I've been running clamscan locally on about 1,000 servers. Each server has its own freshclam instance and scans are started from a cronjob. I noticed recently that ClamAV has a TCP socket option that can run as a server. Has anyone had any experience with a large deployment targeting a clamav server?

From a technical standpoint, what is being transmitted over the TCP socket? A hash of the local file? I'm curious if the network overhead of having 1,000+ servers scanning over a TCP socket instead of on the local host is going to be too much. I guess I could always go and test it, but I figured I'd ask around if anyone is already doing something similar.