eastwind]

ORIGINAL: emnoc The person who said it buffers the file and then if it reaches the max size the file is pass or blocked based on the setting, is right. Since the Fortinet AV scanner has no ideal of the size of the file, it has to capture it ( the buffering patr ). So it' s not scanning the file up the max size but buffering it , so it can conduct the AV scanning. We discussed this in my fortinet security class awhile back and that' s how I recalled it. Also you have to protect yourself from exhausting memory , while doing these scans.

So are u saying the Fortinet will buffer the file first then scan whatever buffered next. So is it possible the embedded virus or trojan is located outside the 12MB then what happened?