Bob Courchaine wrote:

Nevin Pratt wrote:

Brent Vukmer wrote:

Have you watched the HTTP request/response interaction using
Ethereal?  I find that tool to be a very helpful complement to digging
into networking code.

I'll try it.  Unfortunately, I'm Mac based.  So, I'll have to dig up
another machine somewhere.  But I'll give it a go.


Nevin, try using tcpdump from a Terminal. It comes w/ OS X.

You'll have to use sudo to run it as root ("sudo tcpdump").

Bob

I tried that. It wasn't particularly helpful. For example, while running tcpdump, when I type the following URL into my (Thunderbird) browser:

http://testing.shippingapis.com/ShippingAPITest.dll?API=Verify&XML=<AddressValidateRequest ><Address ID="0"><Address1></Address1><Address2>6406 Ivy Lane</Address2><City>Greenbelt</City><State>MD</State><Zip5></Zip5><Zip4></Zip4></Address></AddressValidateRequest>

tcpdump gives me the following:

10:56:05.224754 IP 192.168.0.25.56308 > utscfwhm01.ut.sprintbbd.net.domain: 26942+ A? testing.shippingapis.com. (42)
10:56:05.345274 IP utscfwhm01.ut.sprintbbd.net.domain > 192.168.0.25.56308: 26942* 1/3/3 A[|domain]
10:56:05.346627 IP 192.168.0.25.50582 > testing.shippingapis.com.http: S 1878312729:1878312729(0) win 65535 <mss 1460,nop,wscale 0,nop,nop,timestamp 1507361664 0>
10:56:05.414864 IP testing.shippingapis.com.http > 192.168.0.25.50582: S 2571541148:2571541148(0) ack 1878312730 win 17520 <mss 1460,nop,wscale 0,nop,nop,timestamp 0 0>
10:56:05.414968 IP 192.168.0.25.50582 > testing.shippingapis.com.http: . ack 1 win 65535 <nop,nop,timestamp 1507361664 0>
10:56:05.415152 IP 192.168.0.25.50582 > testing.shippingapis.com.http: P 1:723(722) ack 1 win 65535 <nop,nop,timestamp 1507361664 0>
10:56:05.528382 IP testing.shippingapis.com.http > 192.168.0.25.50582: P 1:101(100) ack 723 win 16798 <nop,nop,timestamp 112599815 1507361664>
10:56:05.529178 IP testing.shippingapis.com.http > 192.168.0.25.50582: FP 101:258(157) ack 723 win 16798 <nop,nop,timestamp 112599815 1507361664>
10:56:05.529229 IP 192.168.0.25.50582 > testing.shippingapis.com.http: . ack 259 win 65535 <nop,nop,timestamp 1507361664 112599815>
10:56:05.529436 IP 192.168.0.25.50582 > testing.shippingapis.com.http: F 723:723(0) ack 259 win 65535 <nop,nop,timestamp 1507361664 112599815>
10:56:05.599318 IP testing.shippingapis.com.http > 192.168.0.25.50582: . ack 724 win 16798 <nop,nop,timestamp 112599816 1507361664>

Then, in Squeak, when I enter that same URL as an argument to "HTTPClient httpGetDocument:", tcpdump gives me the following:

11:00:42.637048 IP 192.168.0.25.56324 > utscfwhm01.ut.sprintbbd.net.domain: 4024+ PTR? 12.0.0.224.in-addr.arpa. (41)
11:00:42.693034 IP utscfwhm01.ut.sprintbbd.net.domain > 192.168.0.25.56324: 4024* 1/3/9 PTR[|domain]
11:00:43.055624 IP 192.168.0.25.49271 > testing.shippingapis.com.http: S 849893481:849893481(0) win 65535 <mss 1460,nop,wscale 0,nop,nop,timestamp 1507362219 0>
11:00:43.193739 IP testing.shippingapis.com.http > 192.168.0.25.49271: S 1243403613:1243403613(0) ack 849893482 win 17520 <mss 1460,nop,wscale 0,nop,nop,timestamp 0 0>
11:00:43.193830 IP 192.168.0.25.49271 > testing.shippingapis.com.http: . ack 1 win 65535 <nop,nop,timestamp 1507362220 0>
11:00:43.555171 IP 192.168.0.25.49271 > testing.shippingapis.com.http: P 1:366(365) ack 1 win 65535 <nop,nop,timestamp 1507362220 0>
11:00:43.636319 IP testing.shippingapis.com.http > 192.168.0.25.49271: F 225:225(0) ack 366 win 17155 <nop,nop,timestamp 112585161 1507362220>
11:00:43.636409 IP 192.168.0.25.49271 > testing.shippingapis.com.http: . ack 1 win 65535 <nop,nop,timestamp 1507362220 0>
11:00:43.637288 IP testing.shippingapis.com.http > 192.168.0.25.49271: P 1:225(224) ack 366 win 17155 <nop,nop,timestamp 112585161 1507362220>
11:00:43.637322 IP 192.168.0.25.49271 > testing.shippingapis.com.http: . ack 226 win 65535 <nop,nop,timestamp 1507362220 112585161>
11:00:44.376669 IP 192.168.0.25.49271 > testing.shippingapis.com.http: R 366:366(0) ack 226 win 65535

As far as I can tell, that doesn't tell me anything about why the Microsoft IIS server at "testing.shippingapis.com" is treating the two requests differently-- why it works fine when my browser is the client, but returns a "400 Bad Request" error when Squeak is the client.

Nevin