Running the Apparent Data Type can be similar to running the command ` file` on a Linux machine.ĭENY _data_type=(PDF, executable) If a PDF file has been renamed into MP3, the Apparent Data Type will remain PDF and the policy action Allow or Deny will be based on that piece of information. It doesn't look at a file extension/name at all but the actual payload of the file. When using the Apparent Data Type object, the ProxySG will look at the initial bytes of a file to determine its type.

If a true PDF file has its name changed to EXE, the webserver will set the HTTP header Content-Type to application/x-mdos-program which is the MIME type for EXE and not PDF.īelow is an example of HTTP headers (request in red and response in blue) taken from a Wireshark Packet Capture. The webserver will define the MIME type based on the file name extension. Please note the webserver does not look deeply into the file to define the MIME type.

If the webserver sends the Content-Type in the HTTP response, the ProxySG will look at this piece of information from the HTTP headers and the ProxySG will allow/deny the access depending on the Content-Type.

However, some webservers are configured to not send the Content-Type of the file. Most of the webservers send the Content-Type information by default. These headers will usually contain the 'Content-Type' information or also known as HTTP MIME type. In this example above, the extension of the file is included in the URL.Īfter the download, the webserver sends some HTTP headers in the HTTP response. This can work only if the extension of the file is contained in the URL.įor example, song.mp3 has the extension mp3.

In the ProxySG's policy, you can use the following policy objects to block a file.

Wireshark http download filename