>>socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) = 3
>>bind(3, {sa_family=AF_INET, sin_port=htons(0),
>>sin_addr=inet_addr("IP address")}, 16) = 0
>
>From clamdscan's perspective this should not have been successful. It means
>that the local machine successfully bound to "IP address", so "IP address"
>(and therefore clamd running on it) has to be local, hence CONTSCAN.
Interesting. I'm not sure why it succeeded then.
>What does "sysctl net.ipv4.ip_nonlocal_bind" say?
$ sysctl net.ipv4.ip_nonlocal_bind
net.ipv4.ip_nonlocal_bind = 0
_______________________________________________
Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users
Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation
https://docs.clamav.net/#mailing-lists-and-chat
