[Don Pickett]

From Slashdot:

Internet Explorer on Windows always seems either to run impossibly fast (page requests are fulfilled almost before the mouse button has returned to its original unclicked position), or ridiculously slow (as with the weird stalling-on-connect problem that many people, including myself, have noticed).

One possible explanation is something that my team and I noticed a couple of years ago, in analyzing packet traces of IE's connection setup procedure. Microsoft might have fixed this since then; I'm not sure. But it's a possible culprit.

First of all, for those rusty on their TCP/IP-- here's how a normal HTTP request over TCP should work:

Client Server
1. SYN ->
2.
4. Request ->

This is how the client and server synchronize their sequence numbers, which is how a connection gets established. The client sends a synchronization request, the server acknowledges it and sends a synchronization request of its own, and the client acknowledges that. Only then can the HTTP request proceed reliably.

The server's SYN (synchronize) and ACK (acknowledgement) packets are combined for speed; there's no reason to send two separate packets, when you're trying to get a connection established as quickly as possible. Another speed enhancement that Mac OS 9's stack uses, by the way, is to combine the client's ACK and the HTTP request into a single packet; this is legal, but not frequently done. The idea is that within the structure of TCP/IP, you want to minimize the number of transactions that need to take place in setting up the two-way handshake necessary before you can send the HTTP request.

When tearing down a connection, it looks like this:

Client Server
1.
3. FIN ->
4.
Uh... what? Dunno what the hell this is. I'll ignore it, or RST.
2. Oh, you're a standard server. Okay: SYN ->
3.
5. Request ->

In other words, instead of sending a SYN packet like every other TCP/IP application in the world, IE would send out the request packet first of all. Just to check. Just in case the HTTP server was, oh, say, a Microsoft IIS server. Because IIS' HTTP teardown sequence looked like this:

Client Server
1. ...And that's it. The client doesn't FIN, and the server doesn't ACK. In other words, the connection is kept "half-open" on the server end. The reason for this? Why, to make subsequent connections from IE clients faster. If the connection isn't torn down all the way, all IE has to do is send an HTTP request, with no preamble-- and the server will immediately respond. Ingenious!

They probably called it "Microsoft Active Web AccelerationX™®" or something.

(I may be remembering this incorrectly; it might be that the client does FIN, and the server simply keeps the connection around after it ACKs it. Instead of shutting down the connection entirely, it just waits to see if that client will come back, so it can open the connection back up immediately instead of having to go through that whole onerous SYN-SYN/ACK procedure. Damn rules!)

Now, what does this mean for non-IIS servers? It means that if you use IE to connect to them, it first tries to send that initial request packet, without any SYNs-- and then it only proceeds with the standard TCP connection setup procedure if the request packet gets a RST or no response (either of which is a valid way for a legal stack to deal with an unsynchronized packet). But IIS, playing by its own rules, would respond to that packet with an HTTP response right away, without bothering to complete the handshake. So IE to IIS servers will be nice and snappy, especially on subsequent connections after the first one. But IE to non-IIS servers waste a packet at the beginning of each request-- and depending on how the server handles that illegal request, it might immediately RST it, or it might just time out... which would make the browser seem infuriatingly slow to connect to new websites.

[gorgonzola]

That's very interesting. But there's something weird going on with your lists...the sequence of stuff is out of order and contains blank and missing steps and stuff.

[Don Pickett]

Originally posted by gorgonzola:
That's very interesting. But there's something weird going on with your lists...the sequence of stuff is out of order and contains blank and missing steps and stuff.

That's as copied directly from Slashdot. The original site is Slashdotted, so we'll have to wait until later to view it.

[gorgonzola]

Ah, ok. Makes sense.

[Adam Betts]

Originally posted by Don Pickett:
That's as copied directly from Slashdot. The original site is Slashdotted, so we'll have to wait until later to view it.

You should at least give them a credit for that. I thought you typed all of it yourself.

[Socially Awkward Solo]

Originally posted by Adam Betts:
You should at least give them a credit for that. I thought you typed all of it yourself.

Oooooh the horror! Someone at Slashdot isn't sleeping tonight!

[forkies]

Originally posted by Socially Awkward Solo:
Oooooh the horror! Someone at Slashdot isn't sleeping tonight!

**** you, ass.

[Camelot]

Funny, this whole discussion sounds to me remarkably like HTTP Keep-alives, which are a part of the HTTP 1.1 specification and supported by all modern browsers and servers, including Apache.

Just to prove it, Apache's KeepAlive documentation can be found at: http://httpd.apache.org/docs/keepalive.html

I haven't read the original /. article, but I'd want to see a comparison between IE and, say, Mozilla accessing the same set of servers before I'm convinced this is anything special on MS's part.

It might just be a (rare?) documented case of MS following the specs.

Now if you told me that IIS only honored keep-alives for IE and forced all non-MS browsers to initiate new connections for each request, I wouldn't be overly surprised...

[macmike42]

This has nothing to do with Keep-Alive. This is a blatant disregard of the TCP/IP protocol at the cost of security.

Keep-Alive establishes a normal connection to the web server and keeps it open for subsequent requests (such as images, stylesheets, etc.).

WinIE bypasses the normal TCP/IP connection procedure, which is to send a SYN (synchronization) packet, then wait for a SYN response and ACK (acknowledgment) packet. This is how all TCP/IP connections are established. What WinIE does is to immediately send out a HTTP request, without establishing a valid connection of any kind, and wait for either a) a response, b) an error message, or c) a connection timeout. If it doesn't get a response, or times out, it tries again the "legal" way.

Of course, all Microsoft server products respond perfectly to to this "illegal" form of HTTP request. All other operating systems drop the packet and either send an error message, or better yet, simply act like nothing happened. Either way, the packet never makes it to userspace. If an error is sent, the connection still seems relatively quick, otherwise, pageloads slow to a crawl waiting for timeouts.

Basically what a SYN packet does is create a short-term agreement between two hosts on a "magic number" that will be attached to every subsequent packet that is considered part of that connection. The main problem here is that without the SYN and ACK packets (required by the TCP/IP specs), it is trivially easy to spoof the network address of any packet. This is why any good TCP/IP stack will completely ignore any packets which have not been SYN'd and ACK'd.

Since Microsoft's TCP/IP stack obviously passes these (and other) malformed packets on to whatever application is listening for them, it should become quite clear how Microsoft has sacrificed security for perceived performance.

[Socially Awkward Solo]

Originally posted by forkies:
**** you, ass.

What is it like
to have someone who
cares about you
takes time for you
is drawn to you
makes you feel like a king
trusts you
& isn't afraid to
take down all of his defenses
so that it is obvious he loves you
& wants you to love him?

What is it like?

[Don Pickett]

The live link, no longer slashdotted: http://grotto11.com/blog/slash.html?+1039831658

[forkies]

Originally posted by Socially Awkward Solo:
What is it like
to have someone who
cares about you
takes time for you
is drawn to you
makes you feel like a king
trusts you
& isn't afraid to
take down all of his defenses
so that it is obvious he loves you
& wants you to love him?

What is it like?

By what means did you find my poetry? Though I am flattered to have you quote it, I fail to see what my poetry has to do with your being an ass. Also, I'd appreciate it if you would give me credit for my own poem, you plagiarist bastard.

more of my poetry

[milhouse]

This petty name calling and flaming is getting as bad as some of the stuff at Ars...

[Millennium]

Forkies, Solo, calm down.

From the look of it, this is yet another case of Microsoft's Embrace And Extend philosophy. Go figure; they really do cheat.

[Ken_F2]

This was debunked by several other sites, btw.

[AKcrab]

Originally posted by Ken_F2:
This was debunked by several other sites, btw.

How enlightening... Can you be more specific?

[Drizzt]

There are other reasons why it is so faster..

It ignores the "no cache" header, you need tomake a 'Expire' header so it works..

It caches about everything..

Even if you choose to 'Check web pages on every visit' instead of 'Automaticly' updating.. it doesn't..

There are other stuff like that.. I had a hell of a time solving these problems.. Everything was fine with IE/Mac, Gecko/Mozilla.. but IE/Win was giving me headaches..