[clamav-users] We STILL cannot reliably get virus updates (since new mirrors)

[Joel Esler (jesler)]

On Jul 3, 2018, at 3:59 PM, Reindl Harald <h.reindl at thelounge.net<mailto:h.reindl at thelounge.net>> wrote:

voila - all new connections which are more than 5 per hour from the same
IP are dropped, i have similar rules for specific ports and max
connections per client for many years now - no rocket science

Yes.  But measuring those numbers is the difficult part.  A fresh install of ClamAV is going to download the main, the daily, then all the diffs since the last daily, which could be a ton.  It's the people that are downloading the *same* diff 1000x an hour that are the problem.

--
Joel Esler
Sr. Manager
Open Source, Design, Web, and Education
Talos Group
http://www.talosintelligence.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20180703/cfaac5af/attachment.htm>