Fortinet white logo
Fortinet white logo

Administration Guide

Flow mode stream-based scanning NEW

Flow mode stream-based scanning NEW

In flow mode with AV engine 7.0, FortiOS automatically uses stream-based antivirus scanning for HTML and Javascript files. The AV engine determines the necessary amount of file payload to buffer and scans the partial buffer in certain instances, eliminating the need to cache the entire file, and potentially improving memory usage.

Prior to AV engine 7.0, the whole file was cached before AV engine scanning started, and this legacy antivirus scanning method is retained for file types and configurations unsupported by stream-based scanning. As a result, the following types of scans are supported:

  • Default antivirus scans for HMTL and Javascript files

  • Legacy antivirus scans

The following table summarizes the types of scans and when they are automatically used:

Default antivirus scan

  • Automatically uses stream-based scanning in flow mode for HTML and Javascript files.

  • Triggers a legacy scan for unsupported configurations and file types.

Legacy antivirus scan

  • Automatically used for files types unsupported by default antivirus scans.

  • Automatically used when any of the following antivirus scanning features are enabled:

    • Machine learning-based malware detection (set machine-learning-detection)

    • Extreme antivirus database (set use-extreme-db)

    • Antivirus PUP/PUA grayware checks

    • Mobile malware database (set mobile-malware-db)

    • External block list (set external-blocklist)

    • EMS threat feed

    • FortiGuard outbreak prevention

  • Automatically used when any of the following scanning features are used:

    • Data loss prevention (DLP)

    • File filter

Flow mode stream-based scanning NEW

Flow mode stream-based scanning NEW

In flow mode with AV engine 7.0, FortiOS automatically uses stream-based antivirus scanning for HTML and Javascript files. The AV engine determines the necessary amount of file payload to buffer and scans the partial buffer in certain instances, eliminating the need to cache the entire file, and potentially improving memory usage.

Prior to AV engine 7.0, the whole file was cached before AV engine scanning started, and this legacy antivirus scanning method is retained for file types and configurations unsupported by stream-based scanning. As a result, the following types of scans are supported:

  • Default antivirus scans for HMTL and Javascript files

  • Legacy antivirus scans

The following table summarizes the types of scans and when they are automatically used:

Default antivirus scan

  • Automatically uses stream-based scanning in flow mode for HTML and Javascript files.

  • Triggers a legacy scan for unsupported configurations and file types.

Legacy antivirus scan

  • Automatically used for files types unsupported by default antivirus scans.

  • Automatically used when any of the following antivirus scanning features are enabled:

    • Machine learning-based malware detection (set machine-learning-detection)

    • Extreme antivirus database (set use-extreme-db)

    • Antivirus PUP/PUA grayware checks

    • Mobile malware database (set mobile-malware-db)

    • External block list (set external-blocklist)

    • EMS threat feed

    • FortiGuard outbreak prevention

  • Automatically used when any of the following scanning features are used:

    • Data loss prevention (DLP)

    • File filter