MS changes IE and IIS TCP/IP rules

[Jeffrey Pyne]

On Monday, January 06, 2003 11:17 AM, Derek Neighbors wrote:

> I can't comment on the issue, but I can comment on the tool 
> choice.  (i.e. I'm not sure that Microsoft Networking Tools 
> can be trusted). For example Microsoft's ping tool doesnt 
> report 'duplicate' packets.  If multiple packets are sent 
> it just ignores them and doesnt report that they are being 
> sent.

I share your skepticism in Microsoft's networking tools.  Unfortunately,
that's all I had at my disposal at the moment.  However, since NM does
report HTTP Requests subsequent to the TCP/IP handshake, I would be
surprised (well, not THAT surprised, I guess) if Network Monitor chose not
to display that particular packet if it existed.  If it were doing so, THAT
would be even freakier than the original behavior being discussed.  :)

> Have you tried using more robust network monitors?

I would normally use tcpdump on Linux or snoop on Solaris....  Duh, why
didn't I run the capture on the server instead of on my workstation...?
Need... more... coffee....  

Okay, I just used snoop on a Solaris box running iPlanet, and I still see no
HTTP Request preceding the initial SYN from IE.  So it appears that Network
Monitor is trustworthy (at least in this instance).  

Is anyone else able to verify the behavior described in the article?

~Jeff