anybody seen this? (POST /PAV_REL HTTP/1.0)

Matt Hite mh_nanog at ibexa.com
Tue Aug 7 23:04:41 UTC 2001


Paul, 

This is a guess, but given a few clues in the header, I'd speculate that it's
an anti-virus agent that utilizies Marimba technology for signature updates.
(From what I understand, Marimba technology is incorporated into a number
of applications for product updates, etc.)

--Matt Hite

On Tue, Aug 07, 2001 at 11:06:05AM -0700, Paul A Vixie wrote:
> while hunting codered, i started seeing quite a few of the following:
> 
> 	POST /PAV_REL HTTP/1.0
> 	User-Agent: TSTPAV
> 	Connection: Keep-Alive
> 	Content-length: 138
> 	Pragma: no-cache
> 	Content-type: application/marimba
> 	Request-type: update/12
> 
> what's being attempted here, and is anybody else seeing it?  sometimes it's
> 
> 	POST /PAV_REL HTTP/1.1
> 	Host: ...
> 	Connection: keep-alive
> 	User-Agent: TSTPAV
> 	Content-length: 974
> 	Pragma: no-cache
> 	Content-type: application/marimba
> 	Request-type: update/12
> 	Via: 1.0 proxy-rnb (NetCache NetApp/5.1D3)
> 	X-Forwarded-For: ...
> 
> i'm not currently collecting the content, maybe i should.  anybody seen this?
> 
> ------------------------------



More information about the NANOG mailing list