Weird loss of network access via browser

[_Bat_]

This has been happening randomly across our network for a few months now. It doesn't happen often, we get maybe one instance of it a week. It always affects random users, and random computers across the college. So far, only windows XP has been known to have the issue. The solution is always to reboot, which fixes the problem. However we still don't know what is causing it.

 

The symptoms are that the user cannot access any webpages in IE, they all just say "page cannot be displayed". Sometimes it occurs just after they have logged on, sometimes they may have been logged on for several hours before the issues occur.

 

In our testing, we have discovered:

 

- No webpage will load, whether internal or external. It has the same symptoms trying to access the web interface of a printer on the same subnet, which rules out the firewall

 

- It's not DNS, because it has the same problem whether using the IP address or DNS name (both external and internal).

 

- It's not internet explorer. Firefox displays the same symptoms.

 

- The computers affected have been all across the network. There is no one switch they are all connected to apart from the core switches.

 

All other network services work fine. The user can access their documents, e-mail (outlook/exchange combo) etc.

 

Our setup:

 

Clients: Windows XP SP3, IE8, office 2010

 

DCs: mostly 2003, a couple of 2008.

 

Has anyone seen anything like this before?

 

Cheers

[obijon]

I've seen malware proxies that stop serving pages after awhile (probably buggy). Does your network use a web proxy by chance?

[dwhyte85]

I've seen malware proxies that stop serving pages after awhile (probably buggy). Does your network use a web proxy by chance?

 

Seen... or used

 

Would definitely suggest checking netstat -b to make sure nothing is running locally on standard proxy ports e.g, 1080, 8080 and just to see whether any apps are connecting to dodgy IPs.

Edited December 1, 2010 by dwhyte85

[_Bat_]

I've seen malware proxies that stop serving pages after awhile (probably buggy). Does your network use a web proxy by chance?

 

We do use a proxy, which is set to the correct address in IE each time. I have tried allowing an affected PC "direct" access to the internet via the firewall and removing the proxy settings from IE entirely, but made no difference.

 

Seen... or used

 

Would definitely suggest checking netstat -b to make sure nothing is running locally on standard proxy ports e.g, 1080, 8080 and just to see whether any apps are connecting to dodgy IPs.

 

I'll give it a try next time I come across an affected PC, though it may be a week or two before we get another report of it lol. I don't suspect malware (though obviously I can't rule it out), I have a sneaky suspicion that there is a mature group policy (designed for an older version of something) somewhere which is causing this to happen sporadically, but because it doesn't happen often, trying to find it will be a pain and may not be worth the amount of time it will take to solve, as a lot of our group policies will not be following us when we roll out win7 fully. It wouldn't be the first time a mature group policy has caused very odd behaviour on this network (like any place, we have had several generations of technicans, and not always much documentation )

Edited December 1, 2010 by _Bat_

[glennda]

can the machine access network shares etc?

 

 

EDIT@ my bad i didn't read the full post!

[DMcCoy]

Nod32? I've see this when the web filter stops responding, although it is always fixed by a reboot.

[_Bat_]

Nod32? I've see this when the web filter stops responding, although it is always fixed by a reboot.

 

We do indeed have nod32, I think you may be on to something here. I will check this next time it happens. Thanks for this

[DMcCoy]

you can turn off real time scanning to test, just the webfilter part doesn't seem to work.

[gjdb]

I can report we have the same issue over here now and then, a user logs-in just fine, can access his own homedir and all shares, but web browsing fails.

After a reboot everything works just ok again.

It seems we have a similar setup.

Workstations Windows XP SP3, Windows server 2003/2008, NOD32 on workstations, roaming profiles.

 

We never examined it deeply, because it does not happen on a daily basis and with a small amount of users (1 or 2 in 1 month).

[gjdb]

Double post %^$#%^$#

[irsprint84]

Apple bonjour causes issues