Neither did I (at first)... Let this be a lesson to me; just because someone complains about an app-level problem doesn't mean it's always above L5... -----Original Message----- From: isapros-bounce@xxxxxxxxxxxxx [mailto:isapros-bounce@xxxxxxxxxxxxx] On Behalf Of Stefaan Pouseele Sent: Sunday, October 07, 2007 2:15 PM To: isapros@xxxxxxxxxxxxx Subject: [isapros] Re: Silverlight through ISA 2006 Hi Jim, Wow... as always, the devil is in the details! I would never have looked into that direction... Many thanks, Stefaan -----Original Message----- From: isapros-bounce@xxxxxxxxxxxxx [mailto:isapros-bounce@xxxxxxxxxxxxx] On Behalf Of Jim Harrison Sent: zaterdag 6 oktober 2007 23:38 To: isapros@xxxxxxxxxxxxx Subject: [isapros] Re: Silverlight through ISA 2006 No takers? Ok - it goes like unto thusly (open Stefaan's crapture so you can follow the bouncing packets): Client == 192.168.22.100 ISA == 192.169.22.1 Server == 207.46.192.254 Frame Direction Action ------------------------------------------------------------------- 009 Client --> ISA:8080 HTTP GET /array.dll?Get.Routing.Script (from IE7) 011 ISA:8080 --> Client HTTP 200 "OK" 027 Client --> ISA:8080 HTTP GET http://www.microsoft.com/emea/spotlight/Steve_Riley_The_Fortified_Data_Cente r_in_Your_Future.aspx 032 ISA --> Server:80 HTTP GET http://www.microsoft.com/emea/spotlight/Steve_Riley_The_Fortified_Data_Cente r_in_Your_Future.aspx 034 Server:80 --> ISA HTTP 200 "OK" 053 ISA:8080 --> Client HTTP 200 "OK" ...blah, blah, blah... more content from the web page 424 Client --> ISA:8080 HTTP GET /array.dll?Get.Routing.Script (from nsplayer) 425 ISA:8080 --> Client HTTP 200 "OK" 444 Client --> ISA:80 HTTP GET http://a1336.v14853a.c14853.g.vm.akamaistream.net/7/1336/14853/v0001/microso fttec.download.akamai.com/14853/msexp/msexp/E0093/0540_w.asf 446 ISA:80 --> Client HTTP 400 "Bad Request" In the initial page load activity, all traffic is directed to ISA on port 8080. Clearly, Stefaan is using the ISA default for the web proxy outbound listener. In frame 444, the Silverlight AX client makes a CERN proxy request to the ISA autodiscovery listener on port 80. Since only autodiscovery requests are allowed to this listener (/wpad.dat, /wspad.dat, /array.dll?Get.Routing.Script, /array.dll?Get.Info.v[1|2|3]), ISA rejects it as a "bad request" (which it is). What's really interesting about this is that the WPAD script requested *by the media player* in frame 424, and provided by ISA in frame 425. IOW, there's no excuse for the AX control to behave this way; especially since WMP (what the Silverlight AX control is using, if the User-Agent header is to be believed) understands (sorta) how to use the proxy script. Good scenario testing, Silverlight team... :-( I'll file the bug. Jim -----Original Message----- From: isapros-bounce@xxxxxxxxxxxxx [mailto:isapros-bounce@xxxxxxxxxxxxx] On Behalf Of Jim Harrison Sent: Saturday, October 06, 2007 12:28 PM To: isapros@xxxxxxxxxxxxx Subject: [isapros] Re: Silverlight through ISA 2006 Ok; I do know. In fact, I know two things: 1. eye wur been stoopd 2. the answer is in the craptures Three social points if you can find it before I come back from lunch. Hint: if you are looking higher than OSI layer 4, you went too far (raises hand; bows head). Jim -----Original Message----- From: isapros-bounce@xxxxxxxxxxxxx [mailto:isapros-bounce@xxxxxxxxxxxxx] On Behalf Of Jim Harrison Sent: Saturday, October 06, 2007 12:01 PM To: isapros@xxxxxxxxxxxxx Subject: [isapros] Re: Silverlight through ISA 2006 Ok - I don't know why. If you use WMP to access that .asf link directly, it plays just fine. The Silverlight plug-in apparently extends the WMP AX control, because I noted a version change in the user-agent request header after installing it. I've sent my data to the folks in Haifa for their review. -----Original Message----- From: isapros-bounce@xxxxxxxxxxxxx [mailto:isapros-bounce@xxxxxxxxxxxxx] On Behalf Of Jim Harrison Sent: Saturday, October 06, 2007 9:28 AM To: isapros@xxxxxxxxxxxxx Subject: [isapros] Re: Silverlight through ISA 2006 Nope; nothing else. I know where the problem is; just sorting the "why". In frame 444, WMP makes the following request: - Request: Command: GET + URI: http://a1336.v14853a.c14853.g.vm.akamaistream.net/7/1336/14853/v0001/microso fttec.download.akamai.com/14853/msexp/msexp/E0093/0540_w.asf ProtocolVersion: HTTP/1.0 Host: a1336.v14853a.c14853.g.vm.akamaistream.net UserAgent: NSPlayer/11.08.0005.0000 Accept: */* Accept-Language: en-us, *;q=0.1 Connection: Keep-Alive + Pragma: xClientGuid={00000000-0000-0000-0000-000000000000} + Pragma: packet-pair-experiment=1 Supported: com.microsoft.wm.srvppair, com.microsoft.wm.sswitch, com.microsoft.wm.startupprofile, com.microsoft.wm.predstrm + Pragma: no-cache,stream-time=0,stream-offset=0:0,packet-num=4294967295,max-duration= 0 + Pragma: LinkBW=2147483647,rate=1.000, AccelDuration=10000, AccelBW=2147483647 HeaderEnd: CRLF ISA responds in frame 446 with: - Response: ProtocolVersion: HTTP/1.1 StatusCode: 400, Bad request Reason: Bad Request ( The data is invalid. ) Via: 1.1 ISA Connection: Keep-Alive Proxy-Connection: Keep-Alive Pragma: no-cache Cache-Control: no-cache ContentType: text/html ContentLength: 1946 HeaderEnd: CRLF + payload: HttpContentType = text/html I'll need to do some targeted ISA tracing to see exactly what ISA thought of this request and thus determine why it was rejected. Stay tuned for more as I get details. -----Original Message----- From: isapros-bounce@xxxxxxxxxxxxx [mailto:isapros-bounce@xxxxxxxxxxxxx] On Behalf Of Stefaan Pouseele Sent: Saturday, October 06, 2007 1:54 AM To: isapros@xxxxxxxxxxxxx Subject: [isapros] Re: Silverlight through ISA 2006 Any more info needed? Stefaan -----Original Message----- From: isapros-bounce@xxxxxxxxxxxxx [mailto:isapros-bounce@xxxxxxxxxxxxx] On Behalf Of Stefaan Pouseele Sent: vrijdag 5 oktober 2007 18:46 To: isapros@xxxxxxxxxxxxx Subject: [isapros] Re: Silverlight through ISA 2006 Hi Jim, Yep, the box is fully patched, including the supportability update. Attached you should find the capture taken with Netmon 3.1 on ISA internal + external interface: - ISA external interface: 192.168.1.10 - ISA internal interface: 192.168.22.1 - Internal ADC/DNS/DHCP/etc: 192.168.22.2 - Internal client: 192.168.22.100 Thanks, Stefaan -----Original Message----- From: isapros-bounce@xxxxxxxxxxxxx [mailto:isapros-bounce@xxxxxxxxxxxxx] On Behalf Of Jim Harrison Sent: vrijdag 5 oktober 2007 18:06 To: isapros@xxxxxxxxxxxxx Subject: [isapros] Re: Silverlight through ISA 2006 Got network craptures? Got the Supportability update? It includes lots of fixes (kind of a mini-service pack) -----Original Message----- From: isapros-bounce@xxxxxxxxxxxxx [mailto:isapros-bounce@xxxxxxxxxxxxx] On Behalf Of Stefaan Pouseele Sent: Friday, October 05, 2007 8:57 AM To: isapros@xxxxxxxxxxxxx Subject: [isapros] Silverlight through ISA 2006 Hi, I can't see the video in the URL http://www.microsoft.com/emea/spotlight/Steve_Riley_The_Fortified_Data_Cente r_in_Your_Future.aspx through ISA 2006 SE when IE7 is configured as a Web proxy client. It gives always the following "Silverlight eror message": ErrorCode: 4001 ErrorType: MediaError Message: AG_E_NETWORK_ERROR The ISA Server and the XP client are fully patched. When I disable the Web Proxy settings in IE7, it works flawless! In the ISA log I see the following failing entry: Original Client IP Client Agent Authenticated Client Service Server Name Referring Server Destination Host Name Transport MIME Type Object Source Source Proxy Destination Proxy Bidirectional Client Host Name Filter Information Network Interface Raw IP Header Raw Payload GMT Log Time Source Port Processing Time Bytes Sent Bytes Received Result Code HTTP Status Code Cache Information Error Information Log Record Type Authentication Server Log Time Destination IP Destination Port Protocol Action Rule Client IP Client Username Source Network Destination Network HTTP Method URL 0.0.0.0 NSPlayer/11.08.0005.0000 No Proxy ISA a1336.v14853a.c14853.g.vm.akamaistream.net TCP - - - Req ID: 07949093 - - - 5/10/2007 15:19:34 0 1 2160 695 13 The data is invalid. 0x0 0x0 Web Proxy Filter 5/10/2007 17:19:34 192.168.22.1 80 http Failed Connection Attempt 192.168.22.100 anonymous Internal GET http://a1336.v14853a.c14853.g.vm.akamaistream.net/7/1336/14853/v0001/microso fttec.download.akamai.com/14853/msexp/msexp/E0093/0540_w.asf Failed Connection Attempt ISA 5/10/2007 17:19:34 Log type: Web Proxy (Forward) Status: 13 The data is invalid. Rule: Source: Internal (192.168.22.100) Destination: (192.168.22.1:80) Request: GET http://a1336.v14853a.c14853.g.vm.akamaistream.net/7/1336/14853/v0001/microso fttec.download.akamai.com/14853/msexp/msexp/E0093/0540_w.asf Filter information: Req ID: 07949093 Protocol: http User: anonymous Additional information Client agent: NSPlayer/11.08.0005.0000 Object source: (No source information is available.) Cache info: 0x0 Processing time: 1 MIME type: Any clue what's the cause? Thanks, Stefaan