Most engineers think…
Most people assume a next-gen firewall with gateway antivirus already stops everything — 'it scans files, so we are covered'. That mental model breaks the moment a brand-new (zero-day) or fileless attack arrives, because there is no signature to match.
SonicWall splits the job in two. The on-box RFDPI engine scans flowing traffic for known threats at line rate. Anything unknown is forwarded to Capture ATP, a cloud multi-engine sandbox, where the patented RTDMI engine forces the code to reveal itself in memory — beating the encryption, obfuscation and delayed-execution tricks that fool ordinary sandboxes. Understanding 'known on-box vs unknown in the cloud' is exactly what an interviewer is listening for.
① Why signatures alone fail — and where Capture ATP fits
A traditional gateway scanner works by signatures: it compares a file against a list of known-bad patterns. That is fast and accurate for malware the world has already seen — but it has a fatal blind spot. A zero-day attack has no signature yet, and a fileless attack may never write a file to scan at all.
SonicWall splits detection into two layers. The on-box RFDPI engine handles the known — gateway AV, IPS and app control on flowing traffic. When a file is unknown or suspicious, RFDPI hands it to Capture ATP, the cloud sandbox, which handles the unknown. The interview line: signatures catch what we already know; Capture ATP exists to catch what we don't.
Why can a signature-only scanner miss a zero-day attack?
② How Capture ATP works — the cloud multi-engine sandbox
Capture ATP (Advanced Threat Protection) is a cloud-based, multi-engine sandbox. The firewall does not detonate files itself; instead it extracts a suspicious file from the traffic it is already inspecting and submits it to the SonicWall Capture cloud. There, several analysis engines run in parallel — a virtualised sandbox plus RTDMI — and reach a consensus verdict of clean or malicious.
The submission flow
The path is: RFDPI flags an unknown file ▸ the firewall forwards it to the Capture cloud ▸ the engines detonate and observe it ▸ a verdict and a detailed report come back. Coverage spans PE/EXE, Office documents, PDFs, archives and scripts — i.e. the file types attackers actually weaponise. Identical files seen later are answered instantly from cache.
SonicWall's cloud-based, multi-engine sandbox. The firewall submits unknown files; several engines analyse them in parallel and return a clean-or-malicious verdict.
Real-Time Deep Memory Inspection — the patented engine that watches code in memory in real time, catching fileless, encrypted and zero-day threats that fool ordinary sandboxes.
Holds a first-seen download at the gateway until the cloud verdict returns, so a risky file never reaches the user before analysis. Slight delay on first sight only.
Reassembly-Free Deep Packet Inspection — the on-box, single-pass engine that scans flowing traffic for known threats. Different layer from RTDMI: known vs unknown.
In an interview, be precise: the firewall does not detonate files itself — it extracts the unknown file and submits it to the Capture cloud, where multiple engines analyse it in parallel. The on-box job is RFDPI; the detonation job is the cloud.
Where does Capture ATP actually detonate and analyse a suspicious file?
③ RTDMI — memory inspection, and RTDMI vs RFDPI
RTDMI (Real-Time Deep Memory Inspection) is SonicWall's patented engine at the heart of Capture ATP. Instead of only watching a file's actions in a sandbox, it inspects what the code does in memory, in real time. That forces malware to reveal its weaponry the instant it executes — so it catches fileless attacks, encrypted and obfuscated malware, zero-day exploits, side-channel attacks and weaponised Office/PDF documents that slip past ordinary sandboxes. Crucially, RTDMI complements the older sandbox engines; it does not replace them.
RTDMI is not RFDPI
A classic interview trap. RFDPI (Reassembly-Free Deep Packet Inspection) is the on-box, single-pass engine that scans flowing traffic for known threats. RTDMI is the cloud memory-inspection engine that detonates the unknown. RFDPI asks 'do I already know this is bad?'; RTDMI asks 'this is unknown — what does it actually do?'
RFDPI is the on-box, single-pass engine for known threats; RTDMI is the cloud memory-inspection engine for unknown ones. Saying 'RTDMI scans packets on the firewall' is the classic wrong answer. Known on-box vs unknown in the cloud.
▶ Watch an unknown download get held, detonated and blocked
How one HTTPS download is inspected end-to-end. Press Play for the healthy path, then Break it to see the classic failure.
What makes RTDMI catch evasive malware that a normal sandbox misses?
④ Block Until Verdict, reporting & sane scoping
Analysis takes a moment, so what happens to the file meanwhile? Block Until Verdict tells the gateway to hold a first-seen file at the firewall until the cloud returns its verdict — nothing risky reaches the user before it has been analysed. The trade-off is a slight delay the first time a file is seen; later identical files are served instantly from cache.
Read it, then scope it
Verdicts and per-file analysis reports appear in Capture Security Center, SonicWall's cloud portal, and the same intelligence ties in with Capture Client on the endpoint. Two scoping rules matter: pick sensible file types to submit, and turn on DPI-SSL — because most downloads are HTTPS, and without decryption the firewall only sees encrypted bytes and can never extract the file to submit it.
Priya at a Hyderabad fintech faces this
A finance user opens a macro-laden invoice .docx downloaded over HTTPS and the endpoint later beacons out — even though Capture ATP is licensed and 'enabled'.
DPI-SSL is off, so the firewall only saw encrypted bytes and never extracted the document to submit it to Capture ATP — the file was never analysed.
In Capture Security Center the document has no analysis record at all (proof it was never submitted); on the firewall, DPI-SSL client inspection is disabled for outbound HTTPS.
Firewall ▸ DPI-SSL ▸ Client Inspection + Capture ATP ▸ File Types & SettingsEnable DPI-SSL client inspection with a sane bypass list (banking/health), confirm Office docs are in the Capture ATP file-type scope, and turn on Block Until Verdict so first-seen files are held.
Re-download a known-suspicious test file over HTTPS — the firewall holds it, RTDMI returns a malicious verdict, the download is blocked, and the per-file report now appears in Capture Security Center.
Never assume a file was checked. Capture Security Center shows the per-file verdict and analysis report. If a download has no record there, it was never submitted — usually because DPI-SSL was off or the file type was out of scope.
Files download fine but Capture ATP never analyses anything over HTTPS. The most likely cause?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: in your own words, why does Capture ATP exist if the firewall already has gateway antivirus? Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- Capture ATP
- SonicWall's cloud-based, multi-engine sandbox. The firewall submits unknown files; several engines analyse them in parallel and return a clean-or-malicious verdict.
- RTDMI
- Real-Time Deep Memory Inspection — the patented cloud engine that watches code behaviour in memory in real time to catch evasive, fileless and zero-day threats.
- RFDPI
- Reassembly-Free Deep Packet Inspection — the firewall's on-box, single-pass engine that scans flowing traffic for known threats (AV/IPS/app control).
- Sandbox
- An isolated environment where a suspect file is detonated and observed safely so its behaviour can be judged clean or malicious.
- Block Until Verdict
- A gateway feature that holds a first-seen file at the firewall until the cloud verdict returns, so a risky file never reaches the user pre-analysis.
- Zero-day
- A brand-new threat with no existing signature, so signature-only tools cannot recognise it — exactly what cloud sandboxing targets.
- Fileless malware
- Malicious code that runs in memory without writing a file to disk, evading file-based scanners — a key thing RTDMI's memory inspection catches.
- DPI-SSL
- Deep Packet Inspection of SSL/TLS — decrypts HTTPS so the firewall can inspect and extract files to submit to Capture ATP.
- Capture Security Center
- SonicWall's cloud portal where Capture ATP verdicts and per-file analysis reports appear and policy is managed.
- Capture Client
- SonicWall's endpoint agent that extends the same threat intelligence to the device for a coordinated network-plus-endpoint defence.
📚 Sources
- SonicWall — Capture Advanced Threat Protection (Capture ATP) product page. sonicwall.com/products/firewalls/security-services/capture-advanced-threat-protection
- SonicWall — Real-Time Deep Memory Inspection (RTDMI) technology overview. sonicwall.com
- SonicWall — Capture ATP datasheet: multi-engine cloud sandboxing & Block Until Verdict. sonicwall.com
- SonicWall — Capture Security Center: cloud management, verdicts and reporting. sonicwall.com
- SonicWall Administration Guide — DPI-SSL and the Capture ATP file-submission dependency. docs.sonicwall.com
- SonicWall — 2026 Cyber Threat Report: RTDMI never-before-seen malware discoveries. sonicwall.com
What's next?
Capture ATP can only analyse a file if the firewall can see it — and most downloads are encrypted. Next, go deep on DPI-SSL: client and server TLS inspection, how the firewall decrypts and re-signs traffic, and the bypass lists that keep it safe and legal.