 | 1 | initial version |
The reason Wireshark does not show [Http Request 1/2] in stream 1 is that the second response was not captured, so wireshark did not get to see it. The client did get to see it (as can be seen from the ACK numbers acking both responses).
As for finding a more detailed explanation, one would need more than 1 example of the good and bad behavior to start seeing a pattern. From the limited data provided, I assume the extra (non-compliant) CRLF in the request always triggers the extra HTTP 400 responses. So the difference in the two examples given are the retransmissions of the first response after sending the second response. But further analysis of multiple occurrences is needed to confirm if this is of importance.
What could have changed is the network stability (you mentioned WiFi) at the client side, triggering retransmissions that were not there before. Then together with the non-compliant response to the non-compliant request might trigger a bug in the software on the client. But that is a lot of assumptions and no proving (until at least more occurrences have been analysis or even reproduction of the error can be done).
