Troubleshooting IIS 6 / Classic ASP

We have IIS 6 (IIS 5 Isolation Mode) with Server 2003 Enterprise SP2. About
four weeks ago, we began having intermittent problems with pages not
completing. The server was rebooted and the problem has occurred again
today a week later. Restarting the WWW service temporarily fixes the
problem.

I have reviewed the IIS and HTTP logs, and used WFetch and NetMon. It seems
smaller HTTP responses complete normally while larger ones do not. I set up
a test .asp page, and called it with WFetch. The content length from WFetch
was 250008, but the actual byte count returned was 184718. The return
status was 200 and sc-win32-status was zero.

Here is the .asp:

<%
response.Buffer=true
response.Write string(request.QueryString("len"), "X")
response.Write "
"
response.Write "done"
%>

And here is the entry from W3SVC1:
2008-03-31 15:49:37 GET /.../1wildtest.asp len=250000 - 10.40.10.59
HTTP/1.1 - - - hathor 200 0 0 184718 100 593

During these events, we get large quantities of sc-win32-status = 64, but in
this example we did not. There are no entries in the Sys or App event log,
or httperr. I was initially suspicious of the network service, but I
couldn't understand why recycling WWW would clear it up.

There were four frames in the conversation, and I didn't see anything that
would identify a cause or solution. In addition, I found setting
"response.buffer = false" in some of the offending pages would cause the
page to complete, with a noticeable delay midstream.

The server appears healthy, with 2.6gb commit charge / 8.2gb total, and
utilization 0-25%.

Does anyone know of something else to check? Thanks!!

-- Joe

Frame:
+ Ethernet: Etype = Internet IP (IPv4)
+ Ipv4: Next Protocol = TCP, Packet ID = 15740, Total IP Length = 530
+ Tcp: Flags=...PA..., SrcPort=1856, DstPort=HTTP(80), Len=490,
Seq=3934598403 - 3934598893, Ack=3170363483, Win=65535 (scale factor 0) =
65535
- Http: Request, GET /.../1wildtest.asp
- Request:
Command: GET
+ URI: /openss/activities/1wildtest.asp?len=250000
ProtocolVersion: HTTP/1.1
Accept: */*
Accept-Language: en-us
UA-CPU: x86
Accept-Encoding: gzip, deflate
UserAgent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR
1.1.4322; .NET CLR 2.0.50727)
Host: hathor
Connection: Keep-Alive
Cookie:
OpenSS=CurrentPage=instr%2Ehtm&UserName=Joe&Browser=IE4&Sess ionKey=f5093956&UserID=fs05;
OpenStream=NT=; ASPSESSIONIDAQTBTATQ=FMKJBBHDDMJPHBEGBJGMAOJE;
ASPSESSIONIDASRBTASR=CHMDDNGDKILCBIMHNOFJBOCK
HeaderEnd: CRLF

Frame:
+ Ethernet: Etype = Internet IP (IPv4)
+ Ipv4: Next Protocol = TCP, Packet ID = 7715, Total IP Length = 1500
+ Tcp: Flags=....A..., SrcPort=HTTP(80), DstPort=1856, Len=1460,
Seq=3170363483 - 3170364943, Ack=3934598893, Win=65045 (scale factor 0) =
65045
- Http: Response, HTTP/1.1, Status Code = 200
- Response:
ProtocolVersion: HTTP/1.1
StatusCode: 200, Ok
Reason: OK
Date: Mon, 31 Mar 2008 15:40:57 GMT
Server: Microsoft-IIS/6.0
XPoweredBy: ASP.NET
ContentLength: 250008
ContentType: text/html
Cache-control: private
HeaderEnd: CRLF
+ payload: HttpContentType = text/html

Frame:
+ Ethernet: Etype = Internet IP (IPv4)
+ Ipv4: Next Protocol = TCP, Packet ID = 7738, Total IP Length = 1500
+ Tcp: Flags=....A..., SrcPort=HTTP(80), DstPort=1856, Len=1460,
Seq=3170397063 - 3170398523, Ack=3934598893, Win=65045 (scale factor 0) =
65045
- Http: HTTP Payload
+ payload: HttpContentType = text/html

Frame:
+ Ethernet: Etype = Internet IP (IPv4)
+ Ipv4: Next Protocol = TCP, Packet ID = 7760, Total IP Length = 1500
+ Tcp: Flags=....A..., SrcPort=HTTP(80), DstPort=1856, Len=1460,
Seq=3170429183 - 3170430643, Ack=3934598893, Win=65045 (scale factor 0) =
65045
- Http: HTTP Payload
+ payload: HttpContentType = text/html