Reducing CPU load on the Terminal Server
Load balancing and failover solution
Norman SandBox
NVCnet concept
Updating virus definition files

Reducing CPU load on the Terminal Server
Back to top

In a Terminal server environment, NVCnet adds flexibility and predictability to the environment. By adding dedicated NVCnet servers to the network, this moves the scanning load from the Terminal server itself, to a separate virus scanning NVCnet server. Consequently, most of the terminal servers resources can be used to manage files and users, without interruptions caused by virus scanning.

By combining on-access scanning with the NVCnet technology, it is possible for a network administrator to more accurately predict both the resources needed to scan for viruses and the resources needed for the terminal services. When CPU load on the terminal server passes a set limit, the virus scanning is transferred to the dedicated NVCnet server. The CPU load on the Terminal server will be lower, more stable, and not dependent on the type of files handled by the scanner.

Load balancing and failover solution
Back to top

It is also possible to have several NVCnet servers connected to the Terminal server. Then even more flexibility is added to the system by letting the next NVCnet server in the range take over if the first NVCnet server is already under heavy load.

Using at least two NVCnet servers also gives a failover solution, ensuring that OnAccess virus scanning will continue, even if one NVCnet server fails. This solution also give the possibility of updating the servers with patches etc. without the need for stopping AV scanning and thereby risk a potential virus infection.

Norman SandBox
Back to top

Norman’s SandBox technology detects new and unknown computer viruses, including trojans and worms. Today, an email worm can infect tens of thousands of workstations in a matter of seconds. The antivirus vendors are expected to find the cure, update the virus definition files, and distribute these to their customers immediately. The need for speed is paramount. Norman’s SandBox is a virtual world where everything is simulated. An emulator provides an environment where possible virus infected executables “run" just as they would do on a real system. When execution stops, the SandBox is analyzed for changes. The SandBox is particularly tuned to find new email-, network- and peer-to-peer worms.

NVCnet concept
Back to top

NVCnet represents a new approach to the issues of load distribution, reduced CPU usage, failover and updateability in AV applications. It implements a network layer between the scanner engine and the object identified for scanning. The result is a client-server approach for virus scanning, where the NVCnet client resides on the Terminal server(s) passing the objects that are to be scanned over to the NVCnet server where the actual scanning for viruses is performed.

Network scanning is not new, but has usually been performed by classic AV applications accessing files through remotely mounted shares. In NVCnet, the network layer is located between the NSE (Norman Scanner Engine) and the object to be scanned. There is no overhead caused by network clients, and all I/O is done by the thin client as instructed by the remote NSE. The logic of the NSE generates only small pieces of the object for transfer across the network since the scanner engine only requests the parts of the object that it needs for virus detection. Since the NSE resides on the NVCnet server, a database update on this central server will cause all clients that use this server to be updated.

Updating virus definition files
Back to top

As a running version of NVC for servers has to be installed on the NVCnet server, the updates of virus definition files will be handled by the standard NVC update module - Norman Internet Update (NIU). Norman Internet Update can be configured to regularly check for new and updated files on Norman’s product servers.
NIU offers complete updating and upgrading of the NVC software to ensure that virus definitions are kept up to date and that you are always running the latest version of the software. The Norman Internet Update uses incremental updates of virus definition files to keep the size of the updates as small as possible, thereby reducing the network load and increase the speed for distributing updates.