Great timing for me on this topic. We are currently phasing out our use of Henrik's great havp proxy and are going to ICAP - and I have been majorly disappointed with the performance of the commercial ICAP services I've tried
I had a 60M zip file I was testing with via Firefox: Kaspersky would say "9 hours" to download, then go "9h, 9h, 9h, 9h, complete!" - which is an AWFUL end-user experience. F-Secure would go "unknown, unknown, unknown, complete!" - which is even worse. Strangely enough, the one ICAP service that worked well was - c-icap with CLAMD! That seemed to give a much better feeling of "2m, 2m, 1m, complete!" - which seems to contradict what's been said here Henrik - you said ICAP "can't achieve such trickery" - are you sure about that? If that's true (and my c-icap test is somehow mistaken), then I'm majorly disappointed - and a bit stuck as to how to do AV filtering without users screaming (PS: yes the AVs all took 2minutes to download and process the same file - but the *perception* of performance is the key attribute I want to see) Jason -- Cheers Jason Haar Corporate Information Security Manager, Trimble Navigation Ltd. Phone: +1 408 481 8171 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 _______________________________________________ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
