Description:
------------
We are trying to download file from php.net and it takes a long time to initiate the download.


To download a file, 

1) we go to php.net's download page.

http://us2.php.net/downloads.php

2) click on one of the link to download source code ( for example, http://www.php.net/get/php-5.1.2.tar.gz/from/a/mirror).   It takes over 7 minutes to load up the next page.

This behavior is consistent and we can duplicate it at will.

we actually did a packet capture.. it shows that after we click on "http://www.php.net/get/php-5.1.2.tar.gz/from/a/mirror" .. the web server is suppose to send a HTTP redirect (HTTP 301) reply back to my web browser, but we never see that packet comes back from the php.net server.  At the end, the TCP session was kept open mean a few more TCP retransmission of the HTTP GET was sent to php.net.

Eventually, php.net sends a FIN packet to our computer wanting to close to TCP session, but my computer haven't receive the HTTP reply yet.  So my computer will send a ACK back to php.net and immediately, the HTTP301 reply comes back and my web browser closes the TCP session and move on to load the mirror page based on the information from the HTTP 301 reply.

We suspected that there we might be triggering a false positive on your IDS there 'cause the HTTP 301 being drop (may be??)  

Can you see if there is anything at your end that might explain this behavior?  our subnet is 129.22.0.0/16

I have a ethereal capture if you want to see it.

thank you very much.

Eric Chan
Case Western Reserve University
Information Technology Services