Support Center > Search Results > SecureKnowledge Details
Eicar file is not blocked when a SSL session fails to short circuit mode
Symptoms
  • When uploading an eicar file, it is not always detected / blocked by the gateway by Anti-Virus and SSL inspection.

  • Debug shows:
    [DATE TIME]...{connection} ws_connection_read_handler: [WARNING]: failed to find read session;
    [DATE TIME]...{stream} ws_stream_iterate: iterating stream, calling 0xf2a2ab40 with buffer 0xc949f358 of 49 bytes;
    [DATE TIME]...{parser} ws_parser_is_CRLF_buffer: is the buffer CRLF only: 0, data processed: 0;
    [DATE TIME]...{stream} ws_stream_iterate: callback returned 'stop' after processing 0 bytes;
    [DATE TIME]...{stream} ws_stream_iterate: stream offset is 645;
    [DATE TIME]...{connection} ws_connection_read_handler: [WARNING]: a response was received before any request was sent;
    [DATE TIME]...{connection} ws_connection_read_handler: [WARNING]: protocol violation - act according to the policy;
    [DATE TIME]...{connection} ws_connection_read_handler: copy_data flag is false, clearing stream data;
    [DATE TIME]...{stream} ws_stream_queue_clear_data: queue offset is 645;
    [DATE TIME]...{stream} ws_stream_queue_clear_data: stream is now empty, queue len: 0, queue offset is 645;
    [DATE TIME]...{connection} ws_connection_read_handler: READ END: close connection: FALSE, returned: FALSE;
    [DATE TIME]...{module} ws_cpas_read_handler: [WARNING]: read handler failed;
    [DATE TIME]...{module} ws_cpas_read_handler: log not sent, track is set to 'none';
    [DATE TIME]...{connection} ws_connection_sc_handler: close connection: FALSE;
    [DATE TIME]...{module} ws_cpas_read_handler: *** Monitor only - switching to short-circuit mode ***;
    [DATE TIME]...{module} ws_cpas_sc_read_handler: short circuit - side CPAS_SERVER_SIDE len 49;
    [DATE TIME]...{module} ws_cpas_sc_read_handler: no proxy or no _opaque;
Solution
Note: To view this solution you need to Sign In .