An ICAP request consists of a few sections:
The ICAP Request itself, with various Headers. This would look like this:
RESPMOD icap://192.168.2.231:1344/RESPMOD ICAP/1.0\r\n
Encapsulated: req-hdr=0, res-hdr=84, res-body=150\r\n
The Encapsulated Request Header. This is supposed to represent an HTTP request.
GET /testfile.zip HTTP/1.1\r\n
The Encapsulated response header.
HTTP/1.1 200 OK\r\n
And the Response body, which is where the file is and it's usually chunked binary.
(529 bytes of binary data sent)\r\n
req-hdr=0 means the "GET /eicar.com HTTP/1.1" starts at 0 bytes right after the ICAP header.
res-hdr=84 means the HTTP/1.1 200 OK starts at 84 bytes after the ICAP header.
res-body=150 means the Response body starts at 150 bytes after the ICAP header.
Does that help?
I attached an ICAP client PERL script that _might_ make it easier to follow.
icapClient.pl.zip 3.5 K
Thanks Erik for your quick reply. This information has been extremely helpful for me.