ZoneAlarm 6.1.737 - Free Version - Way Too Active

I installed zonealarm free as noted above and configured my programs for outbound access.
After I shutdown the machine last night and booted up this am I started getting alerts on an almost non-stop basis. I am running paid versions of nod32 and spysweeper 4.5.

I was using mcafee firewall ver 6 on this machine which worked fine. I took it off when I installed nod32. and removed the entire mcafee sec. suite. Another machine is running safety.net 3.61 with the same software and no problems.

Here is a sample of what I was getting. BTW, Zonealarm does NOT seem to indicate what it's blocking. Could be nod32, etc. who knows:

Zonealarm blocked port 2869 on your computer
Generic host process for win32 was blocked from accepting a connection from the internet 192.168.0.1 port 1900
The firewall has blocked internet access to your computer from port 2869 from 192.168.0.1 port 1450 tcp flag S.
generic host process from win 32 has blocked port 123 at 132.xxx.x.102 and 101 and 103.

No explanations and worse, no options as to what if any actions to take. I never had issues or alerts with any firewall like this.

For the experts out there, what is/was going on? I run a d-link di-604 wired router through a westell 2100 modem. I did NOT set up zonealarm as a network. I do have one other machine running through a switch.

Thanks.

 

on program control set it too low so that it learns

 

You can also turn off the alert events if you want silent blocking.

 

This is the free version - no component controls, no "learning" mode.


Hello mattc,

Next time an alert comes up, tick "do not alert me" or something like that. Its been a long time since I've use the free version.

It will still log all alerts. One more thing, it would benefit you if you read the help file over - this is explained.

Regards - Charles

 

zcv:

Thanks for taking the time to reply. I guess what surprised me was how this program has changed. Many years ago I installed the original zonealarm and like everyone else used Norton anti-virus.

I guess much has changed since the days of dial-up. I did not expect all of these alerts after using mcafee and safety.net and maybe they just allow stuff that zonealarm doesn't.

I just felt like a detective this morning trying to figure out what the heck all of this was!!

 

Hi Matt,

To be fair to McAfee and Safety.net, don't think that's true, they just don't pop up with these alerts by default the way ZA does.

Regards - Charles

 

yea, zonealarm is known for showing loads of incomming alerts - even those of no real threat. other firewalls tend to alert only when necessary, but you will find their blocking pretty much the same stuff. other than that its a good firewall, being easily stealthed.

 

I guess my only concern is if I just ignore the alerts, could it somehow be blocking my nod32 daily updates or updates from other programs. Without knowing what exactly it's blocking, it concerns me that it is preventing some necessary background processes from running.

I am clueless as to what all these programs use for ports. For instance it is blocking something incoming on port 103. But it makes no mention of what program or what process.

 

Hi Matt,

NOD or any any program that updated would let you know if the updates were blocked.

For instance it is blocking something incoming on port 103.
Those are probes and part of the background of net traffic - normal. ZA is blocking that because it's unsolicited - meaning there wasn't any browser request for that traffic. This is what a firewall is designed to stop.

NOD requests NOD's servers for updates - so that's why it wouldn't be blocked.

Regards - Charles

 

I have not used the free version in many years, but there should be a Log Viewer somewhere in the GUI. You would be able to see more info on what is being blocked.

I am guessing here that your router has the DHCP server turned on, and the router is set to 192.168.0.1. Go to Firewall > Zones tab (or it's equivalent) and add a Trusted Zone Subnet entry as with the IP Address = 192.168.0.0, Subnet Mask = 255.255.255.0. Enter a meaningful description. This should take care of the above alerts.

Is this inbound or outbound?

By making the above Trusted Zone Subnet entry the LAN will set.

 

Disciple:

Thanks for taking the time to outline a solution. I will give it a try. I installed sygate 5.6 (last free) version I believe today, and it seems to be working quite well.

 

Portpeeker

http://millfam.org/PortPeeker.html