cancel
Showing results for 
Search instead for 
Did you mean: 

Webgateway - How to terminate large file download session?

Situation:

- The /opt is 39GB

- 10 user downloading with file size over 5GB from google drive

- The file is caching for Alti-malware scan

Because files are storing on google drive, we can not know their sizes to bypass Alti-malware scan

I want to know there is a way to terminate downloading session.

4 Replies
Highlighted
McAfee Employee smasnizk
McAfee Employee
Report Inappropriate Content
Message 2 of 5

Re: Webgateway - How to terminate large file download session?

Termination of running sessions aren't possible. Please keep in mind that bypass on file.size will still take effect on big files even if file size is not provided in HTTP headers. The engine will download the limited size and then skip it from scanning as the size has been exceeded. When this rule isn't working, please create rule engine trace and feedback file before you fill new service request with tech. support for review.

-Sergej

Re: Webgateway - How to terminate large file download session?

I'm a little surprised. 

I've watched rule traces accumulating hundreds of cycles, even to the limit (500 I think).  Maybe this only happens for trickling or a progress page (with the opener enabled), which is what's needed for the antimalware scanner, and that's were it would be valuable. 

I'm tempted to hack at this to see if it's really true.  What one would hope is that file.size increases for each of those cycles.  Maybe it doesn't; maybe it can be used like that in a rule.  I wonder.

Re: Webgateway - How to terminate large file download session?

Dear Sergej

Can use give me an example about file.size rule.

I use 7.6.2.9.0 and can not find the file.size property.

McAfee Employee sbluemel
McAfee Employee
Report Inappropriate Content
Message 5 of 5

Re: Webgateway - How to terminate large file download session?

Hi,

You can use such sample:

Name:

Skip Files from Scanning over 50 MB

Comment:

Rule Criteria:

Connection.Protocol does not equal "FTP" AND

Cycle.Name equals "Response" AND

Body.Size greater than 52428800 OR (

Header.Exists ("Content-Length") equals true AND

String.ToNumber (Header.Get ("Content-Length")) greater than 52428800)

Action:

Stop Cycle

Regards,

Stefan

McAfee ePO Support Center Plug-in
Check out the new McAfee ePO Support Center. Simply access the ePO Software Manager and follow the instructions in the Product Guide for the most commonly used utilities, top known issues announcements, search the knowledgebase for product documentation, and server status and statistics – all from within ePO.