6
Copyright © 1990-2011 Norman ASA
Norman Network Protection
Administrator Guide
Introduction | Implementation
Norman Network Protection versus proxy
Traditional proxy solutions have several drawbacks. Most important is the latency effect because the
proxy holds back the entire stream until it has received all the data and analyzed it in its entirety.
Network Protection avoids this problem since it does not hold back more data than necessary. It takes
packets from the stream and reassembles them locally as a file. When the amount of data collected is
what the scanner engine has required, the packets are duplicated in Network Protection and the origi-
nals are passed on.
However, when the engine is busy scanning, the packets are held back until the engine returns with
status OK. In this case a slight delay in the transmission of the last packet may be experienced, but
generally there is practically no interruption to the packet flow. Packets belonging to an unsupported
session type are not scanned. As the stream is passing through the system it is scanned, and as soon
as something malicious is found, the stream is stopped.
Proxy servers require quite a bit of configuration on both servers and clients. Moreover, the proxy
solution needs maintenance when running in the network.
Network Protection is transparent to the network operation and requires no network adaptation and
very little assistance to keep it in order once it is up and running. Since Network Protection works on
packet level, the system has full control over the network flow.
What is Norman Network Protection?
Norman Network Protection is a new technology from Norman providing protection for an entire local
area network or critical segment of a network. Norman Network Protection can be installed onto an
Intel based server with three network interfaces. One network interface is reserved for alerting and
remote configuration and the remaining interfaces collect network packets for scanning from the net-
work segments they are connected to.
In a pair of connected interfaces, one interface provides an upstream or naked network connection,
while the second interface provides the downstream or protected network connection. The network
connections can be of any physical type that supports the TCP/IP protocol.
Figure 1: The Network Protection installed
In Figure 1 Network Protection runs
NIC1
and
NIC2
in promiscuous mode. This means that all net-
work packets from the other network will be received by the network cards regardless of their destina-
tion address.
Packets of the selected protocol type are then gathered into a group and passed on to the scanning
engine to be scanned for malicious code. If the group of packets are clean, they are passed on to the
protected zone via
NIC2
. If the packets contain malicious code, they are effectively blocked from the
protected zone and an alert is sent to the network via
NIC0
. Norman Network Protection is also avail-
able as an appliance.
NIC1
NIC2
NIC0
