hello

this request causes a “bad request” ond IIS6 – but works fine on IIS5 –
what’s wrong with this request?
no ? no lowercase keyword… no hostheaderproblems (http1.0) – no idea?! 😉

—————–>> request:
0x0000 00 01 03 BF C8 F2 00 06-DC 00 26 06 08 00 45 00 …¿Èò..Ü.&…E.
0x0010 01 52 00 7A 00 00 FE 06-70 34 C0 A8 64 DD C0 A8 .R.z..þ.p4À¨dÝÀ¨
0x0020 64 C9 04 07 00 50 CB FA-20 01 94 18 3C 54 80 18 dÉ…PËú .”.<T?.
0x0030 2D A0 E9 95 00 00 08 0A-00 0C BF A3 00 00 00 00 – é…….¿£….
0x0040 00 00 47 45 54 20 2F 20-48 54 54 50 2F 31 2E 30 ..GET / HTTP/1.0
0x0050 0D 0A 55 73 65 72 2D 61-67 65 6E 74 3A 20 53 79 ..User-agent: Sy
0x0060 61 62 61 73 2F 30 33 2D-36 37 2D 30 33 31 32 31 abas/03-67-03121
0x0070 32 2D 30 32 2D 4E 53 54-2D 31 30 35 2D 30 30 35 2-02-NST-105-005
0x0080 2F 30 32 2D 4E 53 54 20-28 75 43 4F 53 2D 49 49 /02-NST (uCOS-II
0x0090 20 76 32 2E 30 35 3B 4E-4F 53 3B 4B 41 39 51 3B v2.05;NOS;KA9Q;
0x00A0 20 36 32 34 78 34 39 36-2C 48 69 43 6F 6C 6F 72 624×496,HiColor
0x00B0 3B 20 77 77 77 2E 73 79-61 62 61 73 2E 63 6F 6D ; www.syabas.com
0x00C0 29 0D 0A 41 63 63 65 70-74 3A 20 2A 2F 2A 0D 0A )..Accept: */*..
0x00D0 48 6F 73 74 3A 20 31 39-32 2E 31 36 38 2E 31 30 Host: 192.168.10
0x00E0 30 2E 32 30 31 0D 0A 43-6F 6E 6E 65 63 74 69 6F 0.201..Connectio
0x00F0 6E 3A 20 4B 65 65 70 2D-41 6C 69 76 65 0A 43 61 n: Keep-Alive.Ca
0x0100 63 68 65 2D 43 6F 6E 74-72 6F 6C 3A 20 6E 6F 2D che-Control: no-
0x0110 63 61 63 68 65 0D 0A 50-72 61 67 6D 61 3A 20 6E cache..Pragma: n
0x0120 6F 2D 63 61 63 68 65 0D-0A 43 6F 6F 6B 69 65 3A o-cache..Cookie:
0x0130 20 4A 53 45 53 53 49 4F-4E 49 44 3D 32 42 38 30 JSESSIONID=2B80
0x0140 42 33 46 38 33 32 37 33-30 38 43 38 41 36 43 31 B3F8327308C8A6C1
0x0150 45 32 32 32 34 44 39 31-42 31 34 41 0D 0A 0D 0A E2224D91B14A….

—————–>> server answer:
0x0000 00 06 DC 00 26 06 00 01-03 BF C8 F2 08 00 45 00 ..Ü.&….¿Èò..E.
0x0010 00 C9 5D 69 40 00 80 06-00 00 C0 A8 64 C9 C0 A8 .É]i@.?…À¨dÉÀ¨
0x0020 64 DD 00 50 04 07 94 18-3C 54 CB FA 21 1F 80 19 dÝ.P..”.<TËú!.?.
0x0030 43 52 39 1D 00 00 01 01-08 0A 00 00 5A 14 00 0C CR9………Z…
0x0040 BF A3 48 54 54 50 2F 31-2E 31 20 34 30 30 20 42 ¿£HTTP/1.1 400 B
0x0050 61 64 20 52 65 71 75 65-73 74 0D 0A 43 6F 6E 74 ad Request..Cont
0x0060 65 6E 74 2D 54 79 70 65-3A 20 74 65 78 74 2F 68 ent-Type: text/h
0x0070 74 6D 6C 0D 0A 44 61 74-65 3A 20 4D 6F 6E 2C 20 tml..Date: Mon,
0x0080 32 33 20 46 65 62 20 32-30 30 34 20 31 37 3A 33 23 Feb 2004 17:3
0x0090 38 3A 33 31 20 47 4D 54-0D 0A 43 6F 6E 6E 65 63 8:31 GMT..Connec
0x00A0 74 69 6F 6E 3A 20 63 6C-6F 73 65 0D 0A 43 6F 6E tion: close..Con
0x00B0 74 65 6E 74 2D 4C 65 6E-67 74 68 3A 20 32 30 0D tent-Length: 20.
0x00C0 0A 0D 0A 3C 68 31 3E 42-61 64 20 52 65 71 75 65 …<h1>Bad Reque
0x00D0 73 74 3C 2F 68 31 3E st</h1>


>hello ng
>
>this request causes a “bad request” ond IIS6 – but works fine on IIS5 –
>what’s wrong with this request?
Assuming I read this right, it may be you haven’t enabled parent paths
on IIS6.


>no ? no lowercase keyword… no hostheaderproblems (http1.0) – no idea?! 😉
>
>—————–>> request:
>0x0000 00 01 03 BF C8 F2 00 06-DC 00 26 06 08 00 45 00 …¿Èò..Ü.&…E.
>0x0010 01 52 00 7A 00 00 FE 06-70 34 C0 A8 64 DD C0 A8 .R.z..þ.p4À¨dÝÀ¨
>0x0020 64 C9 04 07 00 50 CB FA-20 01 94 18 3C 54 80 18 dÉ…PËú .”.<T?.
>0x0030 2D A0 E9 95 00 00 08 0A-00 0C BF A3 00 00 00 00 – é…….¿£….
>0x0040 00 00 47 45 54 20 2F 20-48 54 54 50 2F 31 2E 30 ..GET / HTTP/1.0
>0x0050 0D 0A 55 73 65 72 2D 61-67 65 6E 74 3A 20 53 79 ..User-agent: Sy
>0x0060 61 62 61 73 2F 30 33 2D-36 37 2D 30 33 31 32 31 abas/03-67-03121
>0x0070 32 2D 30 32 2D 4E 53 54-2D 31 30 35 2D 30 30 35 2-02-NST-105-005
>0x0080 2F 30 32 2D 4E 53 54 20-28 75 43 4F 53 2D 49 49 /02-NST (uCOS-II
>0x0090 20 76 32 2E 30 35 3B 4E-4F 53 3B 4B 41 39 51 3B v2.05;NOS;KA9Q;
>0x00A0 20 36 32 34 78 34 39 36-2C 48 69 43 6F 6C 6F 72 624×496,HiColor
>0x00B0 3B 20 77 77 77 2E 73 79-61 62 61 73 2E 63 6F 6D ; www.syabas.com
>0x00C0 29 0D 0A 41 63 63 65 70-74 3A 20 2A 2F 2A 0D 0A )..Accept: */*..
>0x00D0 48 6F 73 74 3A 20 31 39-32 2E 31 36 38 2E 31 30 Host: 192.168.10
>0x00E0 30 2E 32 30 31 0D 0A 43-6F 6E 6E 65 63 74 69 6F 0.201..Connectio
>0x00F0 6E 3A 20 4B 65 65 70 2D-41 6C 69 76 65 0A 43 61 n: Keep-Alive.Ca
>0x0100 63 68 65 2D 43 6F 6E 74-72 6F 6C 3A 20 6E 6F 2D che-Control: no-
>0x0110 63 61 63 68 65 0D 0A 50-72 61 67 6D 61 3A 20 6E cache..Pragma: n
>0x0120 6F 2D 63 61 63 68 65 0D-0A 43 6F 6F 6B 69 65 3A o-cache..Cookie:
>0x0130 20 4A 53 45 53 53 49 4F-4E 49 44 3D 32 42 38 30 JSESSIONID=2B80
>0x0140 42 33 46 38 33 32 37 33-30 38 43 38 41 36 43 31 B3F8327308C8A6C1
>0x0150 45 32 32 32 34 44 39 31-42 31 34 41 0D 0A 0D 0A E2224D91B14A….
>
>
>—————–>> server answer:
>0x0000 00 06 DC 00 26 06 00 01-03 BF C8 F2 08 00 45 00 ..Ü.&….¿Èò..E.
>0x0010 00 C9 5D 69 40 00 80 06-00 00 C0 A8 64 C9 C0 A8 .É]i@.?…À¨dÉÀ¨
>0x0020 64 DD 00 50 04 07 94 18-3C 54 CB FA 21 1F 80 19 dÝ.P..”.<TËú!.?.
>0x0030 43 52 39 1D 00 00 01 01-08 0A 00 00 5A 14 00 0C CR9………Z…
>0x0040 BF A3 48 54 54 50 2F 31-2E 31 20 34 30 30 20 42 ¿£HTTP/1.1 400 B
>0x0050 61 64 20 52 65 71 75 65-73 74 0D 0A 43 6F 6E 74 ad Request..Cont
>0x0060 65 6E 74 2D 54 79 70 65-3A 20 74 65 78 74 2F 68 ent-Type: text/h
>0x0070 74 6D 6C 0D 0A 44 61 74-65 3A 20 4D 6F 6E 2C 20 tml..Date: Mon,
>0x0080 32 33 20 46 65 62 20 32-30 30 34 20 31 37 3A 33 23 Feb 2004 17:3
>0x0090 38 3A 33 31 20 47 4D 54-0D 0A 43 6F 6E 6E 65 63 8:31 GMT..Connec
>0x00A0 74 69 6F 6E 3A 20 63 6C-6F 73 65 0D 0A 43 6F 6E tion: close..Con
>0x00B0 74 65 6E 74 2D 4C 65 6E-67 74 68 3A 20 32 30 0D tent-Length: 20.
>0x00C0 0A 0D 0A 3C 68 31 3E 42-61 64 20 52 65 71 75 65 …<h1>Bad Reque
>0x00D0 73 74 3C 2F 68 31 3E st</h1>

0x00E0 30 2E 32 30 31 0D 0A 43-6F 6E 6E 65 63 74 69 6F 0.201..Connectio
0x00F0 6E 3A 20 4B 65 65 70 2D-41 6C 69 76 65 0A 43 61 n: Keep-Alive.CaThe “Connection: Keep-Alive” header is terminated with just “\n” (hex 0A)
instead of “\r\n” (hex 0D 0A), like every other header. According to
HTTP/1.1 spec, request/response headers MUST be terminated by “\r\n”.

So, the client is truly sending a “bad request”.

this request causes a “bad request” ond IIS6 – but works fine on IIS5 –
what’s wrong with this request?
no ? no lowercase keyword… no hostheaderproblems (http1.0) – no idea?! 😉

—————–>> request:
0x0000 00 01 03 BF C8 F2 00 06-DC 00 26 06 08 00 45 00 …¿Èò..Ü.&…E.
0x0010 01 52 00 7A 00 00 FE 06-70 34 C0 A8 64 DD C0 A8 .R.z..þ.p4À¨dÝÀ¨
0x0020 64 C9 04 07 00 50 CB FA-20 01 94 18 3C 54 80 18 dÉ…PËú .”.<T?.
0x0030 2D A0 E9 95 00 00 08 0A-00 0C BF A3 00 00 00 00 – é…….¿£….
0x0040 00 00 47 45 54 20 2F 20-48 54 54 50 2F 31 2E 30 ..GET / HTTP/1.0
0x0050 0D 0A 55 73 65 72 2D 61-67 65 6E 74 3A 20 53 79 ..User-agent: Sy
0x0060 61 62 61 73 2F 30 33 2D-36 37 2D 30 33 31 32 31 abas/03-67-03121
0x0070 32 2D 30 32 2D 4E 53 54-2D 31 30 35 2D 30 30 35 2-02-NST-105-005
0x0080 2F 30 32 2D 4E 53 54 20-28 75 43 4F 53 2D 49 49 /02-NST (uCOS-II
0x0090 20 76 32 2E 30 35 3B 4E-4F 53 3B 4B 41 39 51 3B v2.05;NOS;KA9Q;
0x00A0 20 36 32 34 78 34 39 36-2C 48 69 43 6F 6C 6F 72 624×496,HiColor
0x00B0 3B 20 77 77 77 2E 73 79-61 62 61 73 2E 63 6F 6D ; www.syabas.com
0x00C0 29 0D 0A 41 63 63 65 70-74 3A 20 2A 2F 2A 0D 0A )..Accept: */*..
0x00D0 48 6F 73 74 3A 20 31 39-32 2E 31 36 38 2E 31 30 Host: 192.168.10
0x00E0 30 2E 32 30 31 0D 0A 43-6F 6E 6E 65 63 74 69 6F 0.201..Connectio
0x00F0 6E 3A 20 4B 65 65 70 2D-41 6C 69 76 65 0A 43 61 n: Keep-Alive.Ca
0x0100 63 68 65 2D 43 6F 6E 74-72 6F 6C 3A 20 6E 6F 2D che-Control: no-
0x0110 63 61 63 68 65 0D 0A 50-72 61 67 6D 61 3A 20 6E cache..Pragma: n
0x0120 6F 2D 63 61 63 68 65 0D-0A 43 6F 6F 6B 69 65 3A o-cache..Cookie:
0x0130 20 4A 53 45 53 53 49 4F-4E 49 44 3D 32 42 38 30 JSESSIONID=2B80
0x0140 42 33 46 38 33 32 37 33-30 38 43 38 41 36 43 31 B3F8327308C8A6C1
0x0150 45 32 32 32 34 44 39 31-42 31 34 41 0D 0A 0D 0A E2224D91B14A….

—————–>> server answer:
0x0000 00 06 DC 00 26 06 00 01-03 BF C8 F2 08 00 45 00 ..Ü.&….¿Èò..E.
0x0010 00 C9 5D 69 40 00 80 06-00 00 C0 A8 64 C9 C0 A8 .É]i@.?…À¨dÉÀ¨
0x0020 64 DD 00 50 04 07 94 18-3C 54 CB FA 21 1F 80 19 dÝ.P..”.<TËú!.?.
0x0030 43 52 39 1D 00 00 01 01-08 0A 00 00 5A 14 00 0C CR9………Z…
0x0040 BF A3 48 54 54 50 2F 31-2E 31 20 34 30 30 20 42 ¿£HTTP/1.1 400 B
0x0050 61 64 20 52 65 71 75 65-73 74 0D 0A 43 6F 6E 74 ad Request..Cont
0x0060 65 6E 74 2D 54 79 70 65-3A 20 74 65 78 74 2F 68 ent-Type: text/h
0x0070 74 6D 6C 0D 0A 44 61 74-65 3A 20 4D 6F 6E 2C 20 tml..Date: Mon,
0x0080 32 33 20 46 65 62 20 32-30 30 34 20 31 37 3A 33 23 Feb 2004 17:3
0x0090 38 3A 33 31 20 47 4D 54-0D 0A 43 6F 6E 6E 65 63 8:31 GMT..Connec
0x00A0 74 69 6F 6E 3A 20 63 6C-6F 73 65 0D 0A 43 6F 6E tion: close..Con
0x00B0 74 65 6E 74 2D 4C 65 6E-67 74 68 3A 20 32 30 0D tent-Length: 20.
0x00C0 0A 0D 0A 3C 68 31 3E 42-61 64 20 52 65 71 75 65 …<h1>Bad Reque
0x00D0 73 74 3C 2F 68 31 3E st</h1>

thank you very much for a short feedback

hello

thank you very much for this answer! i already read about this “lf
/cr&lf;”-thing, but this time i didn’t see the wood for the trees 😉
unfortunately i cannot change the client-behaviour by myself (but i
alreadysent a message to the support of the company developing the client.)

do you know if the patched http.sys (Microsoft Knowledge Base Article –
828726) would be helpfull here?

IIS5 was not so “sensitive” about this type of “bad request” 😉

just wondering: how about HTTP/1.0 – need for “\r\n” (hex 0D 0A) too?
because, as you see, the client does a HTTP/1.0-request (GET / HTTP/1.0)

> 0x00E0 30 2E 32 30 31 0D 0A 43-6F 6E 6E 65 63 74 69 6F

0.201..Connectio
> 0x00F0 6E 3A 20 4B 65 65 70 2D-41 6C 69 76 65 0A 43 61 n:

Keep-Alive.Ca
>
> The “Connection: Keep-Alive” header is terminated with just “\n” (hex 0A)
> instead of “\r\n” (hex 0D 0A), like every other header. According to
> HTTP/1.1 spec, request/response headers MUST be terminated by “\r\n”.
>
> So, the client is truly sending a “bad request”.
>
> —
> //David
> IIS
> This posting is provided “AS IS” with no warranties, and confers no

rights.
> //
> “curtis m. west” <curtis@gr8.ch> wrote in message
> news:uW7Abvl%23DHA.2824@tk2msftngp13.phx.gbl…
> hello ng
>
> this request causes a “bad request” ond IIS6 – but works fine on IIS5 –
> what’s wrong with this request?
> no ? no lowercase keyword… no hostheaderproblems (http1.0) – no idea?!

😉
>
> —————–>> request:
> 0x0000 00 01 03 BF C8 F2 00 06-DC 00 26 06 08 00 45 00

….¿Èò..Ü.&…E.
> 0x0010 01 52 00 7A 00 00 FE 06-70 34 C0 A8 64 DD C0 A8

..R.z..þ.p4À¨dÝÀ¨
> 0x0020 64 C9 04 07 00 50 CB FA-20 01 94 18 3C 54 80 18 dÉ…PËú

..”.<T?.
> 0x0030 2D A0 E9 95 00 00 08 0A-00 0C BF A3 00 00 00 00 –

é…….¿£….
> 0x0040 00 00 47 45 54 20 2F 20-48 54 54 50 2F 31 2E 30 ..GET /

HTTP/1.0
> 0x0050 0D 0A 55 73 65 72 2D 61-67 65 6E 74 3A 20 53 79 ..User-agent:

Sy
> 0x0060 61 62 61 73 2F 30 33 2D-36 37 2D 30 33 31 32 31

abas/03-67-03121
> 0x0070 32 2D 30 32 2D 4E 53 54-2D 31 30 35 2D 30 30 35

2-02-NST-105-005
> 0x0080 2F 30 32 2D 4E 53 54 20-28 75 43 4F 53 2D 49 49 /02-NST

(uCOS-II
> 0x0090 20 76 32 2E 30 35 3B 4E-4F 53 3B 4B 41 39 51 3B

v2.05;NOS;KA9Q;
> 0x00A0 20 36 32 34 78 34 39 36-2C 48 69 43 6F 6C 6F 72

624×496,HiColor
> 0x00B0 3B 20 77 77 77 2E 73 79-61 62 61 73 2E 63 6F 6D ;

www.syabas.com
> 0x00C0 29 0D 0A 41 63 63 65 70-74 3A 20 2A 2F 2A 0D 0A )..Accept:

*/*..
> 0x00D0 48 6F 73 74 3A 20 31 39-32 2E 31 36 38 2E 31 30 Host:

192.168.10
> 0x00E0 30 2E 32 30 31 0D 0A 43-6F 6E 6E 65 63 74 69 6F

0.201..Connectio
> 0x00F0 6E 3A 20 4B 65 65 70 2D-41 6C 69 76 65 0A 43 61 n:

Keep-Alive.Ca
> 0x0100 63 68 65 2D 43 6F 6E 74-72 6F 6C 3A 20 6E 6F 2D che-Control:

no-
> 0x0110 63 61 63 68 65 0D 0A 50-72 61 67 6D 61 3A 20 6E cache..Pragma:

n
> 0x0120 6F 2D 63 61 63 68 65 0D-0A 43 6F 6F 6B 69 65 3A

o-cache..Cookie:
> 0x0130 20 4A 53 45 53 53 49 4F-4E 49 44 3D 32 42 38 30

JSESSIONID=2B80
> 0x0140 42 33 46 38 33 32 37 33-30 38 43 38 41 36 43 31

B3F8327308C8A6C1
> 0x0150 45 32 32 32 34 44 39 31-42 31 34 41 0D 0A 0D 0A

E2224D91B14A….
>
>
> —————–>> server answer:
> 0x0000 00 06 DC 00 26 06 00 01-03 BF C8 F2 08 00 45 00

…Ü.&….¿Èò..E.
> 0x0010 00 C9 5D 69 40 00 80 06-00 00 C0 A8 64 C9 C0 A8

..É]i@.?…À¨dÉÀ¨
> 0x0020 64 DD 00 50 04 07 94 18-3C 54 CB FA 21 1F 80 19

dÝ.P..”.<TËú!.?.
> 0x0030 43 52 39 1D 00 00 01 01-08 0A 00 00 5A 14 00 0C

CR9………Z…
> 0x0040 BF A3 48 54 54 50 2F 31-2E 31 20 34 30 30 20 42 ¿£HTTP/1.1 400

B
> 0x0050 61 64 20 52 65 71 75 65-73 74 0D 0A 43 6F 6E 74 ad

Request..Cont
> 0x0060 65 6E 74 2D 54 79 70 65-3A 20 74 65 78 74 2F 68 ent-Type:

text/h
> 0x0070 74 6D 6C 0D 0A 44 61 74-65 3A 20 4D 6F 6E 2C 20 tml..Date: Mon,
> 0x0080 32 33 20 46 65 62 20 32-30 30 34 20 31 37 3A 33 23 Feb 2004

17:3
> 0x0090 38 3A 33 31 20 47 4D 54-0D 0A 43 6F 6E 6E 65 63 8:31

GMT..Connec
> 0x00A0 74 69 6F 6E 3A 20 63 6C-6F 73 65 0D 0A 43 6F 6E tion:

close..Con
> 0x00B0 74 65 6E 74 2D 4C 65 6E-67 74 68 3A 20 32 30 0D tent-Length:

20.
> 0x00C0 0A 0D 0A 3C 68 31 3E 42-61 64 20 52 65 71 75 65 …<h1>Bad

Reque
> 0x00D0 73 74 3C 2F 68 31 3E st</h1>

No, 828726 would not help here. That article indicates how many broken HTTP
clients there are out there — the HTTP spec specifically states that HTTP
Verbs are case sensitive and are all upper case, but dumb client
implementations chose lower case…In short, there’s many broken clients out there which don’t follow spec, and
over time, these things will happen. And, as there tends to be thousands of
such clients per instance of the server, people tend to want server-side
“fixes” for these client-side problems — quite the nightmare that HTTP
designers feared, due to people not following spec. Strangely, people
complain about IIS does not support the HTTP spec, yet these same people
complain when IIS enforces the HTTP spec. Seems that people just want to do
whatever they want, damn the spec — which isn’t that smart from an
interoperability perspective at all — but strangely, they scream when
Microsoft supports something outside the spec. Go figure — a lose-lose
demand.

BTW, HTTP version does not change the definition of headers delimiters.

IIS5 was not so “sensitive” about MANY bad things, including Code Red. It
doesn’t mean it’s “correct”.

thank you very much for this answer! i already read about this “lf
/cr&lf;”-thing, but this time i didn’t see the wood for the trees 😉
unfortunately i cannot change the client-behaviour by myself (but i
alreadysent a message to the support of the company developing the client.)

do you know if the patched http.sys (Microsoft Knowledge Base Article –
828726) would be helpfull here?

IIS5 was not so “sensitive” about this type of “bad request” 😉

just wondering: how about HTTP/1.0 – need for “\r\n” (hex 0D 0A) too?
because, as you see, the client does a HTTP/1.0-request (GET / HTTP/1.0)


> 0x00E0 30 2E 32 30 31 0D 0A 43-6F 6E 6E 65 63 74 69 6F

0.201..Connectio
> 0x00F0 6E 3A 20 4B 65 65 70 2D-41 6C 69 76 65 0A 43 61 n:

Keep-Alive.Ca
>
> The “Connection: Keep-Alive” header is terminated with just “\n” (hex 0A)
> instead of “\r\n” (hex 0D 0A), like every other header. According to
> HTTP/1.1 spec, request/response headers MUST be terminated by “\r\n”.
>
> So, the client is truly sending a “bad request”.
>
> —
> //David
> IIS
> This posting is provided “AS IS” with no warranties, and confers no

rights.
> //
> “curtis m. west” <curtis@gr8.ch> wrote in message
> news:uW7Abvl%23DHA.2824@tk2msftngp13.phx.gbl…
> hello ng
>
> this request causes a “bad request” ond IIS6 – but works fine on IIS5 –
> what’s wrong with this request?
> no ? no lowercase keyword… no hostheaderproblems (http1.0) – no idea?!

😉
>
> —————–>> request:
> 0x0000 00 01 03 BF C8 F2 00 06-DC 00 26 06 08 00 45 00

….¿Èò..Ü.&…E.
> 0x0010 01 52 00 7A 00 00 FE 06-70 34 C0 A8 64 DD C0 A8

..R.z..þ.p4À¨dÝÀ¨
> 0x0020 64 C9 04 07 00 50 CB FA-20 01 94 18 3C 54 80 18 dÉ…PËú

..”.<T?.
> 0x0030 2D A0 E9 95 00 00 08 0A-00 0C BF A3 00 00 00 00 –

é…….¿£….
> 0x0040 00 00 47 45 54 20 2F 20-48 54 54 50 2F 31 2E 30 ..GET /

HTTP/1.0
> 0x0050 0D 0A 55 73 65 72 2D 61-67 65 6E 74 3A 20 53 79 ..User-agent:

Sy
> 0x0060 61 62 61 73 2F 30 33 2D-36 37 2D 30 33 31 32 31

abas/03-67-03121
> 0x0070 32 2D 30 32 2D 4E 53 54-2D 31 30 35 2D 30 30 35

2-02-NST-105-005
> 0x0080 2F 30 32 2D 4E 53 54 20-28 75 43 4F 53 2D 49 49 /02-NST

(uCOS-II
> 0x0090 20 76 32 2E 30 35 3B 4E-4F 53 3B 4B 41 39 51 3B

v2.05;NOS;KA9Q;
> 0x00A0 20 36 32 34 78 34 39 36-2C 48 69 43 6F 6C 6F 72

624×496,HiColor
> 0x00B0 3B 20 77 77 77 2E 73 79-61 62 61 73 2E 63 6F 6D ;

www.syabas.com
> 0x00C0 29 0D 0A 41 63 63 65 70-74 3A 20 2A 2F 2A 0D 0A )..Accept:

*/*..
> 0x00D0 48 6F 73 74 3A 20 31 39-32 2E 31 36 38 2E 31 30 Host:

192.168.10
> 0x00E0 30 2E 32 30 31 0D 0A 43-6F 6E 6E 65 63 74 69 6F

0.201..Connectio
> 0x00F0 6E 3A 20 4B 65 65 70 2D-41 6C 69 76 65 0A 43 61 n:

Keep-Alive.Ca
> 0x0100 63 68 65 2D 43 6F 6E 74-72 6F 6C 3A 20 6E 6F 2D che-Control:

no-
> 0x0110 63 61 63 68 65 0D 0A 50-72 61 67 6D 61 3A 20 6E cache..Pragma:

n
> 0x0120 6F 2D 63 61 63 68 65 0D-0A 43 6F 6F 6B 69 65 3A

o-cache..Cookie:
> 0x0130 20 4A 53 45 53 53 49 4F-4E 49 44 3D 32 42 38 30

JSESSIONID=2B80
> 0x0140 42 33 46 38 33 32 37 33-30 38 43 38 41 36 43 31

B3F8327308C8A6C1
> 0x0150 45 32 32 32 34 44 39 31-42 31 34 41 0D 0A 0D 0A

E2224D91B14A….
>
>
> —————–>> server answer:
> 0x0000 00 06 DC 00 26 06 00 01-03 BF C8 F2 08 00 45 00

…Ü.&….¿Èò..E.
> 0x0010 00 C9 5D 69 40 00 80 06-00 00 C0 A8 64 C9 C0 A8

..É]i@.?…À¨dÉÀ¨
> 0x0020 64 DD 00 50 04 07 94 18-3C 54 CB FA 21 1F 80 19

dÝ.P..”.<TËú!.?.
> 0x0030 43 52 39 1D 00 00 01 01-08 0A 00 00 5A 14 00 0C

CR9………Z…
> 0x0040 BF A3 48 54 54 50 2F 31-2E 31 20 34 30 30 20 42 ¿£HTTP/1.1 400

B
> 0x0050 61 64 20 52 65 71 75 65-73 74 0D 0A 43 6F 6E 74 ad

Request..Cont
> 0x0060 65 6E 74 2D 54 79 70 65-3A 20 74 65 78 74 2F 68 ent-Type:

text/h
> 0x0070 74 6D 6C 0D 0A 44 61 74-65 3A 20 4D 6F 6E 2C 20 tml..Date: Mon,
> 0x0080 32 33 20 46 65 62 20 32-30 30 34 20 31 37 3A 33 23 Feb 2004

17:3
> 0x0090 38 3A 33 31 20 47 4D 54-0D 0A 43 6F 6E 6E 65 63 8:31

GMT..Connec
> 0x00A0 74 69 6F 6E 3A 20 63 6C-6F 73 65 0D 0A 43 6F 6E tion:

close..Con
> 0x00B0 74 65 6E 74 2D 4C 65 6E-67 74 68 3A 20 32 30 0D tent-Length:

20.
> 0x00C0 0A 0D 0A 3C 68 31 3E 42-61 64 20 52 65 71 75 65 …<h1>Bad

Reque
> 0x00D0 73 74 3C 2F 68 31 3E st</h1>