Application layer?

Could someone tell me where NOD32 stops virii, compared to this article: http://www.chetbacon.com/LessonPlans/osi-explained.htm

Would it be towards the application layer or more towards the data link layer?

Thanks!

 

More towards the application level... probably around the session layer (layer 5) if I had to guess an exact location.

The IMON module of NOD32 is implemented as a Layered Service Protocol (LSP) within Winsock. Think of an LSP as a "plugin". Winsock acts as an interface in Windows between the applications and the transport layer (layer 4). In effect, IMON intercepts traffic coming in at the port level (port 110 for POP3 scanning... ports 80, 8080, 3128, etc. for HTTP traffic) and then scans it before passing it along to the application.

That's my take on it, anyway. Another link to look at: http://en.wikipedia.org/wiki/OSI_model

 

Great answer....thank you.