05-28-2014 12:33 AM - edited 03-10-2019 06:12 AM
Hello,
I confused these days about the difference between Network malware scanner and the IPS.
For example - Cisco doesn't have integrated malware scanner in the NGFW, but some vendors have. What is the purpose of having IPS and malware simultaneously? The only thing i can think about is malware scanners can fix infected files (on IronPort ESA for example) and IPS directly drops traffic.
Solved! Go to Solution.
05-28-2014 08:13 AM
An IPS scans packets whereas a malware scanner scans files. With the Cisco IPS, you can configure in either promiscuous or inline modes. In inline mode, the IPS can identify and drop malicious packets before they're unleashed on the network. In promiscuous mode, a copy of each packet is sent to the IPS and malicious packets are identified after they arrive at their destination. This means viruses, malware, etc. can potentially be activated on the network.
A network malware scanner scans for already installed malware. For instance, if a new flavor of malware is sent as an attachment to an email address on your network, the IPS will not pick it up since it doesn't have a signature for it. If the attachment is opened, it's unleashed. If you have periodic scans done with your network malware scanner, this is something it'll pick up.
Jason
05-28-2014 08:13 AM
An IPS scans packets whereas a malware scanner scans files. With the Cisco IPS, you can configure in either promiscuous or inline modes. In inline mode, the IPS can identify and drop malicious packets before they're unleashed on the network. In promiscuous mode, a copy of each packet is sent to the IPS and malicious packets are identified after they arrive at their destination. This means viruses, malware, etc. can potentially be activated on the network.
A network malware scanner scans for already installed malware. For instance, if a new flavor of malware is sent as an attachment to an email address on your network, the IPS will not pick it up since it doesn't have a signature for it. If the attachment is opened, it's unleashed. If you have periodic scans done with your network malware scanner, this is something it'll pick up.
Jason
05-31-2014 12:14 AM
Thank you for the answer, Jason!
And the malware scanner is working only on specific ports - 80, 443, 25...
I think it is more clear for me now.
Best regards!
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: