Advanced Settings - Firewall Behavior Settings?

Regarding these advanced settings can someone give me a break down about needing them?

  1. The ‘Arp’ settings just use those if you are on a Network, otherwise no need on a single box?

  2. ‘Protocol Analysis’ why isn’t this checked by default, seems like good extra protection?

  3. ‘Monitor NDIS protocols other than TCP/IP’, again seems like another option good to use? But incompatible with some protocol drivers, so how often incompatible, can this be a real problem, so better to stay clear?


P.S. Besides these Advanced settings, what about the Alert Frequency Level, the default ‘Low’ has nothing to do with the quality of security right? It’s just about how often you simply wanted to be alerted to something and at what level? So actually Low would mean you’re just not being alerted as often unless there’s really an important need? So for those that don’t want to be bothered with alerts or the newbie this is a better setting?

You can see my reply to a similar question here Re: Balance between safety and speed configuration ?

You can also take a look at the help page. Comodo Help

The Alert level slider gives you control over the level of detail a rule will contain and also how many alerts may be generated for any given event. At a low level you will receive general alerts indicating both inbound and outbound connections. At very high you receive many more alerts and the rules created will contain more detail, such ad IP Addresses and ports used in the connections.

To give you an idea see the images below. The first image is the result of the Alert slider being set to Low. When I launched firefox, I received one alert for loopback and the rule was created. When I set the slider to Very High, I received alerts for both loopback and for connecting to any site. See image two.

Clearly, when the Alert level is set to very high, many more alerts will be received. Of course, the rules may be easily modified to reduce the number of entries, or you may choose to make use of the pre-defined rules, where they exist.

[attachment deleted by admin]

Ok I guess I’ll just leave everything as it is, for the default settings…

Maybe I’m thinking of the wrong alert then…

What are the big pop up alert windows that appear above the clock that are like 3-4 inches big?

I know when I use to run Comodo on paranoid you’d see this popup for everything going on, now that I have it on safe mode and low I have not seen one popup since I started using my box today for anything…


Paranoid mode refers to Defence+, whereas the Alert lever is a firewall option (found under Firewall Behaviour settings). The firewall and D+ alerts look similar (see images) Placing D+ in Paranoid mode will generate a great many alerts, just as increasing the firewall Alert lever to Very High.

If you place D+ and the firewall in safe mode, you should only receive a relatively small number of alerts. Generally for applications that are not covered by the TVL/safe list.

[attachment deleted by admin]