Proxyman Causes Massive Request Load

[hcarstensen]

Description

In certain situations Proxyman causes a massive IO/CPU load repeating the same request over and over again. In my case this is triggered by the ESET AntiVirus Tool when checking for updated signatures. See attached Screenshot for details.

Steps to Reproduce

1. Install ESET AntiVirus
2. Start Proxyman
3. Open ESEt AntiVirus and check for signature updates

Current Behavior

Proxyman repeats a HEAD request over and over again causing high IO/CPU load.

Expected Behaviour

Proxyman executes the request once.

Environment

• App version: e.g Proxyman 4.16.0
• macOS version: macOS Sonoma 14.3

[NghiaTranUIT]

It seems that ESET AntiVirus Tool conflicts with Proxyman app.

You can fix it by open the Tools menu -> Proxy Setting -> Bypass Proxy Setting -> Add update.eset.com to the list (separate by the comma). This will make the Virus checker never go to the Proxyman app.

[hcarstensen]

Hi!

I already tried this but unfortunately it does not fix my problem. Here is my list of bypasses:

dns.google,one.one.one.one,ocsp.digicert.com,update.eset.com

Am 07.02.2024 um 13:00 schrieb Nghia Tran (Noah) @.***>:

It seems that ESET AntiVirus Tool conflicts with Proxyman app.

You can fix it by open the Tools menu -> Proxy Setting -> Bypass Proxy Setting -> Add update.eset.com to the list (separate by the comma). This will make the Virus checker never go to the Proxyman app.

— Reply to this email directly, view it on GitHub https://github.com/ProxymanApp/Proxyman/issues/1928#issuecomment-1931899270, or unsubscribe https://github.com/notifications/unsubscribe-auth/AF4BU7LZNDYALCQ5KMR2Q6TYSNUGLAVCNFSM6AAAAABC5V45OCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSMZRHA4TSMRXGA. You are receiving this because you authored the thread.

[NghiaTranUIT]

Is it possible to add Proxyman in the Exception List of the Anti Virus? So fix the issue 🤔

Or try to turn off the anti-virus temporarily,

[hcarstensen]

Update: Just had another request load being triggerd by some Google services. See Screenshot for details.

[NghiaTranUIT]

It's really odd. Can you do Factory Reset in the Help menu -> Advance ?

I guess Proxyman is listening on port 9090, right?

[hcarstensen]

Did a factory reset including debug settings. Same issue. After a few moments, it is back to requesting. And yes, the port is 9090.

Currently Proxyman is unusable for me and all of my coworkers. Which is unfortunate, since we really love the tool and need it in our daily work.

[NghiaTranUIT]

Sorry to hear that. Can you try one more thing: Adding ocsp.pki.goog to the Bypass Proxy List to see if it skips the request?

I believe that the Anti Virus causes the issue.

[hcarstensen]

It was stable for a moment, now I have the same issue with a new URL: http://i4.c.eset.com/ This time it is POST request wich remains permanently active.

[hcarstensen]

Added the new URL to the bypass list and now I am back to http://update.eset.com/eset_upd/era_agent/update.ver.signed Which is strange because update.eset.com is in the list as well.

[mpreikschat]

Same issue here. Hope to see a solution in near future.

[hcarstensen]

Short Update: I uninstalled ESET temporarily and the problem did not occur anymore. So it really seems to be an ESET problem.

Any chance we get an update soon?

[NghiaTranUIT]

@hcarstensen Not sure how to fix it on our side. I guess it's from the ESET.

Let me try to download the app (https://www.eset.com/us/download/) and reproduce it

[NghiaTranUIT]

@hcarstensen which one do you use? https://www.eset.com/us/home/protection-plans/

Is it an Ultimate with VPN and Identity Protection?

[NghiaTranUIT]

@hcarstensen Tried with the Home Version, and it just works fine. I guess the problem cause by the VPN. If you can try to turn off the VPN from ESET, it might fix the issue.

[hcarstensen]

Unfortunately I cannot disable ESET at will because I do not have permission. Running ESET is a company-wide security policy and would require our system admin to deactivate it.

But let me try and give you some more information.

1. The ESET product is called "ESET Endpoint Antivirus, V 7.4.1500.0".
2. It provides "Web Protection", "Anti-Phishing Protection" and "E-Mail Protection", all of which are enabled by default.
3. The macOS Network settings show a "Transparent Proxy" called "ESET Web&Email" which cannot be deactivated.

What I CAN do is disable the protections mentioned under 2. But even then, as soon as ESET tries to update its signature files, the request load occurs. Furthermore, I noticed that sometimes even opening a URL in Safari will trigger the issue. Proxyman will request the URL over and over again.

Also, I updated to the new Proxyman Version 5. Same issue.

[NghiaTranUIT]

Thanks. I'm able to reproduce your issue. It happens when I click on the "Check for Update" button from the ESET Endpoint AntiVirus app.

Let me try to fix it and send you a BETA build asap 👍

[NghiaTranUIT]

@hcarstensen @mpreikschat let's try this Beta build: https://download.proxyman.io/beta/Proxyman_5.0.0_Fix_ESET_Endpoint_Antivirus_issues.dmg

Changelog

• Fix the loop issue when using Proxyman with ESET Endpoint Antivirus

[hcarstensen]

Thanks for the update. I installed the Beta and so far it's looking good. I will let you know in case the issue returns unexpectedly.