[clamav-users] TCP FIN Packet Received Before Data

[Cory Parrish]

After analyzing the pcap file I realized that NodeJs is sending the FIN
packet behind the scenes when it has finished streaming the data to the
socket. In an attempt to rule out any issues with clamav, I removed
streaming and read the entire file into a buffer in my service. When
writing the entire buffer at once, I was able to get clamav to respond with
the expected response consistently.

In other words, thanks for your help. Now that I know the issue isn't on
Clamav side, I'll take it from here. Thanks again for the help from the
community!!

On Mon, May 8, 2017 at 5:56 PM, Steven Morgan <smorgan at sourcefire.com>
wrote:

> On Mon, May 8, 2017 at 5:07 PM, Cory Parrish <cory.parrish at strivenine.com>
> wrote:
>
> > Please find the pcap file attached. This particular run had 19 failures
> and
> > then the 20 time I received the expected response. I'll analyze it on my
> > end too but don't have much experience at this so a little help is
> > definitely appreciated.
> >
> >
>  I did not receive the pcaps. Can you send them directly or post them
> somewhere?
>
> Steve
> _______________________________________________
> clamav-users mailing list
> clamav-users at lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml
>



-- 
Cory Parrish
Owner, Developer, and Fellow Geek
StriveNine