EDIT 2: As per comment, updated question from fragmentation to segmentation.

EDIT: I've narrowed this issue to Windows 10 alone - seems like IE hardening was the issue on 2012 R2 which lead me to believe 8.1 is affected too. Original question content follows:

I'm receiving segmented HTTP response from webserver.

First packet (709 on first image) looks like this: 2 - as you can see it contains headers and then content. Second packet (710 on first image) looks like this: 3. Rest of packets are irrelevant to this question, but they contain rest of HTML content.

Checking reassembled data in Wireshark shows proper HTTP response: 4, however ANY (browser or not browser) userland application will receive this: 5. As you can see, it looks like HTML content that is AFTER headers in first packet is missing, instead data follows from second to last packet. For everything to be even more funny, this happens only if application sent HTTP/1.1 or HTTP/1.0 request - sending HTTP/1.2, HTTP/0.9, HTTP/2.0 or even any arbitrary data like "GET / AAA" will result in webserver responding with HTTP/1.1 and application receiving proper data: 6. For what it's worth it seems like something in network stack is attempting some sort of optimization for HTTP requests but I was unable to find any information about this. The issue shows up only on Windows 8+ (or 8.1+, don't have any 8 machine to test) including Server editions. There are no issues with Windows 7 or older or any other *nix based system. This is same issue as can be seen on TP-Link forums (http://forum.tp-link.com/showthread.php?93626-TL-SG105E-v2-Web-interface-unresponsive-Config-utility-works) however I'm pretty sure this is an issue with Windows implementation failing at this specific case (even assuming webserver is doing something improperly, this works on older Windows and *nix systems).

I'm open to any suggestions as frankly at this point I think I'm going crazy.

  • I don't understand what the issue is. Can you be very specific about what's wrong? Where did image 5 come from? How was it made? It just looks like perhaps some security software is moving meta headers from the HTML to the top. What's so wrong with that? Oct 31, 2017 at 21:22
  • Maybe this will be easier to understand, this is how page looks in a browser: i.imgur.com/hwp28ns.png. I can confirm this is happening on Windows Server 2012 R2 with no antivirus solution installed connected directly via LAN cable to webserver responding. Analyzing on wire data via Wireshark shows that whole data was received however initial 1307 bytes of HTML content were lost somehow.
    – eider96
    Oct 31, 2017 at 21:31
  • Sounds like some filtering or security software on the machine is mangling the data. Oct 31, 2017 at 21:32
  • There is no filtering or security software installed. I've created this network from scratch and as said above I can confirm this is happening on a machine connected directly to managed switch which sends this HTTP response in question with no other cables attached. I've tested this on my laptop (also connected directly to switch - this is how i saw the issue when i was unable to configure it via HTTP), PC and server.
    – eider96
    Oct 31, 2017 at 21:34
  • 1
    UPDATE: I've narrowed this issue to Windows 10 alone - seems like IE hardening was the issue on 2012 R2 which lead me to believe 8.1 is affected too. Still believe this is an issue with OS, not application within OS considering two other people on TP-LINK forums have same issue.
    – eider96
    Oct 31, 2017 at 21:40

2 Answers 2


This is probably a combination of two errors: the server sending an invalid response and the AV handling this wrong response by corrupting it. The server sends a response with code 401 but no WWW-Authenticate header. This is invalid according to the HTTP standard:

The response MUST include a WWW-Authenticate header field (section 14.47) containing a challenge applicable to the requested resource.

This WWW-Authenticate header containing a realm is needed so that the browser can either prompt the user to provide the credentials for this realm or use cached credentials. Sending no WWW-Authenticate but instead sending a HTML page which even contains script is definitely wrong behavior of the server.

Note that response code 401 must only be used if the browsers build in authentication dialog should be used and then a realm need to be provided. If one builds its own authentication system outside of HTTP (i.e. the typical logins inside HTML like it seems to be in this case) then response code 200 must be used.

  • You are most likely correct as I noticed that if I log in, and then install Bitdefender (logins persist between reboots) I can use site with no issues until I log out.
    – eider96
    Nov 1, 2017 at 7:15

So, to anyone looking for an answer - it turns out David Schwartz was right, the issue was with security software, however it seems it can be classified as a bug with Bitdefender - even after completely disabling it there were no changes - only uninstalling it gave a proper result. It seems its firewall WFP driver (bdfwfpf.sys) is always working regardless of settings and package you have installed (the one I have does not feature firewall functionality). This seems very aggressive to me and so my solution was equally aggressive - remove WFP firewall driver file and lock permissions to relevant registry keys.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .