The 1U Web Filter 310 device stopped 67 of our 70 malware instances. The Barracuda appliance identifies spyware by file signature, as well as URL and IP address connection attempts. The device automatically updates its definitions at a configurable hourly or daily rate, with hourly checks recommended.
Traffic other than executable files passed through the appliance with a latency range from 20 msec to 27 msec for each packet. The device analyzed executable files for spyware with a latency from 180 msec to 230 msec. Barracuda suggests using the Web Filter 310 to handle about 300 connections per second for best performance. If it detects a phone-home attempt, the system automatically invokes the Barracuda Spyware Removal Tool, an ActiveX program sent to the client to kill the running spyware process and clean up the client’s hard disk.
The Web Filter 310 records the malware’s signature, its URL or IP address source, and the date and time of the client’s near-exposure to the malware. The system integrates with network-management systems via SNMP. We didn’t test Barracuda’s IM Firewall, which the vendor says protects IM clients from IM-borne malware.
