Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to find out if our IIS server is being asked to serve pages compressed. I'm a noob regarding a lot of this so am working my way through the issues.

We're using IIS 6.0 and have correctly turned compression on. If I use Fiddler2 to analyse the HTTP requests via localhost, then Fiddler reports that the pages are compressed.

If we then access the server over the network, either via its external URL or via the internal server name, Fiddler reports those pages as uncompressed.

Therefore, it's logical to assume that something is getting in the way - presumably our ISA server.

Our ISA administrator states that ISA is configured to allow compressed requests but what I want to do is to look at the requests coming through to IIS to see if IIS is being asked to serve pages compressed. I'm fairly convinced that our request is going to ISA, ISA is forwarding these, but not with the "compression" details - therefore IIS is not performing any compression.

I've looked at the IIS logs but can't see anything obvious about the HTTP request. Is there any way I can check, on the web server itself, this sort of information?

One thing that is confusing, but it may be normal, is that the Client IP making the request is not the orignal PC (i.e. mine) and not the ISA firewall, but the web server itself...


share|improve this question
up vote 2 down vote accepted

A sniffer (like Wireshark or the built-in Network Monitor in Windows) is your friend. There's no substitute for looking at the packets, especially when you've got a situation like this where you migth want to examine the traffic before ISA Server gets ahold of it and afterwards.

share|improve this answer

In the IIS logs, you are looking for the phrase "gzip". The column you are looking for the client ip is the c-ip. The logs do also contain the server's ip address. The client ip address is the 9th (ish) column along.

Have a look at LogParser if you want to query the logs.

share|improve this answer
Thanks Matthew. I've checked the text based IIS logs (..Windows\System32\logfiles) but no phrase gzip anywhere, but Fiddler is still saying the page is compressed and the IIS compression folder contains compressed files. Is there another log I should be looking at? – Graham Jun 28 '10 at 10:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.