[Clamav-users] Clam Packet Scanning

[Mar Matthias Darin]

Hello, I realize this is probably a redicules question, but what is the feasibility or praticality of catching viruses through a packet scanner (firewall or IDS) solely at the packet level? For example (poor one but does illustrate the concept): tcpdump -n -l -X | clamscan - I can think of a few shortcommings: 1. a virus will be missed if the signature splits packets. 2 no realistic way of notifing the end user that a packet was infected and destroyed, hence was their download. Thank you in advance.

pgpbZWBPZEd6T.pgp
Description: PGP signature

_______________________________________________
http://lurker.clamav.net/list/clamav-users.html