MS changes IE and IIS TCP/IP rules

[Jeffrey Pyne]

I seem to see different behavior than that described in the article.  When I
use IE 6.0 to hit our IIS 4.0 server (don't ask), I see this:

Client		Server
------		------
SYN		-->	
		<--	SYN/ACK
ACK		-->	
HTTP Request -->
		<--	HTTP Response
etc.

I don't see an HTTP request preceding the initial SYN packet.  

If I use IE 6.0 to hit one of our iPlanet servers, I see the same thing:

Client		Server
------		------
SYN		-->	
		<--	SYN/ACK
ACK		-->	
HTTP Request -->
		<--	HTTP Response
etc.

Again, no HTTP Request preceding the initial SYN.

If I use IE 6.0 to hit one of our iPlanet servers twice, with a couple
seconds in between each request, I see this:

Client		Server
------		------
SYN		-->	
		<--	SYN/ACK
ACK		-->	
HTTP Request -->
		<--	HTTP Response
etc.
		<--	FIN
ACK		-->
FIN		-->	
		<--	ACK
...
SYN		-->	
		<--	SYN/ACK
ACK		-->	
HTTP Request -->
		<--	HTTP Response
etc.
		<--	FIN
ACK		-->
FIN		-->	
		<--	ACK

Still no HTTP Request preceding the initial SYN packet.

If I use IE 6.0 to hit our IIS 4.0 server (again, don't ask) twice, with a
couple seconds in between the requests, I see this:

Client		Server
------		------
SYN		-->	
		<--	SYN/ACK
ACK		-->	
HTTP Request -->
		<--	HTTP Response
etc.
...
SYN		-->	
		<--	SYN/ACK
ACK		-->	
HTTP Request -->
		<--	HTTP Response
etc.

Same thing (still no HTTP Request preceding the initial SYN), except that
there is no tear-down of the connections.  I assume if I left the network
capture running for a few more seconds, the tear-down would eventually come.
The browser doesn't seem to re-use the first TCP/IP connection for the
subsequent request.  So the only difference I see is the delay in tearing
down the connections, which wouldn't improve perceived performance on the
client (I think).  (And actually, wouldn't leaving connections open on a
busy server eventually adversely affect performance of the server?).  I
tried hitting a few random servers on the Internet, and I never see an HTTP
Request precede the initial SYN packet no matter what the server type.

I did this test with Microsoft's Network Monitor, and I can't figure out how
to do an export to plain text so I didn't attach my results.  (If you want
the MS NM dumps, I can send them to you.)  Also, I don't have IE 5.x on my
workstation, so I can't try this with other versions of the browser.  Maybe
the behavior changed from IE 5 to IE 6...?

~Jeff

On Sunday, January 05, 2003 6:13 PM, Matt Alexander wrote:
 
> Could someone with IE and IIS please verify this?  A dump of TCP/IP
> traffic with different versions of IE and IIS would be ideal.