Web Traffic Scanning 

Introduction 

Web Traffic Scanning is the process which GFI WebMonitor performs 

on data objects which are downloaded through the ISA Server.  

During Web Traffic Scanning, GFI WebMonitor performs the following 

functions on the downloaded data objects: 

1. Extracts the HTTP Content Type signature as advertised in the 

HTML code.  

2. Detects the real filetype of the object by analyzing the first sets of 

bytes downloaded against a filetype signature database.  

3. Uses the advertised HTTP Content Type and detected real filetype 

data to block malicious or unwanted files.  

Figure 5   GFI WebMonitor scan web traffic using the supported anti virus scanning engines 

4. Checks for viruses using the supported virus scanning engines.  

5. Checks for spyware and adware using the supported virus scanning 

engines.  

6. Checks for Trojans using the supported virus scanning engines. 

To configure the Web Traffic Scanning options go to Configuration 

Web Traffic Scanning node. Options which can be configured include:  

  Enable/Disable in its entirety the Web Traffic Scanning engine.  

  Enable/Disable virus scanning engine(s) used to scan downloaded 

data objects for malware.  

GFI WebMonitor 3 

Web Traffic Scanning 

 27