Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are trying to fix a performance problem.

It is a WSS 3.0 solution running on Windows 2003, behind a hardware load balancer with IE6 clients. We use windows authentication with integrated security.

So far we have found that there appears to be a lot of unnecessary network traffic. There appears to be a pattern with 5 calls that return http 401.2, then 1 call that returns http 401.1, followed by a call that returns http 200.

Anyone know what could be generating these 401.2 errors or why there are 5 of them for each request.

share|improve this question
up vote 1 down vote accepted

Without seeing what, specifically, is being returned in the logs it's hard to say.

One quick way to see what's what is to browse the site from the server itself and/or another machine that is behind the firewall. If the behavior is the same as the firewall'ed behavior, that at least eliminates that as a problem.

Otherwise, some of this 401 stuff is "expected behavior" as it does take a couple/few steps for integrated authentication to get itself sorted out. Some refs:


share|improve this answer

That is normal, it is part of the pre-login handshake.

What is causing you to look at the IIS Logs? Are you suffering poor performance?

share|improve this answer
Yes it is a performance problem – Shiraz Bhaiji Oct 18 '10 at 14:45
When you say "pre-login handshake". Do you mean that it should happen once per session? Should it happen for every file that is requested? – Shiraz Bhaiji Oct 18 '10 at 14:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.