Slow and Fast IP addresses on http ?

Mon Jun 16 20:53:15 UTC 2003

Did anybody ever hear about IP-addresses which get a slow treatment from
some http servers ?

We have a 195.212.127/24 out of a /16 PA range which is behaving very odd
with multiple WEB servers but works fine with most others.

When we configure an IP out of 195.212.127/24 on an direct Internet
connected workstation, it takes about 1-2 minutes to start loading pages
from some WEB servers, but it is fast for all other pages. When we then
configure any other address out of this /24 onto the same client, everything
works fine.

We checked the WEB servers in question and they use various operating
systems and Server software, so it does not seem to be a bug on the server
side.
A bug on the client side can be excluded as well because we tried various
clients and it always works fine when an address outside the 195.212.127/24
is used.
Routing also can't be the problem because after the "long" break traffic
flows smooth.

************************************************************
195.212.127/24 has for ex. problems with web-sites:
http://www.infobel.com
http://www.cevi.ch
http://www.dropnet.ch

No problems with web-sites:
http://www.yahoo.com and
http://www.google.com
http://www.studerus.ch

No problems to all of the above pages when using any other client IP address
but the same Client Workstation and connectivity.
************************************************************

Sniffering on the client side shows, that the session establish goes
through:
1. Client->Server HTTP: GET / HTTP/1.1$
2. Server->Client TCP: TCP: src = 80, dst = 1944, ack = 0X3A577E76 ACK
3. Client->Server HTTP: HTTP/1.1 200 OK  (http data is received now)

Using a client address outside the range in question or going to a "good"
HTTP-Server, goes through above three steps within some milliseconds.
Using an address out of 195.212.127/24 and going to a "bad" HTTP-Server,
works fine but then stucks for .5 to 2mins before going to above Step 3 and
then all traffic flows smooth.

To me it seems like the Servers are doing some intensive investigations on
this IP addresses before getting the OK to process them. I have never heard
of such a service. DNS/and reverse DNS can be ruled out as well as other,
working addresses, are configured the same.

Does anybody have any idea what the problem could be ?

Thanks
Dani