Capture ATP helps SonicWall firewall identify whether a file is a virus or not by transmitting the file to the Cloud where the SonicWall Capture ATP cloud service analyzes the file to determine if it is a virus and it then sends the results to the SonicWall firewall. This process is done in real time while the file is being processed by the SonicWall firewall. Capture ATP uses the UFTP protocol to transfer the file. UFTP stand for User Datagram Protocol (UDP) File Transfer Protocol (FTP).

The Capture ATP process of a SonicWall firewall communicating with the SonicWall Capture ATP cloud service involves six major steps:

- The SonicWall firewall sends the file to SonicWall Capture ATP cloud services.
- The SonicWall Capture ATP cloud services saves the file in its repository.
- SonicWall Capture ATP cloud services reads and analyzes the file.
- SonicWall Capture ATP cloud services. stores the results in the SonicWall Capture ATP cloud services database.
- SonicWall Capture ATP cloud services access the SonicWall Capture ATP cloud services database.
- SonicWall Capture ATP cloud services sends results to the SonicWall firewall.

The firewall is located in the customer premises. The SonicWall Capture ATP cloud services and database. are located at a SonicWall facility.