On Windows Server 2003 with IIS 6.0, I am seeing that Http.sys blocks some incoming requests.
Http.sys logs RequestLength in Httperr.log and returns status code 400.
I have found an description from Microsoft about what Http.sys logs at http://support.microsoft.com/kb/820729. It states that the error is “A request length limit was exceeded.”
I have found another description from Microsoft about configuring Http.sys at http://support.microsoft.com/kb/820129. It states that “MaxRequestBytes --- Determines the upper limit for the total size of the Request line and the headers. Its default setting is 16KB. If this value is lower than MaxFieldLength, the MaxFieldLength value is adjusted.”
My problem is that I have a Wireshark capture of the communication and according to Wireshark, Http.sys accepts a couple of larger request before getting the request that it rejects. (I am looking at the “reassembled TCP” or “Hypertext Transfer Protocol”). This makes me believe that Http.sys does not count everything in the request.
Is this wrong? Does anyone know what is counted?
