have you tried with a proper web browser, such as firefox ? IE is known as not respecting the RFC for TCP and sending the HTTP request as data in the first "SYN" packet (which is only recognised by IIS, of course) so as to 'make' IE appear faster than it really is..
Would it be possible / likely / practical to mangle such traffic to remove any data from the payload of the SYN packet? Ultimately creating a cleaner connection to the server and causing IE to timeout on the packet and resend it?
guess it's one more example of how badly Windows' TCP/IP stack is broken is so many ways...
*nod*
Grant. . . .
