Clamav: does it scan filesystem or traffic?

[mohitgupta]

I have installed Clamav, freshclam, and luci-app-clamav.
I am a little confused if it scans all the http/ftp/etc traffic to detect a malware/virus/..
or does it scan the openwrt router filesystem to detect any malicious files?

Thanks in Advance

[vgaetera]

@mohitgupta

if it scans all the http/ftp/etc traffic to detect a malware/virus/..

No.

Traffic is mostly encrypted nowadays.
Analyzing it in real-time requires a lot of hardware resources.
In addition, you need to set up a proxy server on the router and configure it on the clients.
Then, make the proxy and antivirus work together is another serious problem.

@mohitgupta

or does it scan the openwrt router filesystem to detect any malicious files?

Most likely no because it is usually pointless.

A typical use case for ClamAV is to scan emails and file shares on the respective servers.

On the other hand, you can use ad-blocking to block fishing and malware domains.

[mohitgupta]

thanks @vgaetera for a quick response. the explanation is really helpful.