HTTP Anti-Virus Proxy

Hi
I am new on HAVP.
I have to question about this proxy:
1- Is there any benchmark (statistic) on how amount bandwidth HAVP (clamav enabled) could handle ?
2- Is there any tool bases on HAVP?Or any company create one tool based on HAVP?

Thanks for any guidance

Not that I know.. mine handles easily 100-200req/s for 1000 users with 5% CPU usage. I think that's much more describing figure than bandwidth. But larger setups might need some tweaking because of the current architecture (video streams etc reserve one child).



What kind of tool? All-in-one easy to setup proxy? Atleast Endian Firewall uses HAVP, but it's just one feature.

Thanks for your reply.
for 100-200 req/s, Did you enable Antir Virus checking??
Is there any benchmark from other installation?
I think my need is over 2000 req/s and of course with enabled antivirus!

Regards

I think, you should search a tool for squid proxy analysis like calamaris or so, this should you give a overview about response time.
But I do not really know a benchmark test for your plan

EDIT: I have one company with ~500 - 700 Requests/second without any problems. I think, best would be, to program a script, that is doing this requests for testing

regards, karesmakro

Easy test to benchmark ClamAV performance (it's really the only thing sucking resources) is to maybe grep 10000 URLs from your Squid log and download all those files with wget or such - or maybe just use your Squid cache directory if you have one. Then simply scan that directory with clamscan. It will tell you realistic URLs/files per second performance for single core for your traffic pattern. You need to use similar clamscan options (max scan size 5MB etc).

Having 2000 req/s means you need 500-1000 scanner processes for nice throughput? Atleast 16 cores for nice load distribution? Just guesses..

You should also compare Squid with c-icap/clamav which might be less featureful but maybe more robust and performing solution.

Thanks for your attention
What do you mean "16 cores"? Did you mean CPU core?
I think I could not correctly understand your told about "compare Squid with c-icap/clamav which might be less featureful but maybe more robust and performing solution".Do you mean Squid with c-icap/clamav is more robust thatn HAVP??

Thanks in advance

Yes



Probably more robust in the sense that it's more simple and uses a known content filtering "standard". It just feeds first x bytes of data to c-icap, and it's either ok or virus, no HTTP or other things involved. HAVP has advantages, but for those rates ICAP might be preferred. I have no real life experience with c-icap, I don't know how robust it's error handling code is etc.

http://www.mail-archive.com/squid-users ... 71246.html
http://www.mail-archive.com/squid-users ... 73543.html