Paul, This is a guess, but given a few clues in the header, I'd speculate that it's an anti-virus agent that utilizies Marimba technology for signature updates. (From what I understand, Marimba technology is incorporated into a number of applications for product updates, etc.) --Matt Hite On Tue, Aug 07, 2001 at 11:06:05AM -0700, Paul A Vixie wrote:

while hunting codered, i started seeing quite a few of the following:

POST /PAV_REL HTTP/1.0 User-Agent: TSTPAV Connection: Keep-Alive Content-length: 138 Pragma: no-cache Content-type: application/marimba Request-type: update/12

what's being attempted here, and is anybody else seeing it? sometimes it's

POST /PAV_REL HTTP/1.1 Host: ... Connection: keep-alive User-Agent: TSTPAV Content-length: 974 Pragma: no-cache Content-type: application/marimba Request-type: update/12 Via: 1.0 proxy-rnb (NetCache NetApp/5.1D3) X-Forwarded-For: ...

i'm not currently collecting the content, maybe i should. anybody seen this?

------------------------------