Sygate's Personal Firewall

Hello All…

After a little over a week of sickness :( , I’m finally feeling better, so if you noticed that my posts were not as cheery or concise as they usually were. Then that’s because I was really cranky.

While I was sick and for the most part cooped up in the house, I decided to try a few new things…One was Sygate’s Firewall Utility. The 3.8MB download is well worth it! Sygate’s Personal Firewall (SPF) offers many of the same features as Zone Alarm and Tiny (Haven’t tried Outpost yet, So I can’t compare) , and more. A few of the features I noticed immediately; when trying to connect to Websites, SPF immediately gives me an alert (Like others) BUT unlike others it gives me protocol information about the packet being sent out…as well a binary dump of the packet.

SPF offers several ways to view log information, which it conveniently divides into 4 types (Security, System, Traffic, and Packet) each offers a wealth of information. I found the Packet Log, excellent, it logs every packet that is sent and enters, and like the alerts gives protocol information for both (TCP & IP) as well as a binary dump (Very Cool).

I tried SPF at Symantec’s Security Check, as well as at HackerWacker, it passed both tests, and even classified the “attacks” as port scans in the security log.

I’ve only been using it for about a day. So I’m still testing it. But I would appreciate it, if someone on a network could test SPF and post their opinion. I think they will the find the Advance Options very useful.

Overall…I am really impressed with Sygate’s Firewall and think it’s definitely worth the download!

That's what I said. :D

I think that TPF has a slightly more intuitive ruleset managing system, given that it isn't broken up into application based and global (advanced) rules, and I might have stuck with TPF if I could have, mainly due to familiarity.

But I agree that Sygate gives a very good showing as a firewall. The packet log is useful, although I had a headache with it once...

On my home network, (2-3 machines, varies, one is laptop) one computer couldn't access the network through the proxy/NAT... It turns out that although I had it set to trust the IP addresses of the home network (90.0.0.x nonroutable), I had neglected to trust them BEFORE they got their IP address (DHCP), so I had to add a rule to trust the card's MAC address. Heh. Whadya know.

My gripes with Sygate:

The log viewer takes a long time. Mainly the traffic log. You can't view less than a day's worth of stuff at a time, and it takes forever to sort that much. And sometimes the log window hangs, and I have to restart the whole program.

They don't have that much in terms of clear instructions on rule precedence. For instance, Apps have trusted hosts... does this mean they trust everyone if no hosts are specified? If you do specify trusfull adresses, does this mean it won't ask you (if set to ask) for those addresses? If set to allow, does it allow ONLY those addresses? If set to deny, does it deny EVERYTHING (except those? or including)?

Can you set rules to DIS-allow a certain IP from connecting to an application, but allowing everything else?

I guess that it boils down to that Sygate has a few more neat features, like a port-scan detector and packet log. TPF has (for me) a more intuitive rule system and precedence is more easily understood. But both are fine for advanced users. (ZA is an example of what is not fine.) That's my rant.

Now, as for Agnitum, I had it on for a day or two, but found it to be a fairly confusing series of dialogs. It has about the same scheme as Sygate, with Application rules and Advanced rules, but I found it just too thrown-together for my tastes. I didn't use it long, however, so I could be mistaken. There might be an "advanced mode" button somewhere... (a la ICQ)

ZA... I still think it below me. :D Too simple and not enough control.

LOL...

Thanks Terr for the feedback...Like I said, I've only had it for a little over a day, and I'm not on a network. Your feedback on Syagtes Performance with a Network is appreciated.

Yes...I have noticed that the Packet Log gets extremely large....and can be cumbersome to search through. I haven't had any problems with the program hanging, though.

Thanks again for the Feedback! :D