Let's say you have a zip file. How do you expect ClamAV to scan it packet by packet? Or any other data really. I think there are very few wild signatures in database that are allowed to match any position anywhere in a "file". Only reliable way is to scan a complete file, so it knows the length and can decode it properly etc.
The now abandoned HAVP proxy scanner does many tricks (filesystem mandatory locking to "pseudo-stream" files into clamav, zip header prefetch etc) to achieve near realtime scanning for large files and reduce "user hanging" to a minimum. I guess this is what you are after, but ICAP can't achieve such trickery. On Thu, Jul 02, 2015 at 12:57:00PM +0530, P K wrote: > Hi guys, > > Waiting for your reply. It should be simpler answer. > > Does ClamAv support virus checking in stream mode for large files? > > If i have file size of 10Mb do i have to send all data to clamAv and clamAv > will send status ok > or it can scan data in each packet and return status for each segment? > > Thanks > > > On Tue, Jun 30, 2015 at 12:28 PM, P K <pkopen...@gmail.com> wrote: > > > Hi Guys, > > > > I am new to Clamd and was trying to use it for virus scanning. > > > > I used squid + icap + clamAv. > > > > But i seen once all data is recieved clamAv INSTREAM is called and data is > > passed to it. > > > > Is it issue with icap server or Clamd doesn't support streaming support? > > > > Any guidance will be helpful for me > > and how can we make ClamAv streaming support. > > > > Awaiting for reply. > > > _______________________________________________ > Help us build a comprehensive ClamAV guide: > https://github.com/vrtadmin/clamav-faq > > http://www.clamav.net/contact.html#ml _______________________________________________ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
