cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
974
Views
0
Helpful
1
Replies

Attachement Blocking - Fingerprinting

fmathon.isabel
Level 1
Level 1

Hello,

I want to avoid creating a regular expression containing all the extensions we want to block and use the fingerprint filter instead (who seems to add a bit of intelligence).

However the fingerprint "file-type" function is not very well documented...

Can anyone provide me more info on how it work? especially for file-type "executable" and "media"

What can it identify and how ?

Thank you

Best regards,

1 Reply 1

Andreas Mueller
Level 4
Level 4

Hello fmathon.isabel,

the file-type condition basically uses the magic number that is defined for each binary file:

http://en.wikipedia.org/wiki/Magic_number_%28programming%29

If you are familiar with the "file" command on Unix and Linux, this is basically what file-type does.

Hope that helps,

Andreas