McAfee Personal Firewall Plus 6.0
Installation and removal:
The installation of program occurs without the problems. The reloading is required after installation.
Advantages:
1. small size, the presence of master, who makes possible for the beginning user to dispose Firewall
2. is a visual display of traffic and the map, on which is reflected the assumed position of that attacking
3. removal of processes of Firewall did not lead to the disappearance of the protection
Deficiencies and the special feature:
1. in the default settings proved to be opened many dangerous ports
2. Warning about applications trying to access the network is not informative enough (there are no data about which IP goes an attempt at the connection, on what ports, there are no complete path to the program and additional data on it...)
3. the possibility of the manual creation of the rules of the filtration of packets is not outlined. Rules for the applications exist, but it is extremely primitive (to permit application everything, to forbid everything)
4. blocking listening on a port, is implemented incorrectly - all investigated firewalls made possible for program to open port for listening (and with the prohibition in rules Firewall of exchange with the network program simply did not obtain on this port packets). In this case the discovery port is blocked - this leads to the errors in some programs
5. IDS is absent - head-on attacks (scanning ports in 200 threads, Flood port at a rate of 2000 connections/sec...) - Firewall gave out no communications or warnings. Then it revealed arrival to my PC of single packet from port 514 (Syslog) and wrote down this into the protocol.
6. in the course of tests was noted certain interesting glitch in the system - ceased to be reflected icons on the desktop
General estimation: Very primitive Firewall, oriented to the level of the beginning user. Of very poor possibilities, IDS do not detect the explicit attacks |
