Skip to main content
added 270 characters in body
Source Link
Steffen Ullrich
  • 207.5k
  • 30
  • 416
  • 481

Usually analysis works only at the level of a single download and it is really hard to do it differently. The firewall has no knowledge that a specific download is only one part of a larger download session and where the rest of the data can be downloaded for a complete analysis.

But depending on the file format the firewall might at least detect that it is a part of a larger download or that this is some unknown data format. And it might have a white list which types of data are allowed and unknown data or partial archives are not part of this white list. In this case the firewall might not be able to analyse the download for malware but it might decide to block the download because the contents is not on the white list.

This kind of situation also happens with download accelerators or resuming of downloads in which case the firewall would also only see a partial download. Some firewalls deal with this case by changing the request of the client so that it results in a full download which then can be analyzed by the firewall.

Usually analysis works only at the level of a single download and it is really hard to do it differently. The firewall has no knowledge that a specific download is only one part of a larger download session and where the rest of the data can be downloaded for a complete analysis.

But depending on the file format the firewall might at least detect that it is a part of a larger download or that this is some unknown data format. And it might have a white list which types of data are allowed and unknown data or partial archives are not part of this white list. In this case the firewall might not be able to analyse the download for malware but it might decide to block the download because the contents is not on the white list.

Usually analysis works only at the level of a single download and it is really hard to do it differently. The firewall has no knowledge that a specific download is only one part of a larger download session and where the rest of the data can be downloaded for a complete analysis.

But depending on the file format the firewall might at least detect that it is a part of a larger download or that this is some unknown data format. And it might have a white list which types of data are allowed and unknown data or partial archives are not part of this white list. In this case the firewall might not be able to analyse the download for malware but it might decide to block the download because the contents is not on the white list.

This kind of situation also happens with download accelerators or resuming of downloads in which case the firewall would also only see a partial download. Some firewalls deal with this case by changing the request of the client so that it results in a full download which then can be analyzed by the firewall.

Source Link
Steffen Ullrich
  • 207.5k
  • 30
  • 416
  • 481

Usually analysis works only at the level of a single download and it is really hard to do it differently. The firewall has no knowledge that a specific download is only one part of a larger download session and where the rest of the data can be downloaded for a complete analysis.

But depending on the file format the firewall might at least detect that it is a part of a larger download or that this is some unknown data format. And it might have a white list which types of data are allowed and unknown data or partial archives are not part of this white list. In this case the firewall might not be able to analyse the download for malware but it might decide to block the download because the contents is not on the white list.