ICAP Patience page not displayed every time a file is downloaded via ProxySG and ProxyAV

book

Article ID: 166559

calendar_today

Updated On:

Products

ProxyAV Software - AVOS ProxySG Software - SGOS

Issue/Introduction

ICAP Patience page not displayed every time a file is downloaded via ProxySG and ProxyAV
The patience page does not work for very small files
The patience page does not work for very large files
The patience page has stopped working.

Resolution

The patience page does not appear in the following scenarios:

  1. The downloaded file is too small or short (the patience page is not triggered)
  2. The file is too large to be scanned

The following example is Office 2008 for Mac which did not trigger the patience page.

### GET Request on the ICAP: ###

HTTP/1.1 302 Found
Date: Wed, 29 Jul 2009 11:01:37 GMT
Server: Apache/2.0
Pragma: no-cache
Cache-control: no-cache
Location: http://download.microsoft.com/download/C/5/3/C534F078-E9E8-4AAE-B845-AF88CD0FFC8E/Office2008-1220UpdateEN.dmg Content-Length: 0
P3P: CP="CAO DSP COR CURa ADMa DEVa PSAa PSDa IVAi IVDi CONi OUR OTRi IND PHY ONL UNI FIN COM NAV INT DEM STA"
Keep-Alive: timeout=4, max=43
Connection: Keep-Alive
Content-Type: text/plain

The value in the "Content-Legth" field is "0". The web server reports back to the ICAP server that the content length of the requested file is "0" and the ICAP server will not scan the file.  The ICAP server will return an OK. That means the scan process does not take place and the download goes strait to the client. The end result is that no patience page is displayed.  A .dmg is a disk image and a hidden virus in this kind of file would not be found. So it is OK that these files are not scanned.

A similar situation but different reason occurs on the Spybot download:

### GET Request on the ICAP: ###

HTTP/1.1 302 Found
Date: Wed, 29 Jul 2009 11:02:50 GMT
Server: Apache/2.2.4
Location: http://cnettech-28.vo.llnwd.net/s/downloadcom/s/software/11/00/04/54/spybotsd162.exe?h=241972b3b2d95869fff034b6452dfdba/.exe
Content-Length: 308
Connection: close
Content-Type: text/html; charset=iso-8859-1

Here the content length is reported with 308 bytes and the actual scan download is less than one second. In the packet capture you see the communication between the ProxySG and the ICAP server for this download:

Start of download (packet#: 82961 - time: 12:02:51.82000)
End of download (packet#: 82968 - time: 12:02:51.846000)
Total time of download (between ICAP and Proxy) 0.024 sec.

The end result is that no patience page is displayed.