Something pretty bizarre is happening here. I'm try to access a website from some machines inside my network and I just can't, while other machines access it normally. The website is online.sefaz.am.gov.br. In order to rule out all browser-related problems, I am testing this with telnet.

From my Macbook, I get this:

$ telnet online.sefaz.am.gov.br 80
Connected to online.sefaz.am.gov.br.
Escape character is '^]'.

From a Windows XP box (Virtual Machine running on the Macbook), I get this:

C:\Documents and Settings\Administrator>telnet 80
Connecting To not open connection to the host, on port 80: Connect failed

Note that on the Windows box I tried to telnet the IP address directly, so that rules out DNS issues. My anti-virus is disabled and so is the Windows firewall.

The virtual machine's network interface is bridged, so it gets a valid IP in my network. I noticed something pretty odd regarding that as well: if I change the network interface to NAT on the virtual machine, I can access the website normally.

I do have a domain controller in my network, but I'm not aware of any group policies that could block an IP.

So my question is: have you ever seen something like this? If so, how to fix it?


I ran nmap against the website from the computer that can't open it on the browser. Here's the outcome:

Starting Nmap 6.25 ( http://nmap.org ) at 2013-02-15 14:31 Pacific SA Standard Time
Nmap scan report for online.sefaz.am.gov.br (
Host is up (0.18s latency).
Not shown: 996 filtered ports
80/tcp   open   http
443/tcp  open   https
8080/tcp open   http-proxy
8443/tcp closed https-alt

TRACEROUTE (using port 8443/tcp)
1   ... 10
11  160.00 ms

Nmap done: 1 IP address (1 host up) scanned in 46.01 seconds


So I got one of these boxes that can't access the website and connected it directly to my internet link. Nothing changed. I still couldn't access the website. Then, I unplugged the machine from my network and connected it to the internet using a 3G usb stick. Guess what? It worked. So the logical conclusion would be that the problem lies on my internet link somewhere.

Not so fast... this very own computer I am typing from is using the internet link and can access the website normally. Go figure!

  • Are you the sysadmin at your network? – pauska Feb 15 '13 at 17:59
  • @pauska yes, I am. – Andre Feb 15 '13 at 18:01
  • was that nmap session run from the windows XP system? – Rex Feb 15 '13 at 18:59
  • @Rex yes, I ran nmap from the win xp box. The same one that fails with telnet – Andre Feb 15 '13 at 19:02
  • Bridging your network adapter makes it create a virtual mac address for your guest(s). Are you sure that you don't have any network equipment limiting the number of mac addresses per port? – pauska Feb 15 '13 at 19:18

Based on the error of the telnet "Connect failed", the TCP connection can not be established. Use tcptraceroute to find out which host is filtering your request.

It could be a routing problem or a firewall problem.

Use a network capture program like WireShark and check for ICMP messages or TCP/RST messages when you start the telnet.

The SYN packets send by nmap and telnet were differing. The telnet one was setting the Selective Acknowledgment (SACK).

It seems that the remote server is filtering the TCP packets that were using SACK.

To disable SACK start the Registry Editor and change HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\SackOpts to 0.

0 = disabled; 1 = enabled

See this answer for details about SACK: When to turn TCP SACK off?

  • I did what you suggested. The website looks fine from nmap (I edited the question to show that). And Wireshark doesn't really give me much; I can see three SYN packages leaving my machine and no response from the website. – Andre Feb 15 '13 at 18:40
  • Can you please run tcptraceroute on port 80/TCP? I am not talking about the tracert that comes with Windows. – Mircea Vutcovici Feb 15 '13 at 19:02
  • When you run the telnet, do you receive the error immediately? If not, can you please run: netstat -an| find "SYN" – Mircea Vutcovici Feb 15 '13 at 19:03
  • I don't have/know where to get tcptraceroute on Windows. I used nmap as an alternative. And when I run telnet, I get the error after 1 or 2 seconds. The netstat command you suggested gives me only this: TCP SYN_SENT – Andre Feb 15 '13 at 19:14
  • Try with: nmap -Pn --traceroute -p 80 or nmap -Pn -sT --traceroute -p 80 – Mircea Vutcovici Feb 15 '13 at 19:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.