A programs tries to access the network (in/out doesn't matter) and ESS shows the popup. 1) Don't click allow or deny. let the connection timeout. 2) When it times out check the "remember action (create rule)" box when choose Allow or Deny 3) Depending on the program, it will retry the connection and the popup will appear again (even though you already chose to remember the rule) and if you click "remember action (create rule)" it will create the duplicate. Of course, if you don't choose to remember the second time it will not create any duplicate. ---- The popups are queued which is why it shows the second time. ESS shows one and waits for user input. In the meantime, the other program retries the connection and ESS queues the popup (as it should) but the other popup wasn't dealt with yet. When the user finally chooses the next popup in queue appears. Ideally, it should cancel the "duplicate" popup. If it's not possible to do so, at least it should detect that there is another rule that's exactly the same and don't duplicate (even if we choose to remember). That's all.