Thank you for your suggestion. I created a pcap file and I see a lot of lines like this:
1689 46.344568 10.210.86.39 10.210.84.7 TCP 80 14952 → 3310 [SYN] Seq=0 Win=8961 Len=0 MSS=8361 SACK_PERM TSval=2413887455 TSecr=0 WS=1 1690 46.344586 10.210.84.7 10.210.86.39 TCP 80 3310 → 14952 [SYN, ACK] Seq=0 Ack=1 Win=62643 Len=0 MSS=8961 SACK_PERM TSval=1236561427 TSecr=2413887455 WS=128 1691 46.345415 10.210.86.39 10.210.84.7 TCP 72 14952 → 3310 [ACK] Seq=1 Ack=1 Win=8961 Len=0 TSval=2413887456 TSecr=1236561427 1692 46.345468 10.210.86.39 10.210.84.7 TCP 72 14952 → 3310 [FIN, ACK] Seq=1 Ack=1 Win=8961 Len=0 TSval=2413887456 TSecr=1236561427 1693 46.345575 10.210.84.7 10.210.86.39 TCP 72 3310 → 14952 [FIN, ACK] Seq=1 Ack=2 Win=62720 Len=0 TSval=1236561428 TSecr=2413887456 1694 46.346108 10.210.86.39 10.210.84.7 TCP 72 14952 → 3310 [ACK] Seq=2 Ack=2 Win=8960 Len=0 TSval=2413887457 TSecr=1236561428 On Thu, Dec 4, 2025 at 4:42 AM Paul Kosinski <[email protected]> wrote: > Have you tried watching network traffic with Wireshark (or TCPdump) for > both the telnet and Java attempts? Perhaps that would show something. E.g., > the Java client doesn't send anything, or does send something but it's > wrong. > > And, of course, if you also run clamdscan itself, you can see what the > correct interaction is. > > P.S. I find Wireshark gives much more detail than TCPdump, and you can > even change what you look at after the fact, if you capture a PCAP output > file during the test. > > > On Wed, 3 Dec 2025 17:46:36 +0200 > Lior Koskas via clamav-users <[email protected]> wrote: > > > Hi, > > > > I'm running ClamAv on Kubernetes. The image tag is clamav/clamav:1.5.1. I > > have a Java app based SpringBoot that communicates with ClamAV. > > When I'm trying to scan a file using my Java app The app hangs up at this > > line: > > > > ClamavClient clamScan = new ClamavClient(url, port); > > > > clamScan.ping(); // hangs up > > > > When I'm running the telnet command to my URL the command run as > expected. > > > > My clamd config file: > > > > ############################## > > # Network Settings (TCP mode) > > ############################## > > TCPSocket 3310 > > TCPAddr 0.0.0.0 > > LocalSocket /run/clamav/clamd.sock > > LocalSocketGroup clamav > > LocalSocketMode 666 > > > > ############################## > > # Logging > > ############################## > > # LogFile /var/log/clamav/clamd.log > > LogFileUnlock yes > > LogTime yes > > LogVerbose no # Change to "yes" for debug > > ExtendedDetectionInfo yes > > LogVerbose yes # Enable verbose for debugging > > > > ############################## > > # Performance & Limits > > ############################## > > MaxScanSize 200M > > MaxFileSize 100M > > StreamMaxLength 150M > > MaxRecursion 20 > > MaxFiles 10000 > > MaxScanTime 120000 # 120 seconds > > ReadTimeout 120 > > IdleTimeout 60 > > > > ############################## > > # Heuristics / Features > > ############################## > > ScanArchive yes > > ScanOLE2 yes > > ScanPDF yes > > ScanSWF yes > > ScanHWP3 yes > > HeuristicScanPrecedence yes > > > > ############################## > > # Misc > > ############################## > > Foreground yes > > User clamav > > SelfCheck 3600 # Every 60 minutes > > > > My freshclam config file: > > > > ############### > > # Database Updates > > ############### > > DatabaseOwner clamav > > Checks 12 # every 2 hours > > > > DatabaseMirror database.clamav.net > > DNSDatabaseInfo current.cvd.clamav.net > > > > ############### > > # Logging > > ############### > > UpdateLogFile /var/log/clamav/freshclam.log > > LogVerbose yes > > > -- Lior Koskas *Blockchain **Specialist**, *WaveBL wavebl.com <https://wavebl.com/> | [email protected] <[email protected]> IMPORTANT: The contents of this email and any attachments are confidential. They are intended for the named recipient(s) only. If you have received this email by mistake, please notify the sender immediately and do not disclose the contents to anyone or make copies thereof. Wavebl.com <https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwavebl.com%2F&data=02%7C01%7CKasper.Oelund%40maersk.com%7C9a72b1fb6eb240bcbfcb08d761aae9da%7C05d75c05fa1a42e79cf1eb416c396f2d%7C0%7C1%7C637085260046191835&sdata=Rq7xeRRcgfnjZ9dMMZlsUFrTXlp6WLILdOcP4kzir6w%3D&reserved=0> | Twitter <https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftwitter.com%2Fwavebl%3Flang%3Den&data=02%7C01%7CKasper.Oelund%40maersk.com%7C9a72b1fb6eb240bcbfcb08d761aae9da%7C05d75c05fa1a42e79cf1eb416c396f2d%7C0%7C0%7C637085260046201829&sdata=GbODOCwXlshniD%2FDlaDF0WfzhRpfqXL8%2B%2BTU79IxqEc%3D&reserved=0> | Linkedin <https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2F10082448%3Ftrk%3Dtyah%26trkInfo%3DclickedVertical%253Acompany%252CclickedEntityId%253A10082448%252Cidx%253A2-1-3%252CtarId%253A1457252792686%252Ctas%253Awave%2520(by&data=02%7C01%7CKasper.Oelund%40maersk.com%7C9a72b1fb6eb240bcbfcb08d761aae9da%7C05d75c05fa1a42e79cf1eb416c396f2d%7C0%7C1%7C637085260046211829&sdata=FKNOcDPezSN4xwlOD%2BbD79LxVDSTNT4%2BTw7rSGjFqL0%3D&reserved=0>
_______________________________________________ Manage your clamav-users mailing list subscription / unsubscribe: https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/Cisco-Talos/clamav-documentation https://docs.clamav.net/#mailing-lists-and-chat
