I'm getting an unexpected "400 Bad Request" when calling REST Web Services from Arduino. The services are perfectly responding from the browser, curl, or fiddler. A network analysis with Wireshark shows the following message sent from Arduino : "GET /CustomerDB/resources/entities.customer HTTP/1.1\r\n" which seems correct and corresponds to the ones sent by curl or fiddler.
It seems you're already looking at the packets, which is the right place to look.
If the request succeeds from some sources and fails from others, there must be some difference in the requests. Hopefully, if you look at the packet trace carefully enough, you should be able to see what the difference is between requests that succeed, and ones that fail. Since the web server will manage each connection separately, remember that this request may depend on previous requests within the same session, and not just the specific HTTP GET request that causes the error.