Duplicate HTTPS requests from iOS

[Samuel Vogel <samuel.vogel () viison com>]

Hello,

I'm debugging a situation where we see duplicate HTTPS requests from iOS 5
& 6 devices with nginx 1.4.1. The first request seems to be cancelled by
the client, but the package gets lost and now the new, repeated and the
original request are both executed. This way the article ends up in the
shopping cart twice.

Only one request is actually seen by iOS Safari / jQuery. This issue is
reproducible most of the time (lets say 75 % of the cases) on two
completely different servers with different hosting providers (Hetzner &
Host Europe in Germany) but not with different browsers. It always follows
the exact same pattern.
I'm pretty sure this can't be coincidental anymore, but have now idea what
could cause this. It would be great if anybody could have  a look at my
capture:

No.     Time        Source                Destination           Protocol
Length Info
    493 27.329737   82.150.163.73         136.27.51.219         TCP      66
    62463 > https [ACK] Seq=2166 Ack=9002 Win=130608 Len=0 TSval=649648630
TSecr=3316961520
    497 28.789294   82.150.163.73         136.27.51.219         HTTP
871    GET
/checkout/addArticle?callback=jQuery172056467744265683_1375187557137&sActionIdentifier=&sAddAccessories=&sAdd=4006040201915&sQuantity=1&_=1375187559605
HTTP/1.1
    498 28.789391   136.27.51.219         82.150.163.73         TCP      66
    https > 54311 [ACK] Seq=24569 Ack=5226 Win=18944 Len=0 TSval=3316961907
TSecr=649650051
    499 28.789401   82.150.163.73         136.27.51.219         TLSv1
 103    Alert (Level: Warning, Description: Close Notify)
    500 28.789409   136.27.51.219         82.150.163.73         TCP      66
    https > 54311 [ACK] Seq=24569 Ack=5263 Win=18944 Len=0 TSval=3316961907
TSecr=649650052
    501 28.789413   82.150.163.73         136.27.51.219         TCP      66
    54311 > https [FIN, ACK] Seq=5263 Ack=24569 Win=131072 Len=0
TSval=649650052 TSecr=3316961416
    502 28.789975   136.27.51.219         82.150.163.73         TCP      66
    https > 54311 [FIN, ACK] Seq=24569 Ack=5264 Win=18944 Len=0
TSval=3316961907 TSecr=649650052
    503 28.789993   82.150.163.73         136.27.51.219         HTTP
871    GET
/checkout/addArticle?callback=jQuery172056467744265683_1375187557137&sActionIdentifier=&sAddAccessories=&sAdd=4006040201915&sQuantity=1&_=1375187559605
HTTP/1.1
    504 28.790144   136.27.51.219         82.150.163.73         TCP      66
    https > 62463 [ACK] Seq=9002 Ack=2971 Win=13056 Len=0 TSval=3316961907
TSecr=649650053
    505 28.839637   82.150.163.73         136.27.51.219         TCP      66
    [TCP Retransmission] 54311 > https [FIN, ACK] Seq=5263 Ack=24569
Win=131072 Len=0 TSval=649650117 TSecr=3316961907
    506 28.839661   136.27.51.219         82.150.163.73         TCP      78
    [TCP Dup ACK 502#1] https > 54311 [ACK] Seq=24570 Ack=5264 Win=18944
Len=0 TSval=3316961919 TSecr=649650117 SLE=5263 SRE=5264
    507 28.839665   82.150.163.73         136.27.51.219         TCP      66
    [TCP Retransmission] 54311 > https [FIN, ACK] Seq=5263 Ack=24569
Win=131072 Len=0 TSval=649650117 TSecr=3316961907
    508 28.839710   136.27.51.219         82.150.163.73         TCP      78
    [TCP Dup ACK 502#2] https > 54311 [ACK] Seq=24570 Ack=5264 Win=18944
Len=0 TSval=3316961919 TSecr=649650117 SLE=5263 SRE=5264
    509 28.840856   82.150.163.73         136.27.51.219         TCP      66
    54311 > https [ACK] Seq=5264 Ack=24570 Win=131072 Len=0 TSval=649650117
TSecr=3316961907
    510 29.945273   136.27.51.219         82.150.163.73         TCP
 1506   [TCP segment of a reassembled PDU]
    511 29.945307   136.27.51.219         82.150.163.73         HTTP
695    HTTP/1.1 200 OK  (text/javascript)

Best Regards,
Samuel

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe