HTTP POST Missing Information

[David Davidson]

I'm just wondering if anybody's seen a problem with their web server recently
that's similar to the following: about two weeks ago some clients on our
intranet started experiencing lost sessions - they would be automatically
redirected back to our default page when doing a normal "postback" (like
clicking a Save or a Search button).

After researching the logs, we saw HTTP POST lines with missing SESSIONID
entries. In fact, the HTTP POSTs have no Form or Cookie collections. I
haven't done it yet, but I'm planning on using Fiddler to verify the client
is actually sending them. It happens only with clients on our intranet (Win
XP Pro boxes), only with certain pages (seem to have very large ViewStates
and, thus, large Forms collections), and intermittently with no discernable
pattern. Sometimes the pages work and have all the necessary info included
with the HTTP POST, sometimes the info is missing and a new session is
started.

The web server is in a DMZ behind a Symantec Raptor firewall and has a
reverse-proxy server as well (which is not controlled by us so I don't have
much info on it at the moment).

I am leaning towards the possibility of update MS05-054 causing the problem,
but I'm still troubleshooting. The problem may be the client or the reverse
proxy server - the web server is definitely not receiving the Forms and
Cookie collections on some HTTP POSTs.

Has anybody out there seen something similar?

- Dave

 

[Luke Zhang [MSFT]]

Hello Dave,

Normally, this kind of problem mostly are caused by proxy or firewall, you
may first confirm if the problem wouldn't occur if the client request is
not crossing the proxy or firewall. Also you may perform a TCP trace on
client side (for example, with netmon) and server side, check the detailed
http content sent between them and where the Forms and Cookie collections
are lost.

Luke Zhang

 

[David Davidson]

Thanks for the response - been doing exactly what you just suggested all day
today. I scoured over firewall and web server logs, pinpointing the date the
problem started (January 6th), and set up a notebook computer with Ethereal
for use as a packet sniffer. (Can't bypass the firewall or proxy because
this is a production environment, and we can't duplicate the problem on our
development network.) I'm still thinking the problem is with the proxy
server, but will know for sure tomorrow morning when I finish looking over
the capture files. Also, I'm still looking at update MS05-054 as the
possible culprit so I must ask again, anybody else seeing a problem like this?

- Dave

 

[Luke Zhang [MSFT]]

I am working with several computers installed update MS05-054 but no same
issues found. It is mostly a proxy related problem. Let's see what you can
find from the sniffer result.

Luke