I just noticed that vsmon.exe from ZoneAlarm firewall started to act like proxy for TCP connections (I am guessing it's doing the same thing for UDP packets internally). I use TCPView.exe from sysinternals to troubleshoot network related issues. So if a process A.exe on the computer try to access remote address b.com on port cccc, I am expecting to see:


A.exe, localhost:nnnn, localhost:mmmm

Instead, I see


A.exe, localhost:nnnn, localhost:mmmm

vsmon.exe, localhost:mmmm, b.com:cccc

This is making things very hard to see which connections to remote addresses belongs to which process anymore. I am trying to figure out a way prevent vsmon.exe to be the middle-man process for the TCP connections from the processes running on my computer.

I am using version 11.0.780.000 of ZoneAlarm. I had the same annoying problem with Kaspersky so I changed to ZoneAlarm a little while ago because ZoneAlarm did not act like proxy process for network connections. But since few updates ago, this started to happen to ZoneAlarm also.

(1) I am wondering if there is a way to change the setting of ZoneAlarm so that it will not hijack my TCP connection like this. I searched their help forum but I could not find good information there.

(2) I am considering to look for alternative firewall products. If you know other firewall products that (a) allows one to setup process level firewall rules like ZoneAlarm or Kaspersky and (b) does not hijack the network connection like these, please let me know.



Looks like we cannot (unless I shut down the FW).

I contacted Customer Service and posted the same question but no solution to do exactly what I asked. I am pretty sure they have their reasons to do this to their FW design so I just gave up on using ZoneAlarm to something that is not ZoneAlarm.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.