Interpreting time-taken IIS log field in load balanced configuration
We are using BIG-IP LTM to load balance between application servers which are running IIS 7.0. Our system is configured to offload SSL to BIG-IP LTM. Our application servers handle compression. I have a question around how to interpret the time-taken IIS header
http://support.microsoft.com/kb/944884 describes this time as "Beginning in IIS 6.0, the time-taken field typically includes network time. Before HTTP.sys logs the value in the time-taken field, HTTP.sys usually waits for the client to acknowledge the last response packet send operation or HTTP.sys waits for the client to reset the underlying TCP connection. Therefore, when a large response or large responses are sent to a client over a slow network connection, the value of the time-taken field may be more than expected. "
Now, BIGIP is configured to buffer the response from IIS to the client -- we've configured our TCP profile per the WAN profile in BIG-IP LTM. We aren't using the LTM's connection pooling feature, so my expectation is that LTM will close the TCP connection to IIS after every response (is this correct?)
When does BIG-IP ACK the final packet sent by IIS to it? Does it wait for the client to ACK its last packet? Does the time-taken header include network time in all cases in our configuration? Please don't hesitate to point out how stupid this question, or suggest an alternate forum for this question! :)