Printable View
I was wonderin why i dont get many alerts from my zonealarm firewall so i decided to test it. I know i wont get alot of alerts cuz i'm in a pretty well protected network but still...not 1 alert was kinda strange. I ran nmap on it from my linux box and not a alert came up and nmap displayed the stats of the comp. Should zonealarm detect a nmap scan???
are you sure you haven't turned off the alert notification... if ZA is running in silent mode then it won't let you know about any scans unless you look through the log file
i also use zonealarm on 1 of my computers. i noticed during installation setup there are certain settings you can select to allow zonealarm to protect your computer automatically in the background or alert you each time something happens. maybe during setup you may have chosen that particular option. if you did, then zonealarm wouldnt alert as much.
i tried grc.com tests ... zonealarm blocked (stealth) on everything, yet i didnt get any alerts.
I've got alerts up...but they just aint comin up for some reason. They're supposed to but they dont. And even if they didnt come up...they still didnt protect from the NMAP scan. Should i just reinstall??? Never had this problem with zonealarm before. Any other firewalls u guys suggest???
i would reinstall zonealarm, making sure you get all the leftovers after the uninstall, such as registry settings etc.. ....after a reinstall and you get the same issue then i would use a different firewall. there are several to choose from but the 2 i use on my computers are zonealarm and kerio personal firewall. kerio is pretty good, its the same setup as tiny personal firewall.
kerio is free for home & personal use just like zonealarm.
http://www.kerio.com/kpf_download.html
I agree with JcT21 it sound like the install is slightly fux0rd... try re-installing ... what version number are you running anyway 4.xxx? And also are you running the free version or the Pro version??
Z
I was thinking that you turned off the auto alert and that is why you were not seeing anything but it should be in the log file
hmm i do suggest use Keiro as an alternative to ZAP. and trust me, u really dont want those alerts to pop up. its annoying as hell, i just turn it off and rely on the logs.
/me pokes sonic.. drop by irc sometime eh?
But it still should have blocked the scan...not so much worried about the popups but NMAP got all the info it needed and zonealarm didnt do ****. Oh well...time for a new one anyways.
If you want a nice efficient free firewall, give a look at Agnitum's Outpost Personal Firewall.
It's a bit more complex to setup then ZoneAlarm but offers much more configuration options and has nice plugins.
http://www.agnitum.com/download/outpostfree.html
"I was wonderin why i dont get many alerts from my zonealarm firewall so i decided to test it. I know i wont get alot of alerts cuz i'm in a pretty well protected network but still...not 1 alert was kinda strange. I ran nmap on it from my linux box and not a alert came up and nmap displayed the stats of the comp. Should zonealarm detect a nmap scan???"
I'm sure you checked the Zones tab? One of the very first things ZA does after the install is to "discover" the first network it detects (the one you're on) and puts in in the "trusted" zone catagory. If you're not carefully watching for this, it's easy to continue clicking OK and miss it.
Re-installs will keep the same zone settings and not help, if this is the situation.
No scans from an IP within this zone will show up -- I'm assuming the nmap box is on your same network.
Hope this helps, :confused:
Myk
What type of scan are you using? Zone Alarm might not pick the nmap stealth scan. Try doing the TCP connect scan and see if you get any alerts.
-NeuTron
If you want to try a new personal firewall/IDS app. I've had good luck with BlackIce from ISS.
Both an IDS and personal Firewall, as well as application security.
I have it installed on one of my boxes and it DOES pick up those NMap scans.
just my $.02 free of charge ;)
I agree with Jct Uninstall and reinstall ZA I have not run into that problem at all it is in the install you had done.
Like Mykol mentioned, you may have inadvertenly set up a trusted zone with your internal network, if that is the case Zone Alarm won't do squat against those internal devices because you told the software to "trust" them.
Either that or some trojan compromised the software.
yep just re - instal it and pay very carefull atention to what options you are selecting.
You can have the best and most expensive FW on the planet but if you dont configure it properly it aint gonna work!!!