Panda GateDefender Performa 8100 - West Coast Labs

Test Report June 2007 

Panda GateDefender 

Performa 8100 

Anti-Spam Technology Report

Panda GateDefender Performa 8100 

Vendor Details 

Name: Panda 

Address: PANDA SOFTWARE INTERNATIONAL S.L. 

c/Buenos Aires, 12, 48001 Bilbao, Spain 

Telephone: +34 91 806 3700 

Website: www.pandasoftware.com 

Product: GateDefender Performa 8100 

Test Laboratory Details 

Name: West Coast Labs 

Address: William Knox House, Britannic Way, Llandarcy, 

Swansea, UK, SA10 9EL 

Telephone: +44 (0) 1792 324000 

Date: June 2007 

Issue 1.0 

Author: G. Samuel 

Contact Point 

Contact name: M. Garrard 

Contact telephone number: +44 (0) 1792 324000 

2 Test Report www.westcoastlabs.com


Contents 

Introduction 4 

Test Network 6 

Test Methodology 7 

Product Test Reporting 8 

The Product 9 

Test Report 10 

West Coast Labs Conclusion 17 

Security Features Buyers Guide 18 

www.westcoastlabs.com Test Report 3


Introduction 

The ever evolving spam threat 

“Two years from now, spam will be solved.” Bill Gates – Jan. 2004 

At the beginning of 2004, Bill Gates was addressing the World Economic 

Forum in Switzerland and confidently predicted that “Two years from now, 

spam will be solved.” Sadly his prophecy has proved somewhat wide of the 

mark as reports continue to emerge about the size of the problem. 

The latter half of 2006 saw an unprecedented rise in spam volumes with 

SurfControl reporting a 50% increase in spam over the previous half year, 

and spam now accounting for almost 90% of all email traffic on the Internet. 

The nature of spam has also changed. In 2004 spam content was 

dominated by pornography, Viagra sales and the infamous “Nigerian 

scam” advance-fee fraud spam. Those types of spam are very much still 

with us but have been added to by phishing attacks, “Pump-and-Dump” 

scams (which involve artificially inflating the price of a stock in order to 

make a quick profit on stock previously purchased cheaply) and spam 

that tricks users into following URL links to web sites that download malicious 

code that will compromise their machines. 

The methods used by spammers to launch their attacks have also 

transformed over time. The vast majority of unsolicited email is now being 

sent via vast armies of infected PCs known as botnets – often these are 

the machines of home users who are unaware that they are part of the 

problem. 

This distributed system approach is making it more difficult to separate out 

spam emails based upon simple network-based criteria, and so companies 

providing anti-spam technologies are having to provide more intelligent 

filtering solutions. 



In a recent interview, Dr Richard Cullen, distinguished engineer at 

SurfControl said, “The threat landscape has changed dramatically over 

the past couple of years. Malware attacks are now commercial ventures, 

with well organized cybercrime gangs harnessing the power of vast botnet 

armies to launch spam, phishing, DDOS and malware attacks.” 

The spammers are also always trying to find new ways of bypassing antispam 

defenses. One such technique that is on the increase is image spam 

– emails with images containing the spammer’s messages within random 

text designed to foil less sophisticated spam filters. Peter Firstbrook, security 

research director for Gartner, has reported that image spam went from 6 

percent of all spam in Q3 of 2006 to 30 percent by Q4, and it is now thought 

to make up almost 40% of all spam. 

Apart from being harder to block, image spam also causes knock-on 

problems because the spam messages are actually larger than simple 

text messages. According to some reports, the average size of a spam 

message has increased by 77% since September last year, from 6.62Kbytes 

to 11.76K) and continues steadily to grow. This adds to the cost of managing 

email, it wastes bandwidth and also consumes storage if a company needs 

to archive all incoming mail. 

And according to the New York Times security columnist John Markoff, one 

recent botnet outbreak managed to consume 15% of Yahoo’s resources 

while searching for random pieces of text to pad out such image-based 

messages. 

As a result, anti-spam vendors are now having to adapt to this new threat 

by both enhancing existing techniques such as heuristics rules to analyze 

the characteristics of image-based spam, and by adding new technology 

layers, such as optical character recognition technologies. Where will it all 

end? 



Test Network 

WCL has a number of domains that collect genuine spam. These 

domains receive varying levels of spam and are consistent with 

different email environments. 

To reflect the email usage within a corporate environment, within each 

domain are a number of designated user accounts with a variety of 

email practices and needs including some that are subscribed to a 

variety of newsgroups and mailing lists. Some user accounts actively 

contribute to mailing lists. 

The multiple domains designated for testing purposes were those that, 

between them, receive spam at a level consistent with the defined 

requirements of testing. 

Software solutions included in the test program were installed on 

servers that meet the minimum specifications required by the vendor. 

Appliance-based solutions were installed on the network according to 

the vendor’s recommended placing. 

For hosted services, WCL testes through identified email domains and 

changed the MX records to divert the mail stream through the hosted 

service. 



Test Methodology 

WCL initially performed the testing with an “out-of-the-box” 

configuration, changing only those settings on the solution needed 

to ensure correct operation inline with the vendors recommended 

installation and configuration procedures. 

Further testing was then be performed at following the vendor’s 

advice for the tuning or training of the solution under test. WCL finetuned 

the solution each day of the test, spending no more than half an 

hour per day undertaking such work. 

Throughout the course of testing, a mixture of email was be sent to the 

test domains from other email addresses and domains controlled by 

WCL to mirror genuine email activity common in business, for example 

requesting meetings, sending notifications to groups and non-business 

related social emails. 

Emails were also be sent from web-based accounts such as Hotmail 

and Google’s Gmail in order to simulate external users sending nonbusiness 

related social emails, and home workers. 

Thus, during the testing period the domains received some spam, 

some list/newsgroup mailings and “genuine” individual emails. 



Product Test Reporting 

Product evaluation addresses three specific areas* - Management/ 

Administration, Functionality, Performance plus Additional Feature 

Testing. 

1. Management/Administration 

• Ease of Setup/Installation 

• Ease of Use 

• Logging and reporting function 

2. Functionality 

• Email Processing Steps 

• Allow/Blocking of Email 

• Quarantine Area 

• Additional functionality 

reporting 

3. Performance 

• Volume or Percentage of spam 

detected 

• False positive rate 

• Spam incorrectly passed 

through 

• Rule creation 

• Customization 

• Content Categories 

• Steps to Process Email 

• Block Email Addresses 

• Blacklist/Whitelist 

• Allow Email Addresses 

• Legitimate mail blocked 

• Legitimate subscription mail 

blocked 



The Product 

Introduction 

Panda GateDefender Performa is a dedicated Secure Content 

Management (SCM) hardware device that is deployed at the network 

perimeter. It is designed to shield against viruses, Spam and other types 

of inappropriate network base content. 

In order to accomplish this, the solution includes an Anti-Spam module 

to stop unsolicited e-mail that can cause the loss of employee 

productivity and can impact upon efficiency. There are also Anti- 

Malware capabilities that can protect against differing forms of 

malware and potentially unwanted programs. Further to this, there is 

Content Filtering that monitors incoming file types, and Web Filtering 

that scans the content of web pages. This can perform various 

actions based upon category to prevent users from viewing any 

sexually explicit or violent content, or any other content deemed 

inappropriate. 

The appliance provides protocol protection for both incoming and 

outgoing traffic, by scanning many of the most commonly used 

protocols. These include, amongst others, HTTP, FTP, SMTP, POP3, and 

IMAP4. All testing for this Technology report was carried out over the 

SMTP protocol. 



Installation and Configuration 

The 1U rackmountable hardware device includes an LCD display on 

the front that provides status information for the device. Information 

available through the LCD includes CPU usage, Configuration 

IP address, Network IP address, Appliance version info, the Serial 

number, and the display also allows access to the Reset capabilities 

for the services and system. There are also two gigabit Ethernet ports 

available for internal and external connectivity on the front. At the 

rear there is a power switch and connections available for power and 

a Serial Connection. 

An Administrator uses a preset IP address to initially access the web 

console. After this the Panda GateDefender Performa configuration 

IP address is entered so that the box may fit onto the appropriate 

company network. No modifications need to be made to the existing 

mail server, which means that there is no requirement for that to be 

stopped. This is a definite advantage for any Administrator wishing to 

avoid downtime. 



Interface 

After the configuration 

parameters are entered, the 

appliance can then be further 

customised and configured. Valid 

authentication details need to 

be entered before access into 

the SSL encrypted web interface 

is granted. Once logged in, 

the Administrator has access to 

Device Configuration, Tools, Reporting options and Administration 

features. It is a simple process to modify any of the settings for the 

supported services, utilities, features and protocols supported. 

The Status window provides 

updated information about the 

current performance of Panda 

GateDefender Performa. It is 

the first screen that appears 

after a successful logon to the 

administration console. An 

Administrator may use this screen 

to perform a quick check to 

determine whether or not the appliance is operating correctly. 

If an Administrator discovers that an area of the solution needs 

attention, information is available within this section that includes 

System date and time, warnings for any errors that may have occurred, 

update information, and the date that the Panda GateDefender 

Performa licenses are due to expire. Additional information provided 



includes protection status for the different protocols supported, and 

graphical representations of various data. There are also different 

selectable modes for viewing this data. 

Registration and activation details are controlled from the License 

Management menu. In order to enter or check the license number 

and other registration details, a link is provided by which the device 

can contact the Panda Software server to retrieve information about 

the licenses. 

Although update processes are 

carried out automatically every 

90 minutes for the definition files, 

an Administrator may also launch 

an immediate update manually 

if required. This is a simple process 

and the updates are delivered via 

the HTTP protocol. 

Each individual menu within the interface subsequently provides 

additional links on the opposite side of the screen that relate to 

the category selected, making optimum use of the screen space 

available. 

The web-based interface is simple to navigate and descriptions are 

concise and informative. This ensures that there is a minimal learning 

curve required, meaning that the Administrator can very quickly get 

the optimum performance from the options, features and services 

provided by the device. Help links provide concise and easy-tounderstand 

information. 



Detailed statistics for Anti-Spam can 

be found under Security protection 

on the Activity screen. Real-time 

statistics for Anti-Spam scans are 

displayed – these include the 

number of messages scanned, 

number of messages classified as 

Spam, and percentages for the 

total amount of messages scanned. 

The View Details link is also available to provide more descriptive 

output. 



Configuration and Customisation 

The configuration of the Anti-Spam 

protection settings found under 

the Protection settings menu is a 

key part of the implementation of 

the solution. From these settings, 

an Administrator specifies what 

protocols may be scanned for 

Spam (SMTP, POP3, or IMAP4), the 

sensitivity level that needs to be 

set for the Anti-Spam protection, the actions Panda GateDefender 

Performa should perform on messages classified as Spam or Probably 

Spam, and white list and blacklist configuration. For the purposes of 

this test, engineers entered internal domain information, mail server 

settings, and an email address for redirection. 

Configuring the scanning is a simple process, merely consisting of 

enabling the appropriate checkbox on a per protocol basis, setting 

the required sensitivity level to Low, Medium, or High, and selecting 

the Action to take on messages classified as Probably Spam or Spam. 

There are additional settings available for whitelist and blacklist 

configuration. The whitelist and blacklist functionality may be 

configured by an Administrator to define a list of addresses, domains 

and/or IP addresses for which messages will not be scanned for Spam 

or for which messages will always be treated as Spam. 

The sensitivity level for the Anti-Spam protection specifies the tolerance 

level of the protection to suspicious messages. The Low sensitivity level 

provides the least protection against these types of messages, but this 

also means that it is highly improbable that the appliance will have a 



significant false positive rate. The Medium sensitivity level for Panda 

GateDefender Performa provides a higher level of detection against 

Spam, but with a greater probability of false positives. The highest level 

of sensitivity provides the highest protection rate but the risk of false 

positives also increases. 

An Administrator may select an appropriate action for Panda 

GateDefender Performa to take on messages classified as Probably 

Spam or Spam. Each message classified may be let through (with a 

report generated), may be redirected to a particular email address, or 

may be deleted. For the purpose of testing, West Coast Labs engineers 

decided that the actions to take on messages classified as Spam 

should be set to pass the message through, to generate a report, and 

to prefix the subject line with defaults tags of [Probably Spam] and 

[Spam]. This ensured that the engineers were able to filter through 

the messages and categorise them into their respective categories 

without difficulty. 



Reporting 

Panda GateDefender Performa 

generates detailed reports for Spam 

detected. Information available 

for viewing includes Classification, 

Sender, Recipient, Subject, Date-time, 

Protocol, and Action taken for each of 

the messages (flagged, redirected, or 

deleted). More detailed information 

about each event is displayed, if an Administrator double clicks on the 

link [+] at the left of the option. 

An Administrator may configure the report to display a certain number 

of lines on a page, or to delete incidents after a certain number of 

days. These options are provided through the Settings link. 

Events for messages in the Anti-Spam reports may be filtered based on 

the criteria provided in one field or more. An Administrator may filter 

reports by Date, Spam classification, Protocol, Sender of the message, 

Recipient of the message, or by Action taken. Columns containing 

the information displayed may also be sorted into ascending or 

descending order. 

Mail activity details for Anti-Spam protection for the SMTP protocol may 

be viewed either as absolute values or as percentages over differing 

time periods for Last 24 hours, Last 7 days, In the last month, In the last 

year or for Specific dates. 

Events for Spam entries included in the report may be exported to a 

file, (the default being a comma separated format, .csv), for inclusion 

into external reports or for further analysis in a spreadsheet application. 

Following this, an Administrator may delete all the entries from the 

report if required. 



Conclusion 

Panda GateDefender Performa incorporates protection to defend 

against the many sophisticated forms and ever-increasing numbers 

of threats. The appliance is straightforward to set up and configure, 

and options relating to the services and protocols supported can be 

changed quickly through the web-based interface that is easy to 

navigate. 

The ability of the appliance to perform updates at regular intervals 

without user intervention are appreciated as the solution can be left to 

its own devices to obtain the latest protection files. 

The Help information provided is informative, concise, and appropriate 

at all stages. This useful information ensures that an Administrator can 

quickly discover the solution to any potential problems relating to any 

aspect of the device. 

Panda GateDefender Performa range can be customised with ease, 

and the ability of the appliance both to work transparently and to 

be remotely administered is a boon for Administrators. Unite these 

capabilities with high quality protection and reporting features, and 

the Panda GateDefender Performa offers effective protection from 

Spam. 



Security Features Buyers Guide 

Panda GateDefender Performa is a dedicated appliance designed 

to provide maximum protection against Contents based threats at the 

Internet gateway, blocking malware, spam and undesirable content 

before they enter the enterprise. 

www.pandasoftware.com/products/GateDefender_Performa.htm 

GateDefender Performa is available in three models that cover the 

needs of all small, mid-sized and large companies or ISPs, adjusting scan 

capacity to the overall volume of network traffic 

Business Benefits….as stated by Panda 

• Optimization of network resources: Bandwidth use will be optimized 

because all the incoming and outgoing unnecessary traffic will be 

blocked. Servers and internal network will also be freed from huge mail 

traffic 

• Users productivity increment: All junk traffic spam and navigation 

through non productive web pages, will be blocked allowing users to 

dedicate to more relevant tasks 

• Low cost of ownership: Justified by the quick and easy installation 

process (Plug-in and forget), the network resources saturation 

prevention and the easy to use and powerful management 

capabilities 

• Reputation Protection: All potentially dangerous or unnecessary 

incoming or outgoing traffic can be blocked. 



Technical Benefits….as stated by Panda 

• Complete protection: Protects against viruses, spam and undesirable 

contents before they enter the network, scanning the six most common 

protocols (HTTP, SMTP, POP3, IMAP4, FTP & NNTP). 

• Always up: All signatures files are updated every 15 to 90 minutes and 

high availability resources guarantee the non-stop functioning 

• Plugin and forget: It is installed in minutes. No change in network 

configuration is needed: It works as a transparent bridge 

• High Performance and scalability: It is a dedicated specialized 

appliance reaching the highest performance. The automatic native 

Load Balance protects the investment and guarantees the availability 

in case of company traffic growth 



Security Features Buyers Guide 

Panda GateDefender Performa 8100 – developments in the last 12 months 

New versions of the anti-spam engine have been released with the 

product in order to maximize the rate of spam detection. The major 

benefits include: 

• Added image analysis to improve accuracy and performance of 

messages with images. 

• Support for enhanced phishing detection. 

• Support for authentication standards, by providing instant SPF 

information via a cached database without the need for an online 

check. 

• Improved foreign language support. Unicode support is added, for 

improved performance among double byte (e.g. Asian) character 

sets. 

• Increased frequency of rule updates to provide ‘real-time’ response 

against spam attacks. An exclusive pool of servers is used for the 

product, in order to guarantee server availability and prevent network 

errors. 

In addition, there is a continuous feedback from customers to increment 

the spam catch rate while keeping the number of false positives to a 

minimum. 



Additional Noteworthy Product Features 

Anti-malware filtering 

The Anti-malware protection detects and blocks all types of malware 

before it can reach the network: viruses, worms, trojans, spyware, dialers, 

jokes, phishing, hacking tools and unknown threats, thanks to its heuristic 

genetic engine. 

Content Filter 

The Content filter engine lets you customize the message and file filters, 

including file size limits, maximum number of compressed files, filters on 

passwords protected files, files with macros, etc. It can also scan nested 

messages and their attachments, and filter by content, subject, type, etc. 

Anti-spam protection 

Panda GateDefender Performa anti-spam module checks all e-mail 

entering the company, significantly reducing the repercussions of spam 

on productivity. Each message is classified as spam, probable spam or 

not spam, and the sensitivity of the scan can be adjusted. Administrator 

can also configure white lists and black lists. 

Web filtering by category 

The Web Filtering module, allows the control of the use of corporate 

network resources and prevent offensive, sexual or violent web content 

from entering the company, which can degrade the work environment 

and productivity as well as compromising corporate image if these are 

forwarded or reproduced by staff. 

GateDefender Performa also allows administrators to create a list of VIP 

users who will be exempt from the web filtering criteria. 

Auto-updates 

The updates against new threats are configured by default to be carried 



out automatically every 90 minutes, ensuring that the software version 

and the malware Signature File are constantly updated against any new 

viruses that could appear. 

Detailed graphic reports and customizable alerts 

The administrator can control, in real-time, network traffic and all the 

protection activity statistics. Panda GateDefender Performa offers 

comprehensive virus, spam and content filtering graphical exportable 

reports, as well as customizable alerts and notifications. 

High performance protection 

The integration of hardware and software allows Panda GateDefender 

Performa to offer excellent performance and the highest scanning 

capability of its class: up to 350 messages per second and 170 Mbps, 

completely transparently to corporate network users. 

High scalability and load balancing 

Thanks to its high scalability, Panda GateDefender Performa adapts 

perfectly to the needs of all small, mid-sized and large companies, 

adjusting scan capacity to the overall volume of network traffic. 

Its load balancing is completely automatic and native, allowing 

workload to be shared across multiple units. The result is increased 

scalability and improved performance for complete protection of your 

network perimeter. 

Centralized monitoring 

Panda GateDefender Performa units can send all events notifications, 

customized alerts and system variables status through e-mail, SNMP 

protocol and/or Syslog standard system in order to allow administrator 

control all the activity related to the different security devices installed in 

the network, from a centralized control application. 


US SALES 

T +1 925 833 6935 

EUROPE SALES 

T +44 1792 324000 

GLOBAL HEADQUARTERS 

West Coast Labs 

William Knox House 

Britannic Way 

Llandarcy 

Swansea SA10 6EL, UK

Panda GateDefender Performa 8100 - West Coast Labs

Create successful ePaper yourself

Delete template?

Save as template?