关于WG，求官人解释

blue_仰望

不多说，直接上图

以前一直没有的情况，今天突然发现了……

Dirk

流量扫描，当然最高

blue_仰望

Dirk 发表于 2011-6-30 18:54
流量扫描，当然最高

知道扫描，可是这也太离谱了吧……以前一直么有发现卡下载速度的……

xiaojinglf

很正常嘛。小红伞wg采用lsp过滤。所以所有网络流量必须经过wg

blue_仰望

xiaojinglf 发表于 2011-6-30 19:13
很正常嘛。小红伞wg采用lsp过滤。所以所有网络流量必须经过wg

我知道必须经过wg过滤，可是过滤之后的流量也太小了点吧……

Knight01

HI,

WebGuard 与 HTTP 代{过}{滤}理类似，需要缓存某些数据以进行扫描。所以该图片中其实是 WebGuard 把正在下载的文件缓存然后进行扫描。

请问你现在可以登入阿里旺旺吗？
http://forum.avira.com/wbb/index ... amp;threadID=132582

hsezbmh

lniwn 发表于 2011-6-30 18:58
知道扫描，可是这也太离谱了吧……以前一直么有发现卡下载速度的……

wg有网络通信扫描，所以会卡网速，这个只要是有网络通信扫描的杀软都有的现象
另外关于卫士的流量监控，是吧网络通讯扫描的速度记在红伞上了，所以会有右图的现象

xiaojinglf

lniwn 发表于 2011-6-30 19:14
我知道必须经过wg过滤，可是过滤之后的流量也太小了点吧……

建议采用tcpview查看一下流量情况。

blue_仰望

Knight01 发表于 2011-6-30 19:14
HI,

WebGuard 与 HTTP 代{过}{滤}理类似，需要缓存某些数据以进行扫描。所以该图片中其实是 WebGuard 把 ...

还是上不去额……

2011/6/30,19:22:14 [INFO] [3295] Remote Address 110.75.162.1:80; Process ID 1604
2011/6/30,19:22:15 [INFO] [3296] Remote Address 110.75.162.1:80; Process ID 1604
2011/6/30,19:22:15 [INFO] [3295] The local computer has cancelled the connection
2011/6/30,19:22:15 [INFO] [3295] The local computer has cancelled the connection
2011/6/30,19:22:15 [INFO] [3295] The remote computer has cancelled the connection
2011/6/30,19:22:50 [INFO] [3296] The remote computer has cancelled the connection
2011/6/30,19:23:30 [INFO] [3297] Remote Address 110.75.162.1:80; Process ID 1604
2011/6/30,19:23:35 [INFO] [3298] Remote Address 110.75.162.1:80; Process ID 1604
2011/6/30,19:23:35 [INFO] [3297] The local computer has cancelled the connection
2011/6/30,19:23:35 [INFO] [3297] The local computer has cancelled the connection
2011/6/30,19:23:35 [INFO] [3297] The remote computer has cancelled the connection
2011/6/30,19:23:50 [INFO] [3299] Remote Address 110.75.180.189:80; Process ID 2224
2011/6/30,19:23:50 [INFO] [3299] Requested URL: http://control.im.alisoft.com/re ... chn&ctx=alitalk
2011/6/30,19:23:51 [INFO] [3299] No malware found
2011/6/30,19:23:51 [INFO] [3299] The local computer has cancelled the connection
2011/6/30,19:24:11 [INFO] [3298] The remote computer has cancelled the connection
2011/6/30,19:24:49 [INFO] Configuration is updated
2011/6/30,19:24:49 [INFO] Current configuration:
        - Exclude files with MIME types: video application/x-mms-framed application/vnd.rn-realmedia application/x-troff-msvideo application/x-rtsp-tunnelled application/x-pncmd multipart/x-mixed-replace audio
        - Exclude files with file extensions: .flv .ogg
        - Files with this MIME type will be blocked:
        - Files with this file extension will be blocked:
        - Exclude websites:
        - Default action: 0
        - Action on detection: 0
        - Macrovirus heuristic is enabled in the mode:
        - Win32 file heuristic is enabled in the mode: 2
        - Web classifier: 1
        - Drive-by protection : 15
        - Process Protection: 1
        - Report level: 3

2011/6/30,19:24:50 [INFO] [3300] Remote Address 110.75.162.1:80; Process ID 1604
2011/6/30,19:24:54 [INFO] [3301] Remote Address 110.75.162.1:80; Process ID 1604
2011/6/30,19:24:54 [INFO] [3300] The local computer has cancelled the connection
2011/6/30,19:24:54 [INFO] [3300] The local computer has cancelled the connection
2011/6/30,19:24:54 [INFO] [3300] The remote computer has cancelled the connection
2011/6/30,19:24:55 [INFO] [3302] Remote Address 110.75.162.1:80; Process ID 1604
2011/6/30,19:24:55 [INFO] [3301] The local computer has cancelled the connection
2011/6/30,19:24:55 [INFO] [3301] The local computer has cancelled the connection
2011/6/30,19:24:55 [INFO] [3301] The remote computer has cancelled the connection
2011/6/30,19:25:38 [INFO] [3302] The remote computer has cancelled the connection
2011/6/30,19:25:42 [INFO] [3303] Remote Address 110.75.162.1:80; Process ID 1604
2011/6/30,19:25:43 [INFO] [3304] Remote Address 110.75.162.1:80; Process ID 1604
2011/6/30,19:25:43 [INFO] [3303] The local computer has cancelled the connection
2011/6/30,19:25:43 [INFO] [3303] The local computer has cancelled the connection
2011/6/30,19:25:43 [INFO] [3303] The remote computer has cancelled the connection
2011/6/30,19:25:44 [INFO] [3305] Remote Address 110.75.162.1:80; Process ID 1604
2011/6/30,19:25:44 [INFO] [3304] The local computer has cancelled the connection
2011/6/30,19:25:44 [INFO] [3304] The local computer has cancelled the connection
2011/6/30,19:25:44 [INFO] [3304] The remote computer has cancelled the connection

blue_仰望

xiaojinglf 发表于 2011-6-30 19:20
建议采用tcpview查看一下流量情况。

谢谢你介绍的工具。