General

Performance Considerations Innoculate Your Network: AVStripper (Part II) —continued

During our evaluation, we looked primarily at functionality, manageability, usability, and reliability. However, any device that separates your network from the rest of the world must be a solid performer.

According to product specs, a single AVStripper supports up to 12 Mbps. Of course, actual throughput depend upon a wide variety of factors, such as the type of traffic being pushed through the AVStripper, the number of viruses found, the length of each file that must be cached before scanning, etc.. Clearly, an AVStripper behind a 1-2 Mbps broadband connection should have no trouble keeping up with offered load. As WAN bandwidth increases, the AVStripper's peak capacity becomes more important.

In Ositis internal testing, AVStripper was demonstrated to support 96,000 mail messages per hour, where 5 percent are 128 byte bodies with 2-5K viral attachments. To measure web browsing capacity, Ositis downloads a portion of the BBC News website, running 720 clients with 400 simultaneous threads, yielding an aggregate throughput of 10 Mbps. According to James, real-world feedback from customers ranges from 6 to 12 Mbps.

We decided to measure a very demanding scenario: one-way file transfer. Over a WAN uplink without AVStripper, our file transfers delivered an average of 1.19 Mbps. With AVStripper in place, this average dropped just slightly to 1.11 Mbps. On a 10 Mbps LAN without AVStripper, similar file transfers averaged 8.63 Mbps. However, with AVStripper in place, throughput dropped rather noticeably.

After further consideration, we concluded that our LAN test did not fill the pipeline. During the WAN test, we transferred a variety of files, ranging from 300KB to 7MB in length. During the LAN test, we transferred longer files, ranging from 4MB to 17MB. By keeping the AVStripper busy storing large files to be scanned, we may have under-utilized the scan engine. A more realistic mix of short and long files would probably have yielded different results.

Pricing and Support
The AVStripper starts at $2,995 for an appliance with a 25-user enterprise antivirus license. The AVStripper with a 250-user license is priced at $10,995. ISP licenses that are not based on the number of users are available directly from Trend Micro.

AVStripper prices include the appliance, licensing, and all upgrades/updates and maintenance for one year. After the first year, antivirus licenses must be renewed annually, starting at $145 for 25 users. Maintenance contracts are also available after the first year to cover non-antivirus software upgrades/updates, professional services, and 24-28 hour product replacement, starting at $599 for 25 users.

Documentation for AVStripper is a bit thin—the only manual is a brief Getting Started Guide, supplemented by on-line network diagrams and a few questions in the Ositis website knowledge base. The admin GUI does not include help text. In truth, there is so little to configure that extensive documentation is not required. However, documentation explaining alerts and log files would be a welcome addition.

Lack of paper documentation in no way implies lack of technical support. Ositis staff responded quickly and helpfully to every support request made by e-mail or phone. Toll free phone support is available from 7 am to 5 pm PST, Monday through Friday.

The Bottom Line
Ositis initially marketed AVStripper to large enterprises. "A typical customer might have thousands of users that need to be protected," said James. "Other gateway antivirus solutions are not working because they require massive network changes—in proxies, addressing, and firewalls—which of course are not desirable." To simplify deployment in existing networks, Ositis worked hard to make AVStripper a transparent bridge. Ositis claims that AVStripper implementation takes just two hours. Based upon our own experience, this estimate is reasonable—perhaps even high.

The AVStripper is also aimed at markets where downtime is critical but IT staff is limited, including government agencies, schools, and small businesses. Smaller ISPs and system integrators can benefit from providing cost-effective, transparent network antivirus to customers. Elk River Computers, a business computer solutions provider based in Missouri, is one of the AVStripper's first customers in this category.

Configuration simplicity and automated operation make the AVStripper attractive to companies looking for virus protection without administrative hand-holding. Larger organizations with extensive IT infrastructure will appreciate AVStripper's network transparency, but wish for more extensive integration features—for example, WebTrends reporting or alerts sent as SNMP traps to an upstream NMS.

As it happens, AVStripper was defending our office network when Klez made its first appearance on April 17th. We could not have asked for a better example to illustrate the value of two-tier virus protection. Not only did AVStripper block Klez before any desktop could be infected, it did so before our desktop antivirus pattern files were updated. Ositis estimates that repairing one unprotected desktop after infection costs $1000. If just three desktop infections were avoided by using AVStripper that day, this unit paid for itself.

—End