Re: anybody seen this? (POST /PAV_REL HTTP/1.0)

[Matt Hite <mh_nanog () ibexa com>]

Paul, 

This is a guess, but given a few clues in the header, I'd speculate that it's
an anti-virus agent that utilizies Marimba technology for signature updates.
(From what I understand, Marimba technology is incorporated into a number
of applications for product updates, etc.)

--Matt Hite

On Tue, Aug 07, 2001 at 11:06:05AM -0700, Paul A Vixie wrote:
> while hunting codered, i started seeing quite a few of the following:
>
>       POST /PAV_REL HTTP/1.0
>       User-Agent: TSTPAV
>       Connection: Keep-Alive
>       Content-length: 138
>       Pragma: no-cache
>       Content-type: application/marimba
>       Request-type: update/12
>
> what's being attempted here, and is anybody else seeing it?  sometimes it's
>
>       POST /PAV_REL HTTP/1.1
>       Host: ...
>       Connection: keep-alive
>       User-Agent: TSTPAV
>       Content-length: 974
>       Pragma: no-cache
>       Content-type: application/marimba
>       Request-type: update/12
>       Via: 1.0 proxy-rnb (NetCache NetApp/5.1D3)
>       X-Forwarded-For: ...
>
> i'm not currently collecting the content, maybe i should.  anybody seen this?
>
> ------------------------------