Security

Ask something
Discussion Locked

ZoneAlarm and TCP/IP

0 helpful
6 replies

by bill cassada 2 views

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Myself and a coworker are evaluating ZoneAlarm (free version) and noticed something that bothers us...we put it on a workstation on a corporate network (we are admins) and set it up, then performed a few attacks which were successfully blocked. We left it running and focused attention on a routine copy from a file server down the road in another building (connected via T1). During the ENTIRE file copy process the little green/red meter on ZoneAlarm never moved. Not once. Is this not supposed to display TCP/IP activity of ANY sort? We are using NT4 SP5 and only running TCP/IP. No other protocol is installed or running.

Is NT using some other way to xfer the files or is ZoneAlarm not seeing it or not working properly?

6 replies

by ipjunkie

I have seen the same thing on my home LAN WIN98 box with 2 NICs, one to the cable modem and one to my LAN. Running Sygate server and ZoneAlarm. ZoneAlarm showed all the traffic lights when I used this same setup with a Dial-up ISP. Now that I connect with a NIC, it doesn show the activity all the time. I can see my hub lights and the lights on the cable modem going, so I figured it must be a bug in ZoneAlarm. Have you tried contacting them for support?

by ipjunkie

Another thought, ZoneAlarm may not be showing the traffic because you are not running it a machine that has a direct connection to the internet.

by bill cassada

It DOES show internet traffic. And it shows network traffic such as Outlook. We only noticed the "dead" meter when we performed a file copy across our internal network (same subnet, too). I emailed the guys at ZoneAlarm but no response yet. I figured someone out there had already seen this and figured it out. True, we don't connect directly to the net, but then again, with a dialup you don't either. Either way there is another device between you and the net. Even with cable/DSL you have to get out of their network to the internet.

by ajdias

I don't have the answer for you but I thought I'd mention the news.grc.com news server if you haven't tried that yet. You'd most likely want to check the grc.security newsgroup. Someone there may be able to help you.

by bill cassada

Actually I've figured out that Zone Labs is not being truthful about their meter. They wrote me an email stating it won't display traffic on the local subnet and explained how to "properly" configure it, but I've proven them totally wrong. This news server was unknown to me, but I'll give you the points as no one else seems to be able to assist since even Zone Labs can't get their facts straight...haha. Thanks!

This discussion is closed to new replies.