MS changes IE and IIS TCP/IP rules

I seem to see different behavior than that described in the article. When I
use IE 6.0 to hit our IIS 4.0 server (don't ask), I see this:

Client        Server
------        ------
SYN        -->    
        <--    SYN/ACK
ACK        -->    
HTTP Request -->
        <--    HTTP Response
etc.

I don't see an HTTP request preceding the initial SYN packet.

If I use IE 6.0 to hit one of our iPlanet servers, I see the same thing:

Client        Server
------        ------
SYN        -->    
        <--    SYN/ACK
ACK        -->    
HTTP Request -->
        <--    HTTP Response
etc.

Again, no HTTP Request preceding the initial SYN.

If I use IE 6.0 to hit one of our iPlanet servers twice, with a couple
seconds in between each request, I see this:

Client        Server
------        ------
SYN        -->    
        <--    SYN/ACK
ACK        -->    
HTTP Request -->
        <--    HTTP Response
etc.
        <--    FIN
ACK        -->
FIN        -->    
        <--    ACK
...
SYN        -->    
        <--    SYN/ACK
ACK        -->    
HTTP Request -->
        <--    HTTP Response
etc.
        <--    FIN
ACK        -->
FIN        -->    
        <--    ACK

Still no HTTP Request preceding the initial SYN packet.

If I use IE 6.0 to hit our IIS 4.0 server (again, don't ask) twice, with a
couple seconds in between the requests, I see this:

Client        Server
------        ------
SYN        -->    
        <--    SYN/ACK
ACK        -->    
HTTP Request -->
        <--    HTTP Response
etc.
...
SYN        -->    
        <--    SYN/ACK
ACK        -->    
HTTP Request -->
        <--    HTTP Response
etc.

Same thing (still no HTTP Request preceding the initial SYN), except that
there is no tear-down of the connections. I assume if I left the network
capture running for a few more seconds, the tear-down would eventually come.
The browser doesn't seem to re-use the first TCP/IP connection for the
subsequent request. So the only difference I see is the delay in tearing
down the connections, which wouldn't improve perceived performance on the
client (I think). (And actually, wouldn't leaving connections open on a
busy server eventually adversely affect performance of the server?). I
tried hitting a few random servers on the Internet, and I never see an HTTP
Request precede the initial SYN packet no matter what the server type.

I did this test with Microsoft's Network Monitor, and I can't figure out how
to do an export to plain text so I didn't attach my results. (If you want
the MS NM dumps, I can send them to you.) Also, I don't have IE 5.x on my
workstation, so I can't try this with other versions of the browser. Maybe
the behavior changed from IE 5 to IE 6...?

~Jeff

On Sunday, January 05, 2003 6:13 PM, Matt Alexander wrote:

> Could someone with IE and IIS please verify this? A dump of TCP/IP
> traffic with different versions of IE and IIS would be ideal.