[clamav-users] TCP FIN Packet Received Before Data

Steven Morgan smorgan at sourcefire.com
Mon May 8 21:48:47 UTC 2017


On Mon, May 8, 2017 at 4:43 PM, Cory Parrish <cory.parrish at strivenine.com>
wrote:

> Thanks for the response Steven. I will get the information that you are
> looking for.
>
> What I have done in the meantime, is setup a retry of the scan with a 50 ms
> delay until I receive an expected response (i.e. non FIN packet). What I
> have found is that I always eventually get the expected response within 10
> tries.
>
> *Is There A Timing Issue?*
> I am immediately sending data after I get an ack back that I am connected
> on the socket. So I don't think there is a timing issue but it would be
> nice to find a way to test this. Do you know if there is a configuration I
> can set to increase this wait time? I haven't seen one in the
> configurations.
>
>
> ReadTimeout looks like the right thing.

Steve



More information about the clamav-users mailing list