Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

In a Windows XP computer suddenly browsers stop showing websites. While running procmon I noticed that I can easily go to websites running on port 443, port 10000 and port 9675 ( spiceworks ).

Also ping, nslookup, tracert work fine.

Trying telnet IP 80 doesn't work. But I can telnet to other TCP services like FTP/SMTP

This problem goes away once the computer is restarted. But it keeps cropping up randomly. How can I troubleshoot this?

share|improve this question
1  
Firewall issue? –  slotishtype Jun 27 '11 at 12:38
    
The system works fine till it doesn't. No change in firewall config at all. So I don't think it is a firewall issue. –  Akash Mahajan Jun 27 '11 at 18:50
add comment

2 Answers

This sounds like something is adding a firewall (or port filtering) entry. I assume your anti-virus software is up to date and you are running the latest patches etc.

It might be worth checking the firewall settings periodically, also you might want to check the application logs to see if a program has set a firewall entry on purpose.

share|improve this answer
add comment

There are a couple of things you could try from the problematic machine (if you haven't already):

  1. Do a TCP/IP stack repair using:

    netsh int ip reset c:\resetlog.txt
    
  2. Use netcat to connect to port 80 and do a HEAD/GET and check response.
  3. Run wireshark when browsing to a site on port 80 and verify you are getting SYN/ACKs or whether atleast your SYNs are going through to the site.
  4. Run the following and check port status:

    nmap -p80 -sT -vv -g34800 <remote-ip>
    
  5. Use procmon and filter only Network Activity and attempt to browse to different sites, including those ones that are not on 80 and see if there is any difference in the captures.
  6. Create another user and attempt to browse to the site.
  7. Check system firewall, third party applications that might prevent communication on port 80.

My thoughts are inclined towards a possible malware infection that is preventing communication on port 80 of any site, quite possibly an outbound packet on port 80 > silent drop. If other systems on the network are able to access the Internet then you can bet it's a system issue.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.