ERR_SOCKET_NOT_CONNECTED on my Macbook Pro? But why?

I’ve been getting frustrating errors on my Macbook Pro running Mac OS X Sierra for the last month or two.

In Chrome, the error is ERR_SOCKET_NOT_CONNECTED – but I also get the same outcome in Firefox and Safari, where they variously report that the connection was reset or failed.

My next step is to try to capture it in TCPDUMP; I did a quick test with defaults, but then somehow it managed to entirely reset my machine, and the problem seems to have been temporarily fixed for now – but it does come back each time.

Googling this error typically comes up with Flushing sockets in Chrome, or fixing a DNS issue. However, neither of these work in this case, and the problem is much more wide ranging. I’ve found that:

– The problem affects all browsers on the computer (Chrome, Firefox, Safari)
– The problem affects only HTTP websites. ie:
– Sites that are HTTP (http://www.bbc.co.uk, http://www.sainsburys.co.uk) always DO NOT work
– Sites that are HTTPS (https://www.facebook.com, google.com, etc) DO always work
– Sites that are HTTP that immediately redirect to HTTPS (eg. facebook.com) DO work
– Sites that are HTTP but can also be forced to HTTPS (eg. https://www.sainsburys.co.uk) DO work

Hence the problem appears to definitely be around HTTP – as if something on my Mac is blocking inbound HTTP responses, or sending back a reset.

As to what could be doing that:
– I have the Mac OS X firewall enabled, blocking all inbound ports that are not attached to whitelisted apps, as well as stealth mode enabled. However, I have whitelisted Chrome and it makes no difference. Also, turning off the firewall made no difference.
– Trend Micro’s AV engine, which I can’t disable, but which reports no blocked web traffic
– CarbonBlack’s agent installed, which I have no visibility over
– Palo Alto Networks SSL VPN client, which makes no difference if connected or disconnected
– Private Internet Access’s client, with impact unknown at present.
– I have various browser blockers  – uBlock Origin, Do Not Track, Vanilla Cookie manager – but these don’t seem to change the outcome either

I’ll keep an eye on this. It does seem to stand apart from all the google search hits I’ve found so far – various Google Chromium discussions, and some ‘fixit’ sites – and I’ll likely have to get into verbose TCPDUMPs to figure it out when it reoccurs.