Scott Hanselman

Some how I got myself into using the Symantec Client Firewall instead of the Windows XP SP2 Firewall.

Today, while doing some local (localhost) debugging, I noticed that when I requested a file called http://localhost/dasblog/themes/elegante/banner.jpg, I was getting back NOTHING. No banner.

Ok, that's weird. So I fired up ieHttpHeaders and saw this (emphasis mine):

GET /DasBlog/themes/elegante/banner.jpg HTTP/1.1
Accept: */*
Accept-Language: en-us,tr;q=0.5
Accept-Encoding: gzip, deflate
If-Modified-Since: Fri, 25 Aug 2000 01:00:00 GMT; length=881
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Tablet PC 1.7; .NET CLR 2.0.50215)
Host: localhost
Connection: Keep-Alive

HTTP/1.0 200 OK
Server: Netscape-Enterprise/2.0a
Pragma: No-cache
Date: Fri, 25 Aug 2000 23:00:00 GMT
Last-modified: Fri, 25 Aug 2000 01:00:00 GMT
Accept-Ranges: bytes
Content-length: 881
Content-type: image/gif

Holy crap! Do I have a Trojan? Spyware? I don't have Netscape anything running on my system. Notice the weird date, the weird Content-length for what was supposed to be a 35k file. I was getting all ready to look at who's got what open on what port, I ran Spyware scans with Search&Destroy and Microsoft AntiSpyware...then I thought, maybe it was AdBlock within FireFox. No, that doesn't make sense, I'm in IE. Who else could be messing around...

Damn you Norton! I disabled the Symantec Client Firewall and poof, there was my banner.

GET /DasBlog/themes/elegante/banner.jpg HTTP/1.1
Accept: */*
Accept-Language: en-us,tr;q=0.5
Accept-Encoding: gzip, deflate
If-Modified-Since: Fri, 25 Aug 2000 01:00:00 GMT; length=881
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Tablet PC 1.7; .NET CLR 2.0.50215)
Host: localhost
Connection: Keep-Alive

HTTP/1.1 200 OK
Server: Microsoft-IIS/5.1
X-Powered-By: ASP.NET
Date: Sun, 10 Jul 2005 05:43:40 GMT
Content-Type: image/jpeg
Accept-Ranges: bytes
Last-Modified: Sun, 10 Jul 2005 01:31:50 GMT
ETag: "ae93325ef84c51:8ad"
Content-Length: 36634

Turns out that Symantec Client Firewall has their own brand of ad blocking built in. That's not a bad thing except:

• They block any graphic requested with the name "banner" anywhere in it - hence the fake HTTP Response.
• The perform this blocking/sniffing even on requests to your OWN MACHINE (localhost)

Sigh. 7 minutes wasted. Hopefully this tidbit will save you a little time one day.

About Scott

Scott Hanselman is a former professor, former Chief Architect in finance, now speaker, consultant, father, diabetic, and Microsoft employee. He is a failed stand-up comic, a cornrower, and a book author.

About   Newsletter

Hosting By