Firewall alerts/Protected

Firewall alerts are the most common type of informational alert. Firewall alerts inform you that the ZoneAlarm security software firewall has blocked traffic based on port and protocol restrictions or other firewall rules.

Figure 4-1: Firewall alert

Why these alerts occur

Firewall alerts with a red band at the top indicate high-rated alerts. High-rated alerts often occur as a result of hacker activity.

Firewall alerts with an orange band at the top indicate medium-rated alerts. Medium-rated alerts are likely the result of harmless network traffic, for example, if your ISP is using ping to verify that you're still connected. However, they also can be caused by a hacker trying to find unprotected ports on your computer.

What you should do

Informational alerts don't require a decision from you. You can close the alert by clicking OK at the bottom of the alert. By doing this you are not allowing any traffic to access your computer.

How to see fewer of these alerts

If you're on a home or business network, and your Trusted Zone security is set to High, normal LAN traffic such as NetBIOS broadcasts may generate firewall alerts. Try lowering Trusted Zone security to Med.

By default, ZoneAlarm security software only displays high-rated firewall alerts. If your defaults have been changed, you may see a lot of medium-rated alerts. Try setting your alert display settings to medium.

If you are receiving a large number of firewall alerts, and you are working on a home network or business LAN, it is possible that normal network communications are being blocked. If this is happening, you can eliminate the alerts by placing your network in the Trusted Zone.

Repeated alerts may indicate that a resource you want to trust is trying repeatedly to contact you. If you are receiving a lot of firewall alerts, but you don't suspect you're under attack, try the following troubleshooting steps:

Determine if the source of the alerts should be trusted.
Submit repeated alerts to SmartDefense Advisor to determine the source IP address that caused the alerts.
If the alerts were caused by a source you want to trust, add it to the Trusted Zone.
Determine if your Internet Service Provider is sending you "heartbeat" messages.
Try the procedures suggested for managing ISP heartbeat. See Allowing ISP Heartbeat messages .