Invalid 'Bytes In' reported

[sabreB6]

Hey!

Can you please take a look on this test result? Report shows Bytes-In 165.3 KB whereas real file size is 0.9 KB!

TCP dump included: http://www.webpagetest.org/result/120223_CF_3B4XR/4.cap

Test: http://www.webpagetest.org/result/120223...4/details/

Failing request:

Request 6:

URL: https://wl8-int.sabresonicweb.com/SSW201...9488115054
Host: wl8-int.sabresonicweb.com
IP: 151.193.58.218
Location: Dallas, TX*
Error/Status Code: 200
Start Offset: 1.806 s
Initial Connection: 121 ms
SSL Negotiation: 0 ms
Time to First Byte: 131 ms
Content Download: 4090 ms
Bytes In (downloaded): 165.3 KB
Bytes Out (uploaded): 1.3 KB

Request Headers:

GET /SSW2010/javascripts/sabre/whitelabel-min.js?1329488115054 HTTP/1.1
Accept: */*
Referer: https://wl8-int.sabresonicweb.com/SSW201...ution=e1s1
Accept-Language: en-US
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; PTST 2.311)
Accept-Encoding: gzip, deflate
Host: wl8-int.sabresonicweb.com
Connection: Keep-Alive
Cookie: JSESSIONID=1289934B0193AF7E52526F6655319191; WLPCOOKIE=sswhli4538

Response Headers:

HTTP/1.1 200 OK
Cache-Control: private, max-age=2592000, must-revalidate
Expires: Sat, 24 Mar 2012 08:22:49 GMT
Accept-Ranges: bytes
ETag: W/"890-1329216162000"
Last-Modified: Tue, 14 Feb 2012 10:42:42 GMT
Content-Type: text/javascript
Content-Length: 890
Date: Thu, 23 Feb 2012 08:22:48 GMT

Any idea why report shows that high difference in size?

Regards,
Sebastian

[pmeenan]

My best guess from the tcpdump is that it is the connection that originates on port 56000. It looks like the bytes that came in are correctly being reported but I can't tell you what's actually IN the SSL payload because of the encryption. If you have access to the server's private key you should be able to use wireshark to decrypt the conversation.

[sabreB6]

Thanks Patrick, I'l ltry to decode stream if I get key, I'll let you know once i find something.

[sabreB6]

I noticed another thing.

Request 6 and Request 13 have vary similar content size, the difference is very close to real size of request 6 (0.9KB).
rq6: 165.3 KB
rq13: 163.7 KB

Check connection view, request6 is processed using connection 5, request 13 is processed using connection 6, both ends almost at the same time (calculated based on data from each rq).
rq6: 6.148
rq13: 6.027

Why report shows 7 connections for wl8-int.sabresonicweb.com whereas IE8 supports 6 connections per domain?

Why request 13 has invalid IP specified?

Request 6:

URL: https://wl8-int.sabresonicweb.com/SSW201...9488115054
Host: wl8-int.sabresonicweb.com
IP: 151.193.58.218
Location: Dallas, TX*
Error/Status Code: 200
Start Offset: 1.806 s
Initial Connection: 121 ms
SSL Negotiation: 0 ms
Time to First Byte: 131 ms
Content Download: 4090 ms
Bytes In (downloaded): 165.3 KB
Bytes Out (uploaded): 1.3 KB

Request 13:

URL: https://wl8-int.sabresonicweb.com/SSW201...9488115054
Host: wl8-int.sabresonicweb.com
IP: 0.0.0.0
Location: *
Error/Status Code: 200
Start Offset: 3.399 s
Time to First Byte: 496 ms
Content Download: 2132 ms
Bytes In (downloaded): 163.7 KB
Bytes Out (uploaded): 0.6 KB

I'm working with OPS team to decode transmission.

[pmeenan]

Hmm, something really strange is certainly going on. IE supports 6 simultaneous connections so it can go over 6 as long as a previous connection closed (like the caymanairways requests) but it does look like the code is tracking 7.

I have some experimental code that will let me get the decrypted data from IE's inbound streams. If you don't have luck with the ops team and the keys I can see about hacking it in for a quick test (later in the week though, I'm tied up all day today).

[sabreB6]

The report shows that http://www.caymanairways.com does not utilize persistent connections so higher number of connections for this domain is fine - interestingly this is not an issue in my FF or PageSpeed online (maybe server checks User-Agent?)

We didn't decode tcp-dump yet so I'm not sure if this is possible. I'll keep you updated.

Thanks.