Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

So I just had a fun and exciting time trying to figure why on earth a particular computer was able to ping different places on the interweb but not browse any webpages of the same places I was able to ping. After a bunch of research, it would turn out the culprit was an outdated, corrupt version of Norton 360 installation that was intercepting all web requests and acted as a proxy. In this case, standard networking diagnostic tools like ping, tracert, and other did not reveal the problem as it appeared to only target HTTP requests. What gave me the clue that it was software related was that I could browse when I booted the computer in Safe Mode with Networking. I had to use Norton's removal tool to uninstall the dead program.

So the question goes, how do I detect when network requests are getting intercepted from localhost?

share|improve this question
    
not an answer but I can tell you that often technicians when there's a problem browsing the web, say, -do you have a firewall or antivirus.. Maybe they disable it or turn if off temporarily to see if it fixes things. –  barlop May 10 '12 at 20:15
add comment

1 Answer

up vote 1 down vote accepted

I go straight to wireshark for this sort of thing. Nothing will teach you how the network works better than Wireshark. For web only things, the network tracing in firebug is also great.

share|improve this answer
    
wireshark (at least in windows where I tried it) won't tell you much about localhost though. It can't monitor the loopback interface, last time i saw anyway. –  barlop May 10 '12 at 20:16
    
You can use netresec.com/?page=RawCap but wireshark will tell you if its NOT on the real interface. –  Julian May 10 '12 at 20:19
    
Maybe wireshark would show something giving away what was happening but i'm not sure what he'd see. Interesting about rawcap. There's tcpdump too (which will show the loopback interface). (windump won't). One would do tcpdump -D which shows which -i the loopback is, then tcpdump -i 0 (if 0 was loopback), then could to ctrl-c and filter for tcpdump -i 0 tcp port 80 But, i've never used it for that.. I once got some duplication looking at loopback.. and re his application, I don't run something that intercepts. –  barlop May 10 '12 at 20:23
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.