Tested on

Windows 10 and Windows 11 with the latest Microsoft Teams app.

Could not reproduce the problem on MacOS with Microsoft Teams.
Could only reproduce the problem on localhost Windows 10/11 (have not tested other Windows versions so far).

Context

We are working on a solution the monitors network traffic for a safe school environment. As part of that we install a local proxy on Windows devices. The proxy is configured as manual proxy in the system proxy settings.

When requesting to sign into the Microsoft Teams app, Teams establishes a connection to login.microsoftonline.com. Without the proxy that works without problems. Teams establishes a TCP connection, sends a CONNECT, TLS handshake (…):

368 1.574576    10.12.128.2 53524   20.190.142.163  443 TCP 66  53524 → 443 [SYN] Seq=0 Win=65535 Len=0 MSS=1460 WS=256 SACK_PERM
372 1.603857    20.190.142.163  443 10.12.128.2 53524   TCP 66  443 → 53524 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1440 WS=256 SACK_PERM
373 1.603929    10.12.128.2 53524   20.190.142.163  443 TCP 54  53524 → 443 [ACK] Seq=1 Ack=1 Win=262144 Len=0
374 1.606798    10.12.128.2 53524   20.190.142.163  443 TLSv1.2 264 Client Hello (SNI=login.microsoftonline.com)

When activating the local proxy this connection to login.microsoftonline.com is not being established. Other connections are fine though (e.g. teams.events.data.microsoft.com, nav.smartscreen.microsoft.com are established just fine):

28  2.021798    127.0.0.1   53465   127.0.0.1   18081   TCP 56  53465 → 18081 [SYN] Seq=0 Win=65535 Len=0 MSS=65495 WS=256 SACK_PERM
30  2.021938    127.0.0.1   53465   127.0.0.1   18081   TCP 44  53465 → 18081 [ACK] Seq=1 Ack=1 Win=262144 Len=0
31  2.022029    127.0.0.1   53465   127.0.0.1   18081   HTTP    210 CONNECT teams.events.data.microsoft.com:443 HTTP/1.0 

In Teams this results in an error page that the login page can’t be reached (it reports a 404, but it’s not a 404).

We ensured that nothing was blocked in the proxy and there are no low-level connection errors, then we dug deeper with Wireshark.

Detected Problem

Once accessing the login page (which would trigger connection making for login.microsoftonline.com) we see a SYN being sent to establish a TCP connection, but there is never a SYN/ACK. The local proxy never receives this SYN (no connection is ever established), somehow it never reaches the destination but is “dropped”. We can see that Teams tries to re-transmit the SYN, but it never arrives at the destination:

1   0.000000    127.0.0.1   53462   127.0.0.1   18081   TCP 56  53462 → 18081 [SYN] Seq=0 Win=65535 Len=0 MSS=65495 WS=256 SACK_PERM
27  0.996856    127.0.0.1   53462   127.0.0.1   18081   TCP 56  [TCP Retransmission] 53462 → 18081 [SYN] Seq=0 Win=65535 Len=0 MSS=65495 WS=256 SACK_PERM
49  2.996787    127.0.0.1   53462   127.0.0.1   18081   TCP 56  [TCP Retransmission] 53462 → 18081 [SYN] Seq=0 Win=65535 Len=0 MSS=65495 WS=256 SACK_PERM

Attempted Solutions / Experiments

A tcp SYN not reaching it’s destination points to it being blocked somewhere, so we:

• Turned the firewall off (anything that can be turned off is turned off)

• Evaluated any other application specific access control rules.

We could not find what would cause this blockage, the problem keeps persisting.

(Note: We were able to reproduce this problem with a different proxy solution as well. Once we configure the proxy on localhost we run into this issue.)

We also tried:

• Configure the local proxy with the IP address of the machine within the local network (i.e. 10.12.128.2) instead of 127.0.0.1: Leads to the same problem.

• Run the local proxy on another Windows machine, turn off firewall and connect to the proxy on the other machine: No problems with this setup, the connection to login.microsoftonline.com is established without problems through the proxy:

728 5.251217    10.12.128.2 50183   10.12.128.1 18081   TCP 66  50183 → 18081 [SYN] Seq=0 Win=65535 Len=0 MSS=1460 WS=256 SACK_PERM
729 5.251797    10.12.128.1 18081   10.12.128.2 50183   TCP 66  18081 → 50183 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 WS=256 SACK_PERM
730 5.251886    10.12.128.2 50183   10.12.128.1 18081   TCP 54  50183 → 18081 [ACK] Seq=1 Ack=1 Win=262144 Len=0
731 5.252182    10.12.128.2 50183   10.12.128.1 18081   HTTP    360 CONNECT login.microsoftonline.com:443 HTTP/1.0 

We then tried to configure the proxy via PAC file (without a DIRECT fallback), which result in different weird behavior with the Teams app.

In the browser the behavior is as expected – pages that are blocked by the proxy report a connection failure, pages that are allowed can be accessed.

For the Teams app login we don’t run into problems with the PAC file based settings, but Teams does not route the connection to login.microsoftonline.com through the proxy! The connection to login.microsoftonline.com somehow implicitly bypasses the system wide proxy settings when using a PAC file (i.e. I see the connection in Wireshark, but it’s directly established, not going through the proxy even though it is configured via PAC file). Other connections related to Teams (e.g. teams.events.data.microsoft.com, nav.smartscreen.microsoft.com) are established through the proxy as expected.

Help please…

It would be great to get help with a better understanding of the cause. Looking for some Windows gurus that can potentially shed some light on what’s causing this.

• What could cause the TCP SYN drop besides the obvious firewall / access control?
• What could cause Teams to behave differently on localhost than over the local network?
• When using a PAC file Windows configures the proxy for us, but why would this behave different in Teams?