Windows 10 - TCP segmentation causes partial HTML response

Question

EDIT 2: As per comment, updated question from fragmentation to segmentation.

EDIT: I've narrowed this issue to Windows 10 alone - seems like IE hardening was the issue on 2012 R2 which lead me to believe 8.1 is affected too. Original question content follows:

I'm receiving segmented HTTP response from webserver.

First packet (709 on first image) looks like this: 2 - as you can see it contains headers and then content. Second packet (710 on first image) looks like this: 3. Rest of packets are irrelevant to this question, but they contain rest of HTML content.

Checking reassembled data in Wireshark shows proper HTTP response: 4, however ANY (browser or not browser) userland application will receive this: 5. As you can see, it looks like HTML content that is AFTER headers in first packet is missing, instead data follows from second to last packet. For everything to be even more funny, this happens only if application sent HTTP/1.1 or HTTP/1.0 request - sending HTTP/1.2, HTTP/0.9, HTTP/2.0 or even any arbitrary data like "GET / AAA" will result in webserver responding with HTTP/1.1 and application receiving proper data: 6. For what it's worth it seems like something in network stack is attempting some sort of optimization for HTTP requests but I was unable to find any information about this. The issue shows up only on Windows 8+ (or 8.1+, don't have any 8 machine to test) including Server editions. There are no issues with Windows 7 or older or any other *nix based system. This is same issue as can be seen on TP-Link forums (http://forum.tp-link.com/showthread.php?93626-TL-SG105E-v2-Web-interface-unresponsive-Config-utility-works) however I'm pretty sure this is an issue with Windows implementation failing at this specific case (even assuming webserver is doing something improperly, this works on older Windows and *nix systems).

I'm open to any suggestions as frankly at this point I think I'm going crazy.

Answer 1

This is probably a combination of two errors: the server sending an invalid response and the AV handling this wrong response by corrupting it. The server sends a response with code 401 but no WWW-Authenticate header. This is invalid according to the HTTP standard:

The response MUST include a WWW-Authenticate header field (section 14.47) containing a challenge applicable to the requested resource.

This WWW-Authenticate header containing a realm is needed so that the browser can either prompt the user to provide the credentials for this realm or use cached credentials. Sending no WWW-Authenticate but instead sending a HTML page which even contains script is definitely wrong behavior of the server.

Note that response code 401 must only be used if the browsers build in authentication dialog should be used and then a realm need to be provided. If one builds its own authentication system outside of HTTP (i.e. the typical logins inside HTML like it seems to be in this case) then response code 200 must be used.

Answer 2

So, to anyone looking for an answer - it turns out David Schwartz was right, the issue was with security software, however it seems it can be classified as a bug with Bitdefender - even after completely disabling it there were no changes - only uninstalling it gave a proper result. It seems its firewall WFP driver (bdfwfpf.sys) is always working regardless of settings and package you have installed (the one I have does not feature firewall functionality). This seems very aggressive to me and so my solution was equally aggressive - remove WFP firewall driver file and lock permissions to relevant registry keys.