The data is allowed or blocked based on the response of the kernel. Stream mode - where traffic for the selected protocols is processed in the kernel on the stream of data without storing the entire file.The data is allowed or blocked based on the response of the Traditional Anti-Virus engine. The security server forwards the data stream to the Traditional Anti-Virus engine. Proactive mode - a file-based solution where traffic for the selected protocols is trapped in the kernel and forwarded to the security server.Traditional Anti-Virus inspection uses these detection modes: Understanding Traditional Anti-Virus Scanning Options Using Traditional Anti-Virus In This Appendix
