Protection Engine for Cloud Services

 View Only

  • 1.  Is SSE 5.2.11 able to scan files greater than 2GB?

    Posted Oct 12, 2011 02:18 AM

    The background of this question is that we have found following description in the release note of SSE 5.2.11:

    -------------------------------------------------------
    Symantec Scan Engine 5.2.11
    New Features:
    Native 64-bit C++ SDK on Windows 2008 R2
    Native 32-bit and 64 bit C++ SDK on Solaris 10 x86
    AMD Opteron hardware support
    Greater than 2 GB files support
    Support for new files types (zipx, mms and 7z)
    ----------------------------------------------------------

    Thus we have tried to scan 2202009600 Byte file (2.1BG) with Symantec Scan Engine 5.2.11.131
     But SSE returned the error "ICAP/1.0 551 Resource unavailable" regardless of the fact that
     we have enough capacity and no filter settings.
    So we wonder if 2GB+ file is suppoted.



  • 2.  RE: Is SSE 5.2.11 able to scan files greater than 2GB?

    Posted Nov 02, 2011 01:43 PM

     

    If a file to be scanned is a container file then AV scanning flow includes extraction of files within the container, followed by AV scanning of the container and as well as AV scanning of the contained files.
     
    In releases earlier than v5.2.11, extraction of files from a container of size more than 2 GB wasn't supported by Scan Engine but in v5.2.11 extraction of files from containers of size more than 2 GB is supported for zip, tar and rar types.  
     
    As far as actual AV scanning is concerned, files with size more than 2 GB are not supported. If a file being scanned, and if its a container then files within the container, are of size more than 2 GB then such files are not AV scanned. 
     
    For example, when a zip file of size 3 GB containing 10 files of size 500 MB each is passed to Scan Engine v5.2.11 for scanning, all the contained files will be extracted and AV scanned, but the zip file itself will not be AV scanned because it is bigger than 2 GB. When a zip file of size 3 GB containing 2 files, one of size 1.5 GB and another of size 2.5 GB is passed to Scan Engine v5.2.11 for scanning, contained file of size 1.5 GB will be AV scanned but the file of size 2.5 GB and also the container file will not be AV scanned.  
     
    In Scan Engine releases earlier than 5.2.11, files contained in a container of size more than 2 GB were not extracted and AV scanned, and also the container file itself was not AV scanned.