Jeffrey Pyne wrote:
>
> On Monday, January 06, 2003 11:17 AM, Derek Neighbors wrote:
>
> > I can't comment on the issue, but I can comment on the tool
> > choice. (i.e. I'm not sure that Microsoft Networking Tools
> > can be trusted). For example Microsoft's ping tool doesnt
> > report 'duplicate' packets. If multiple packets are sent
> > it just ignores them and doesnt report that they are being
> > sent.
>
> I share your skepticism in Microsoft's networking tools. Unfortunately,
> that's all I had at my disposal at the moment. However, since NM does
> report HTTP Requests subsequent to the TCP/IP handshake, I would be
> surprised (well, not THAT surprised, I guess) if Network Monitor chose not
> to display that particular packet if it existed. If it were doing so, THAT
> would be even freakier than the original behavior being discussed. :)
>
> > Have you tried using more robust network monitors?
>
> I would normally use tcpdump on Linux or snoop on Solaris.... Duh, why
> didn't I run the capture on the server instead of on my workstation...?
> Need... more... coffee....
>
> Okay, I just used snoop on a Solaris box running iPlanet, and I still see no
> HTTP Request preceding the initial SYN from IE. So it appears that Network
> Monitor is trustworthy (at least in this instance).
>
> Is anyone else able to verify the behavior described in the article?
>
> ~Jeff
> ---------------------------------------------------
> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change you mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
I used IE 5.5/Win98 against microsoft.com (assuming their web server is
IIS 5) and noticed teh normal TCP behavior using ethereal.
Maybe this is an XP thing?
George
(text/plain)