7.1 How to interface with fpscand

This section applies to F-PROT Antivirus for UNIX File Server and Mail Server versions only

This section describes best practices for 3rd party applications to interface with the F-PROT Antivirus Daemon Scanner to scan for viruses.

fpscand is the F-PROT Antivirus Daemon Scanner program. For general usage information and help, please read the section on F-PROT Antivirus Daemon Scanner in this helpfile as well as the man page (fpscand).

Note that although fpscand can scan MIME-encoded files, its MIME support is minimal and client applications should, if at all possible, decode e-mail attachments using robust MIME parsers before handing those attachments to fpscand for scanning. F-PROT Antivirus for Mail Servers uses a program called scan-mail.pl for this purpose.

How it works

By default, fpscand listens on port 10200 on the loopback address, 127.0.0.1. This can be changed either via the -a or --address startup arguments to fpscand, or by setting a different address:port in the FPSCAND_LISTENADDRESS variable in the config file /etc/f-prot.conf.

Communicating with the F-PROT Antivirus Daemon Scanner (fpscand)

fpscand uses a special syntax. First you establish a connection to the port and then the scan requests follow.

    telnet localhost 10200
    SCAN FILE /path/to/file
    SCAN STREAM streamname SIZE <n>
    .. a stream of n bytes ..

Please note that the SIZE <n> must be followed by a newline symbol before the stream is fed in.

Then, fpscand sends a result string back to the port, where the client can read it back and parse. The result string is of the form:

n <descriptive text> <name of the scanned object>

Where n is the result code.

Example:

    telnet localhost 10200
    SCAN FILE /home/user/somefile.zip
    .. result string sent back ..
    SCAN FILE /home/user/otherfile.zip
    .. result string sent back ..

It is also possible to set up a queue of scans. This is done by entering the QUEUE command, followed by a series of queue requests. The queue is then processed when an empty SCAN command is given.

Example:

    telnet localhost 10200
    QUEUE
    SCAN FILE /home/user/somefile.zip
    SCAN FILE /home/user/otherfile.zip
    SCAN
    .. result string for /home/user/somefile.zip sent back ..
    .. result string for /home/user/otherfile.zip sent back ..

Although fpscand will currently return the results for files in the same order it received them, this is not guaranteed to hold in the future.

Note: FRISK Software offers a virus scan library and software development kits to licensed 3rd party software developers that need virus scanning capabilities.

Back to Index

Copyright © 2007 FRISK Software International. All rights reserved