My best guess from the tcpdump is that it is the connection that originates on port 56000. It looks like the bytes that came in are correctly being reported but I can’t tell you what’s actually IN the SSL payload because of the encryption. If you have access to the server’s private key you should be able to use wireshark to decrypt the conversation.
Request 6 and Request 13 have vary similar content size, the difference is very close to real size of request 6 (0.9KB).
rq6: 165.3 KB
rq13: 163.7 KB
Check connection view, request6 is processed using connection 5, request 13 is processed using connection 6, both ends almost at the same time (calculated based on data from each rq).
rq6: 6.148
rq13: 6.027
Why report shows 7 connections for wl8-int.sabresonicweb.com whereas IE8 supports 6 connections per domain?
Hmm, something really strange is certainly going on. IE supports 6 simultaneous connections so it can go over 6 as long as a previous connection closed (like the caymanairways requests) but it does look like the code is tracking 7.
I have some experimental code that will let me get the decrypted data from IE’s inbound streams. If you don’t have luck with the ops team and the keys I can see about hacking it in for a quick test (later in the week though, I’m tied up all day today).
The report shows that www.caymanairways.com does not utilize persistent connections so higher number of connections for this domain is fine - interestingly this is not an issue in my FF or PageSpeed online (maybe server checks User-Agent?)
We didn’t decode tcp-dump yet so I’m not sure if this is possible. I’ll keep you updated.