ESET traffic filtering feature conflicts with our software

[Guest Boris]

I failed to find support contact, so I posting here.
Our company is a developer of E-Staff software, which is client-server communicating using SOAP (usually over LAN).

All our customers who use ESET product with traffic filtering activated, encounter the same problem:
1. Significant traffic slowdown (about 20 times) between client an the server.
2. Certain traffic is corrupted.

Adding our client software as an exception in traffic filtering section of ESET solves the problem, but not everyone does so, and customers are sure that this is a fault of our software.


 

[Peter Randziak 948]

Hello Boris,

 

could you please provide us with SysInspector log from the affected system and 2 wireshark logs.

One from correctly working state and one from the state, when are you experiencing the slowdown and traffic corruption.

Please start the capturing before data exchange starts as far as we need to see the initialization as well.

 

 

Thank you.

[Marcos 4,714]

If you could provide us with step-by-step instructions, we'll try to reproduce it in our environment to pinpoint the issue.

[Guest Boris]

I still do not know where to send it, so posting here.

Two logs (with traffic filtering on and off) are there:
hxxp://reg.datex-soft.com/download/EStaff_ESET_Logs.rar

I failed to start SysInspector on this machine (Virtual PC with Windows), it exits with error 0xc000000f
I think system is not an issue anyway, because the problem occurs with all our customers, with different version of ESET and different version of Windows.

It seems that ESET parses the content of SOAP message and modifies it to be strictly standard-compliant.
The problem is that our messages are SOAP-based, but this is not true SOAP.

And another problem is significant slowdown. For example, during start-up, where significant number of request is made, the slowdown is to 20-30 sec. instead of normal 2-5 sec.in a LAN.

Test client to reproduce the problem:
hxxp://reg.datex-soft.com/download/EStaff_Test_ESET.rar

It is already preconfigured to connect to our server through Internet, so you do not have to setup a server.
1. Launch SpXml.exe
2. Click OK for login prompt
3. Normally it should show an Initial Setup Wizard, with protocol filtering it will display "End of file" error

 

[Peter Randziak 948]

Hello Boris,

 

we hadn't received requested wireshark logs nor SysInspector log, but we will try to reproduce the issue internally and we will let you know the result or request additional information.

[Peter Randziak 948]

Hello,

 

The application in question pretends to use HTTP protocol, but then sends something in strong conflict with it.

Workaround for this issue is included in Internet protection module 1082 + 

 

In case you experience any further issues please let us know.