Where was the attached packet capture taken? What context is this supposed to give us?
Also, have you reviewed this knowledgebase document?
http://www.symantec.com/business/support/index?page=content&id=TECH174361
This has been known to cause web servers to not even respond to the http 1.0 requests the Web Gateway translates GET requests to.