My guess would be something in the client application. You'll need to either dissect the traffic or obtain logs from the client app to make any further determination.