Have you tried running wireshark or fiddler on the client?