[clamav-users] TCP FIN Packet Received Before Data

[Ángel]

On 2017-05-09 at 11:43 -0400, Cory Parrish wrote:
> After analyzing the pcap file I realized that NodeJs is sending the FIN
> packet behind the scenes when it has finished streaming the data to the
> socket. In an attempt to rule out any issues with clamav, I removed
> streaming and read the entire file into a buffer in my service. When
> writing the entire buffer at once, I was able to get clamav to respond with
> the expected response consistently.
> 
> In other words, thanks for your help. Now that I know the issue isn't on
> Clamav side, I'll take it from here. Thanks again for the help from the
> community!!

Do you have iptables running on either machine? I have seen it behave
weirdly with half-closed connections.