Re: Cannot connect to ClamAV
Lior Koskas via clamav-users <[email protected]> Tue, 9 Dec 2025 17:13:42 +0200
| Newsgroups | gmane.comp.security.virus.clamav.user |
|---|---|
| Message-ID | <CAA2N+9gBNHz4bj6SJfEY44uTsNUoAr-4_-M77219UiiMP58tFw@mail.gmail.com> |
--===============6747768077858150958== Content-Type: multipart/alternative; boundary="0000000000001dd8e20645865cc6" --0000000000001dd8e20645865cc6 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Thank you for your suggestion. I created a pcap file and I see a lot of lines like this: 1689 46.344568 10.210.86.39 10.210.84.7 TCP 80 14952 =E2=86=92 3310 [SYN] S= eq=3D0 Win=3D8961 Len=3D0 MSS=3D8361 SACK_PERM TSval=3D2413887455 TSecr=3D0 WS=3D1 1690 46.344586 10.210.84.7 10.210.86.39 TCP 80 3310 =E2=86=92 14952 [SYN, A= CK] Seq=3D0 Ack=3D1 Win=3D62643 Len=3D0 MSS=3D8961 SACK_PERM TSval=3D1236561427 TSecr=3D2413887455 WS=3D128 1691 46.345415 10.210.86.39 10.210.84.7 TCP 72 14952 =E2=86=92 3310 [ACK] S= eq=3D1 Ack=3D1 Win=3D8961 Len=3D0 TSval=3D2413887456 TSecr=3D1236561427 1692 46.345468 10.210.86.39 10.210.84.7 TCP 72 14952 =E2=86=92 3310 [FIN, A= CK] Seq=3D1 Ack=3D1 Win=3D8961 Len=3D0 TSval=3D2413887456 TSecr=3D1236561427 1693 46.345575 10.210.84.7 10.210.86.39 TCP 72 3310 =E2=86=92 14952 [FIN, A= CK] Seq=3D1 Ack=3D2 Win=3D62720 Len=3D0 TSval=3D1236561428 TSecr=3D2413887456 1694 46.346108 10.210.86.39 10.210.84.7 TCP 72 14952 =E2=86=92 3310 [ACK] S= eq=3D2 Ack=3D2 Win=3D8960 Len=3D0 TSval=3D2413887457 TSecr=3D1236561428 On Thu, Dec 4, 2025 at 4:42=E2=80=AFAM Paul Kosinski <[email protected]= m> wrote: > Have you tried watching network traffic with Wireshark (or TCPdump) for > both the telnet and Java attempts? Perhaps that would show something. E.g= ., > the Java client doesn't send anything, or does send something but it's > wrong. > > And, of course, if you also run clamdscan itself, you can see what the > correct interaction is. > > P.S. I find Wireshark gives much more detail than TCPdump, and you can > even change what you look at after the fact, if you capture a PCAP output > file during the test. > > > On Wed, 3 Dec 2025 17:46:36 +0200 > Lior Koskas via clamav-users <[email protected]> wrote: > > > Hi, > > > > I'm running ClamAv on Kubernetes. The image tag is clamav/clamav:1.5.1.= I > > have a Java app based SpringBoot that communicates with ClamAV. > > When I'm trying to scan a file using my Java app The app hangs up at th= is > > line: > > > > ClamavClient clamScan =3D new ClamavClient(url, port); > > > > clamScan.ping(); // hangs up > > > > When I'm running the telnet command to my URL the command run as > expected. > > > > My clamd config file: > > > > ############################## > > # Network Settings (TCP mode) > > ############################## > > TCPSocket 3310 > > TCPAddr 0.0.0.0 > > LocalSocket /run/clamav/clamd.sock > > LocalSocketGroup clamav > > LocalSocketMode 666 > > > > ############################## > > # Logging > > ############################## > > # LogFile /var/log/clamav/clamd.log > > LogFileUnlock yes > > LogTime yes > > LogVerbose no # Change to "yes" for debug > > ExtendedDetectionInfo yes > > LogVerbose yes # Enable verbose for debugging > > > > ############################## > > # Performance & Limits > > ############################## > > MaxScanSize 200M > > MaxFileSize 100M > > StreamMaxLength 150M > > MaxRecursion 20 > > MaxFiles 10000 > > MaxScanTime 120000 # 120 seconds > > ReadTimeout 120 > > IdleTimeout 60 > > > > ############################## > > # Heuristics / Features > > ############################## > > ScanArchive yes > > ScanOLE2 yes > > ScanPDF yes > > ScanSWF yes > > ScanHWP3 yes > > HeuristicScanPrecedence yes > > > > ############################## > > # Misc > > ############################## > > Foreground yes > > User clamav > > SelfCheck 3600 # Every 60 minutes > > > > My freshclam config file: > > > > ############### > > # Database Updates > > ############### > > DatabaseOwner clamav > > Checks 12 # every 2 hours > > > > DatabaseMirror database.clamav.net > > DNSDatabaseInfo current.cvd.clamav.net > > > > ############### > > # Logging > > ############### > > UpdateLogFile /var/log/clamav/freshclam.log > > LogVerbose yes > > > --=20 Lior Koskas *Blockchain **Specialist**, *WaveBL wavebl.com <https://wavebl.com/> | [email protected] <[email protected]> IMPORTANT: The contents of this email and any attachments are confidential. They are intended for the named recipient(s) only. If you have received this email by mistake, please notify the sender immediately and do not disclose the contents to anyone or make copies thereof. Wavebl.com <https://eur01.safelinks.protection.outlook.com/?url=3Dhttp%3A%2F%2Fwavebl.= com%2F&data=3D02%7C01%7CKasper.Oelund%40maersk.com%7C9a72b1fb6eb240bcbfcb08= d761aae9da%7C05d75c05fa1a42e79cf1eb416c396f2d%7C0%7C1%7C637085260046191835&= sdata=3DRq7xeRRcgfnjZ9dMMZlsUFrTXlp6WLILdOcP4kzir6w%3D&reserved=3D0> | Twitter <https://eur01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Ftwitte= r.com%2Fwavebl%3Flang%3Den&data=3D02%7C01%7CKasper.Oelund%40maersk.com%7C9a= 72b1fb6eb240bcbfcb08d761aae9da%7C05d75c05fa1a42e79cf1eb416c396f2d%7C0%7C0%7= C637085260046201829&sdata=3DGbODOCwXlshniD%2FDlaDF0WfzhRpfqXL8%2B%2BTU79Ixq= Ec%3D&reserved=3D0> | Linkedin <https://eur01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.li= nkedin.com%2Fcompany%2F10082448%3Ftrk%3Dtyah%26trkInfo%3DclickedVertical%25= 3Acompany%252CclickedEntityId%253A10082448%252Cidx%253A2-1-3%252CtarId%253A= 1457252792686%252Ctas%253Awave%2520(by&data=3D02%7C01%7CKasper.Oelund%40mae= rsk.com%7C9a72b1fb6eb240bcbfcb08d761aae9da%7C05d75c05fa1a42e79cf1eb416c396f= 2d%7C0%7C1%7C637085260046211829&sdata=3DFKNOcDPezSN4xwlOD%2BbD79LxVDSTNT4%2= BTw7rSGjFqL0%3D&reserved=3D0> --0000000000001dd8e20645865cc6 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">Thank you for your suggestion. I created a pcap file and I= see a lot of lines like this:<br><br><br>1689 46.344568 10.210.86.39 10.21= 0.84.7 TCP 80 14952 =E2=86=92 3310 [SYN] Seq=3D0 Win=3D8961 Len=3D0 MSS=3D8= 361 SACK_PERM TSval=3D2413887455 TSecr=3D0 WS=3D1<br>1690 46.344586 10.210.= 84.7 10.210.86.39 TCP 80 3310 =E2=86=92 14952 [SYN, ACK] Seq=3D0 Ack=3D1 Wi= n=3D62643 Len=3D0 MSS=3D8961 SACK_PERM TSval=3D1236561427 TSecr=3D241388745= 5 WS=3D128<br>1691 46.345415 10.210.86.39 10.210.84.7 TCP 72 14952 =E2=86= =92 3310 [ACK] Seq=3D1 Ack=3D1 Win=3D8961 Len=3D0 TSval=3D2413887456 TSecr= =3D1236561427<br>1692 46.345468 10.210.86.39 10.210.84.7 TCP 72 14952 =E2= =86=92 3310 [FIN, ACK] Seq=3D1 Ack=3D1 Win=3D8961 Len=3D0 TSval=3D241388745= 6 TSecr=3D1236561427<br>1693 46.345575 10.210.84.7 10.210.86.39 TCP 72 3310= =E2=86=92 14952 [FIN, ACK] Seq=3D1 Ack=3D2 Win=3D62720 Len=3D0 TSval=3D123= 6561428 TSecr=3D2413887456<br>1694 46.346108 10.210.86.39 10.210.84.7 TCP 7= 2 14952 =E2=86=92 3310 [ACK] Seq=3D2 Ack=3D2 Win=3D8960 Len=3D0 TSval=3D241= 3887457 TSecr=3D1236561428<br></div><br><div class=3D"gmail_quote"><div dir= =3D"ltr" class=3D"gmail_attr">On Thu, Dec 4, 2025 at 4:42=E2=80=AFAM Paul K= osinski <<a href=3D"mailto:[email protected]" target=3D"_blank">cla= [email protected]</a>> wrote:<br></div><blockquote class=3D"gmail_quot= e" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204)= ;padding-left:1ex">Have you tried watching network traffic with Wireshark (= or TCPdump) for both the telnet and Java attempts? Perhaps that would show = something. E.g., the Java client doesn't send anything, or does send so= mething but it's wrong.<br> <br> And, of course, if you also run clamdscan itself, you can see what the corr= ect interaction is.<br> <br> P.S. I find Wireshark gives much more detail than TCPdump, and you can even= change what you look at after the fact, if you capture a PCAP output file = during the test.<br> <br> <br> On Wed, 3 Dec 2025 17:46:36 +0200<br> Lior Koskas via clamav-users <<a href=3D"mailto:[email protected]= v.net" target=3D"_blank">[email protected]</a>> wrote:<br> <br> > Hi,<br> > <br> > I'm running ClamAv on Kubernetes. The image tag is clamav/clamav:1= .5.1. I<br> > have a Java app based SpringBoot that communicates with ClamAV.<br> > When I'm trying to scan a file using my Java app The app hangs up = at this<br> > line:<br> > <br> > ClamavClient clamScan =3D new ClamavClient(url, port);<br> > <br> > clamScan.ping(); // hangs up<br> > <br> > When I'm running the telnet command to my URL the command run as e= xpected.<br> > <br> > My clamd config file:<br> > <br> > ##############################<br> > # Network Settings (TCP mode)<br> > ##############################<br> > TCPSocket 3310<br> > TCPAddr 0.0.0.0<br> > LocalSocket /run/clamav/clamd.sock<br> > LocalSocketGroup clamav<br> > LocalSocketMode 666<br> > <br> > ##############################<br> > # Logging<br> > ##############################<br> > # LogFile /var/log/clamav/clamd.log<br> > LogFileUnlock yes<br> > LogTime yes<br> > LogVerbose no=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 # Change to &qu= ot;yes" for debug<br> > ExtendedDetectionInfo yes<br> > LogVerbose yes=C2=A0 # Enable verbose for debugging<br> > <br> > ##############################<br> > # Performance & Limits<br> > ##############################<br> > MaxScanSize 200M<br> > MaxFileSize 100M<br> > StreamMaxLength 150M<br> > MaxRecursion 20<br> > MaxFiles 10000<br> > MaxScanTime 120000=C2=A0 =C2=A0 =C2=A0 =C2=A0 # 120 seconds<br> > ReadTimeout 120<br> > IdleTimeout 60<br> > <br> > ##############################<br> > # Heuristics / Features<br> > ##############################<br> > ScanArchive yes<br> > ScanOLE2 yes<br> > ScanPDF yes<br> > ScanSWF yes<br> > ScanHWP3 yes<br> > HeuristicScanPrecedence yes<br> > <br> > ##############################<br> > # Misc<br> > ##############################<br> > Foreground yes<br> > User clamav<br> > SelfCheck 3600=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0# Every 60 minu= tes<br> > <br> > My freshclam config file:<br> > <br> > ###############<br> > # Database Updates<br> > ###############<br> > DatabaseOwner clamav<br> > Checks 12=C2=A0 =C2=A0# every 2 hours<br> > <br> > DatabaseMirror <a href=3D"http://database.clamav.net" rel=3D"noreferre= r" target=3D"_blank">database.clamav.net</a><br> > DNSDatabaseInfo <a href=3D"http://current.cvd.clamav.net" rel=3D"noref= errer" target=3D"_blank">current.cvd.clamav.net</a><br> > <br> > ###############<br> > # Logging<br> > ###############<br> > UpdateLogFile /var/log/clamav/freshclam.log<br> > LogVerbose yes<br> > <br> </blockquote></div><div><br clear=3D"all"></div><div><br></div><span class= =3D"gmail_signature_prefix">-- </span><br><div dir=3D"ltr" class=3D"gmail_s= ignature"><div dir=3D"ltr"><div style=3D"text-align:left"><table cellpaddin= g=3D"0" cellspacing=3D"0" style=3D"border-collapse:collapse;font-family:&qu= ot;Trebuchet MS";line-height:1.15;color:rgb(0,0,0)"><tbody><tr><td sty= le=3D"vertical-align:top;padding:0.01px 18px 0.01px 1px;width:86px;text-ali= gn:center"><img src=3D"https://d36urhup7zbd7q.cloudfront.net/u/RMNXXWxENOk/= 1676375150887.png" height=3D"16" width=3D"86" style=3D"width: 86px; vertica= l-align: middle; border-radius: 0px; height: 16px;"></td><td valign=3D"top"= style=3D"padding:0.01px 0.01px 0.01px 18px;vertical-align:top;border-left:= 1px solid rgb(189,189,189)"><table cellpadding=3D"0" cellspacing=3D"0" styl= e=3D"border-collapse:collapse"><tbody><tr><td style=3D"line-height:1.32;pad= ding:0.01px"><span style=3D"text-transform:initial;font-weight:bold;color:r= gb(100,100,100);letter-spacing:0px;line-height:1.2;font-size:16px">Lior Kos= kas</span><br><span style=3D"line-height:1.2"><font color=3D"#646464"><span= style=3D"text-transform:initial"><b>Blockchain </b></span><b>Specialist</b= ><span style=3D"text-transform:initial"><b>,=C2=A0</b></span></font></span>= <span style=3D"text-transform:initial;font-weight:bold;color:rgb(100,100,10= 0);line-height:1.2;font-size:13px">WaveBL</span></td></tr><tr><td><table ce= llpadding=3D"0" cellspacing=3D"0" style=3D"border-collapse:collapse"><tbody= ><tr><td nowrap width=3D"234" style=3D"padding-top:18px;white-space:nowrap;= width:234px"><p style=3D"margin:0.1px;line-height:1"><span style=3D"font-si= ze:11px;color:rgb(33,33,33)"><img src=3D"https://cdn.gifo.wisestamp.com/s/r= fw1/45668E/24/trans.png" width=3D"12" style=3D"vertical-align: -2px; line-h= eight: 1.2; width: 12px;"><a href=3D"https://wavebl.com/" rel=3D"nofollow n= oreferrer" style=3D"color:rgb(17,85,204);text-decoration:unset" target=3D"_= blank"><span style=3D"line-height:1.2;color:rgb(33,33,33)">=C2=A0wavebl.com= </span></a>=C2=A0=C2=A0|=C2=A0=C2=A0<img src=3D"https://cdn.gifo.wisestamp.= com/s/rfem1/45668E/24/trans.png" width=3D"12" style=3D"vertical-align: -2px= ; line-height: 1.2; width: 12px;"><a href=3D"mailto:[email protected]" rel=3D= "nofollow noreferrer" style=3D"color:rgb(17,85,204);text-decoration:unset" = target=3D"_blank"><span style=3D"line-height:1.2;color:rgb(33,33,33)">=C2= [email protected]</span></a></span></p></td></tr></tbody></table></td></tr= ></tbody></table></td></tr></tbody></table><table cellpadding=3D"0" cellspa= cing=3D"0" border=3D"0" width=3D"100%"><tbody><tr><td height=3D"16px" style= =3D"line-height:0;height:16px"></td></tr></tbody></table><table cellpadding= =3D"0" cellspacing=3D"0" border=3D"0" style=3D"max-width:600px;width:600px"= ><tbody><tr><td style=3D"line-height:0"><table cellpadding=3D"0" cellspacin= g=3D"0" width=3D"100%" style=3D"font-size:13px;width:600px;padding-right:8p= x;color:gray;border-top-width:1px;border-top-style:solid;line-height:normal= "><tbody><tr><td><p style=3D"font-size:10px;margin:0px;line-height:12px;pad= ding-top:10px;font-family:"Trebuchet MS"">IMPORTANT: The contents= of this email and any attachments are confidential. They are intended for = the named recipient(s) only. If you have received this email by mistake, pl= ease notify the sender immediately and do not disclose the contents to anyo= ne or make copies thereof.</p></td></tr></tbody></table><table cellpadding= =3D"0" cellspacing=3D"0" border=3D"0" width=3D"100%" style=3D"color:rgb(34,= 34,34)"><tbody><tr></tr></tbody></table></td></tr></tbody></table></div><di= v style=3D"text-align:left"><br></div><div style=3D"text-align:left"><br></= div><div style=3D"text-align:left"><div><a href=3D"https://eur01.safelinks.= protection.outlook.com/?url=3Dhttp%3A%2F%2Fwavebl.com%2F&data=3D02%7C01= %7CKasper.Oelund%40maersk.com%7C9a72b1fb6eb240bcbfcb08d761aae9da%7C05d75c05= fa1a42e79cf1eb416c396f2d%7C0%7C1%7C637085260046191835&sdata=3DRq7xeRRcg= fnjZ9dMMZlsUFrTXlp6WLILdOcP4kzir6w%3D&reserved=3D0" style=3D"color:rgb(= 17,85,204);font-size:12.6667px" target=3D"_blank">Wavebl.com</a><span style= =3D"font-size:12.6667px;color:rgb(80,0,80)">=C2=A0|=C2=A0</span><a href=3D"= https://eur01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Ftwitter= .com%2Fwavebl%3Flang%3Den&data=3D02%7C01%7CKasper.Oelund%40maersk.com%7= C9a72b1fb6eb240bcbfcb08d761aae9da%7C05d75c05fa1a42e79cf1eb416c396f2d%7C0%7C= 0%7C637085260046201829&sdata=3DGbODOCwXlshniD%2FDlaDF0WfzhRpfqXL8%2B%2B= TU79IxqEc%3D&reserved=3D0" style=3D"color:rgb(17,85,204);font-size:12.6= 667px" target=3D"_blank">Twitter=C2=A0</a><span style=3D"font-size:12.6667p= x;color:rgb(80,0,80)">|=C2=A0</span><a href=3D"https://eur01.safelinks.prot= ection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.linkedin.com%2Fcompany%2F100824= 48%3Ftrk%3Dtyah%26trkInfo%3DclickedVertical%253Acompany%252CclickedEntityId= %253A10082448%252Cidx%253A2-1-3%252CtarId%253A1457252792686%252Ctas%253Awav= e%2520(by&data=3D02%7C01%7CKasper.Oelund%40maersk.com%7C9a72b1fb6eb240b= cbfcb08d761aae9da%7C05d75c05fa1a42e79cf1eb416c396f2d%7C0%7C1%7C637085260046= 211829&sdata=3DFKNOcDPezSN4xwlOD%2BbD79LxVDSTNT4%2BTw7rSGjFqL0%3D&r= eserved=3D0" style=3D"color:rgb(17,85,204);font-size:12.6667px" target=3D"_= blank">Linkedin</a><b><br></b></div><div><br></div></div></div></div> --0000000000001dd8e20645865cc6-- --===============6747768077858150958== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Manage your clamav-users mailing list subscription / unsubscribe: https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/Cisco-Talos/clamav-documentation https://docs.clamav.net/#mailing-lists-and-chat --===============6747768077858150958==--