When ICAP services are invoked

Points at which the ICAP server can be invoked

NetCache can send a request to an ICAP server at either of two different points before the request reaches the origin server, as well as sending content to the ICAP server after the origin server returns the content. Therefore, you can include ICAP services in your deployment that are performed on the request before it reaches the origin server, for example, content filtering. The following illustration shows the points at which a NetCache appliance can invoke an ICAP service.

The following table describes the possible vectoring points for ICAP service in the request flow shown in the previous illustration (labeled A, B, and C), that is, the points at which the NetCache appliance can invoke ICAP services. The same content can be adapted by multiple ICAP services. Therefore, multiple vectoring points could be invoked during the flow of the same request.

Vectoring point	Common services at this vectoring point	Example of use
Request modification stage
(A) After NetCache checks authentication and ACLs but before it checks its cache	Content filtering	Assume that you want to set a policy so that only employees in the finance department can access stock quotes on the Internet. You set the NetCache ICAP feature to send requests, at this vectoring point, to an ICAP content filtering service that is set up to block access to stock quotes. You also use ACLs to allow access to stock quotes for the finance department employees but no other employees.
(B) After NetCache checks its cache and a cache miss occurs	Content filters that are being applied the same way to all users	Assume that you want to block access to sexually explicit sites for all users. You could set the NetCache ICAP feature to send requests to an ICAP content filtering service at this vectoring point.
Response modification stage
(C) After the origin server returns the content that the client requested	Virus scanning, language translation, and advertisement insertion	See Example: modification of responses for a detailed example of the interaction between the NetCache appliance and an ICAP server at this vectoring point.

Example: modification of responses

The following illustration provides a detailed look at the flow of an HTTP request when the vectoring point for an ICAP service is in the response modification stage. In the response modification stage, NetCache passes the response from the origin server to an ICAP server for processing, in this case, for virus scanning.

The following table describes the flow of a request.

Stage	Description
1	The client makes an HTTP request to download an executable file, which is sent to the NetCache appliance.
2	If...	Then...
	If the NetCache appliance has the requested object	The appliance sends the object to the client. No ICAP transaction for virus scanning is performed. (Other ICAP services might already have been performed before the content was cached.)
	If the NetCache appliance does not have the requested object	The appliance sends the request to the origin server and the process continues, as described in the following steps.
3	The origin server returns the requested object to the NetCache appliance.
4	The ICAP module on the NetCache appliance passes the object to the ICAP server without handling the object.
5	The ICAP server performs content adaptation services. The ICAP configuration on the NetCache appliance controls the ICAP service that the ICAP server performs.
6	The ICAP server sends the object, possibly modified, to the NetCache appliance.
7	The NetCache appliance caches the object and sends the object to the client. These operations are performed concurrently. Therefore, caching adds almost no cost in latency. When it receives additional requests for the same object, NetCache serves the ICAP-modified object from the cache.