Wireshark-users: [Wireshark-users] Duplicate HTTPS requests from iOS

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Samuel Vogel <samuel.vogel@xxxxxxxxxx>
Date: Tue, 30 Jul 2013 19:21:06 +0200
Hello,

I'm debugging a situation where we see duplicate HTTPS requests from iOS 5 & 6 devices with nginx 1.4.1. The first request seems to be cancelled by the client, but the package gets lost and now the new, repeated and the original request are both executed. This way the article ends up in the shopping cart twice.

Only one request is actually seen by iOS Safari / jQuery. This issue is reproducible most of the time (lets say 75 % of the cases) on two completely different servers with different hosting providers (Hetzner & Host Europe in Germany) but not with different browsers. It always follows the exact same pattern.
I'm pretty sure this can't be coincidental anymore, but have now idea what could cause this. It would be great if anybody could have  a look at my capture:

No.     Time        Source                Destination           Protocol Length Info
    493 27.329737   82.150.163.73         136.27.51.219         TCP      66     62463 > https [ACK] Seq=2166 Ack=9002 Win=130608 Len=0 TSval=649648630 TSecr=3316961520
    497 28.789294   82.150.163.73         136.27.51.219         HTTP     871    GET /checkout/addArticle?callback=jQuery172056467744265683_1375187557137&sActionIdentifier=&sAddAccessories=&sAdd=4006040201915&sQuantity=1&_=1375187559605 HTTP/1.1 
    498 28.789391   136.27.51.219         82.150.163.73         TCP      66     https > 54311 [ACK] Seq=24569 Ack=5226 Win=18944 Len=0 TSval=3316961907 TSecr=649650051
    499 28.789401   82.150.163.73         136.27.51.219         TLSv1    103    Alert (Level: Warning, Description: Close Notify)
    500 28.789409   136.27.51.219         82.150.163.73         TCP      66     https > 54311 [ACK] Seq=24569 Ack=5263 Win=18944 Len=0 TSval=3316961907 TSecr=649650052
    501 28.789413   82.150.163.73         136.27.51.219         TCP      66     54311 > https [FIN, ACK] Seq=5263 Ack=24569 Win=131072 Len=0 TSval=649650052 TSecr=3316961416
    502 28.789975   136.27.51.219         82.150.163.73         TCP      66     https > 54311 [FIN, ACK] Seq=24569 Ack=5264 Win=18944 Len=0 TSval=3316961907 TSecr=649650052
    503 28.789993   82.150.163.73         136.27.51.219         HTTP     871    GET /checkout/addArticle?callback=jQuery172056467744265683_1375187557137&sActionIdentifier=&sAddAccessories=&sAdd=4006040201915&sQuantity=1&_=1375187559605 HTTP/1.1 
    504 28.790144   136.27.51.219         82.150.163.73         TCP      66     https > 62463 [ACK] Seq=9002 Ack=2971 Win=13056 Len=0 TSval=3316961907 TSecr=649650053
    505 28.839637   82.150.163.73         136.27.51.219         TCP      66     [TCP Retransmission] 54311 > https [FIN, ACK] Seq=5263 Ack=24569 Win=131072 Len=0 TSval=649650117 TSecr=3316961907
    506 28.839661   136.27.51.219         82.150.163.73         TCP      78     [TCP Dup ACK 502#1] https > 54311 [ACK] Seq=24570 Ack=5264 Win=18944 Len=0 TSval=3316961919 TSecr=649650117 SLE=5263 SRE=5264
    507 28.839665   82.150.163.73         136.27.51.219         TCP      66     [TCP Retransmission] 54311 > https [FIN, ACK] Seq=5263 Ack=24569 Win=131072 Len=0 TSval=649650117 TSecr=3316961907
    508 28.839710   136.27.51.219         82.150.163.73         TCP      78     [TCP Dup ACK 502#2] https > 54311 [ACK] Seq=24570 Ack=5264 Win=18944 Len=0 TSval=3316961919 TSecr=649650117 SLE=5263 SRE=5264
    509 28.840856   82.150.163.73         136.27.51.219         TCP      66     54311 > https [ACK] Seq=5264 Ack=24570 Win=131072 Len=0 TSval=649650117 TSecr=3316961907
    510 29.945273   136.27.51.219         82.150.163.73         TCP      1506   [TCP segment of a reassembled PDU]
    511 29.945307   136.27.51.219         82.150.163.73         HTTP     695    HTTP/1.1 200 OK  (text/_javascript_)

Best Regards,
Samuel