[clamav-users] Unable to download clamav cvd file using google cloud python function

[Paul Smith]

On 10/03/2021 22:29, Joel Esler (jesler) via clamav-users wrote:
> 100 CDIFFs or so behind, and they download it nearly 2k times in a 
> row?  Why?  This is not a partial download either.  It’s the full 
> file.  Stuck cron?
>
>
> Who in the past 24 hours has created 22.17M file downloads /all by 
> themselves/ from a single IP. (The main.cvd btw)

You *may* be forgetting NAT.

Eg, it's possible the first one is a network of a few thousand computers 
going through a NAT firewall where each of them has had an old daily.cvd 
copied onto them in an internal release cycle or something, so each of 
the computers on that network is trying to download a backlog of CDIFFs. 
(Or maybe another problem stopping the updates has been discovered and 
fixed, or something)

I'm not saying it is, but it may be. If you are only analysing by IP 
address, NAT will innocently cause strange results.

-- 
Paul



-- 


Paul Smith Computer Services
Tel: 01484 855800
Vat No: GB 685 6987 53

Sign up for news & updates at http://www.pscs.co.uk/go/subscribe
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20210311/98de0810/attachment.htm>