Under what circumstances would you expect a web browser split an HTTP request into two IP packets, even if the sum of the packet sizes is still less than the maximum segment size? I would assume that this would always be sent as a single packet, but my experience is showing otherwise.
Using Microsoft Network Monitor to analyze HTTP traffic, I occasionally see a request that is divided into two IP packets, as shown below
HTTP:Request, POST /foobar.htm (PacketID=55178, TotalLength=528)
POST /foobar.htm HTTP/1.1
Content-Type: application/x-www-form-urlencoded
...etc...
HTTP:HTTP Payload, URL: /foo.htm (PacketID=55179, TotalLength=98)
param1=foo¶m2=bar¶m3=foo+bar
I've only seen this happening on Windows XP clients so far, but it doesn't happen on all XP clients. And on the affected systems, both IE8 and Firefox exhibit the same double-packet behaviour.
Some context: We recently started using a third-party software package that provides a web application on our intranet. But instead of using a real web server like IIS or Apache, the software implements its own HTTP server internally.
Because the server uses a naive implementation of HTTP, it only inspects the first packet of an HTTP request, and misses the arguments sent in the second packet. This causes the request to fail.