anybody seen this? (POST /PAV_REL HTTP/1.0)
Matt Hite
mh_nanog at ibexa.com
Tue Aug 7 23:04:41 UTC 2001
Paul,
This is a guess, but given a few clues in the header, I'd speculate that it's
an anti-virus agent that utilizies Marimba technology for signature updates.
(From what I understand, Marimba technology is incorporated into a number
of applications for product updates, etc.)
--Matt Hite
On Tue, Aug 07, 2001 at 11:06:05AM -0700, Paul A Vixie wrote:
> while hunting codered, i started seeing quite a few of the following:
>
> POST /PAV_REL HTTP/1.0
> User-Agent: TSTPAV
> Connection: Keep-Alive
> Content-length: 138
> Pragma: no-cache
> Content-type: application/marimba
> Request-type: update/12
>
> what's being attempted here, and is anybody else seeing it? sometimes it's
>
> POST /PAV_REL HTTP/1.1
> Host: ...
> Connection: keep-alive
> User-Agent: TSTPAV
> Content-length: 974
> Pragma: no-cache
> Content-type: application/marimba
> Request-type: update/12
> Via: 1.0 proxy-rnb (NetCache NetApp/5.1D3)
> X-Forwarded-For: ...
>
> i'm not currently collecting the content, maybe i should. anybody seen this?
>
> ------------------------------
More information about the NANOG
mailing list