BlackICE Defender

Although dial-up Internet connections are harder for hackers to attack there's still the risk of your PC being probed for weak spots and exploited - especially if you stay on-line for long periods. ADSL and its 'always on' connection puts the target market of home and SoHo users at even greater risk, so protection from unwanted snoopers is essential. BlackICE Defender aims to offer these very users industrial-strength firewall and intrusion detection measures and it incorporates many features found in Network ICE's corporate ICEpac firewall products.

BlackICE only takes a few minutes to install and immediately starts protecting your system without any user intervention. It defaults to a Cautious mode which is designed for regular Internet usage and only blocks suspicious traffic that attempts to access the operating system and networking services. You can step up to a Nervous mode that blocks all unsolicited inbound traffic except for instances such as interactive Web site content or slam the door shut with the Paranoid mode.

BlackICE certainly doesn't mess about if it detects an attack. All you'll see is the System Tray icon flashing and hear a WAV file play but, behind the scenes, the program is gathering plenty of information about the intruder. From the Attack tab you can view details such as the time and date, the type of attack and the number of occurrences. Each entry is also accompanied by an icon showing the severity of the event and the type of response. A key feature of BlackICE is its ability to back-trace attacks in an attempt to identify the source and, where possible, it will log the intruder's IP address along with the DNS, NetBIOS, node and group names and even their MAC address. Selecting an entry displays a short description of the event and a single mouse click takes you to Network ICE's Web site for more information and advice. Using the What's Up utility from Ipswitch to run a port scan of the local network, I was impressed to see this potential attack immediately identified and blocked but also that all network details about the initiating PC were captured along with the name and the manufacturer of the utility.

Although BlackICE only blocks direct threats to your PC you can modify this by selecting an attack instance or an intruder from the log and either trust them or permanently block them for an hour, a day, a month or forever. IP addresses that you want BlackICE to trust can be entered manually although you can only add individual entries and not a range of addresses. You can also keep a close eye on recent activity as BlackICE maintains two graphs showing local and Internet network activity and attacks and the time period can be extended up to the last 90 days making it easy to see trends in overall traffic and hacking or probing activities. A neat feature is that you can select a peak on the attack graph and BlackICE will automatically switch over to the Attack tab and highlight the entry that caused it. BlackICE can also be set to check Network ICE's Web site periodically and automatically download any product updates.

While there are other good personal firewall utilities on the market such as ZoneAlarm (see www.zonealarm.com), BlackICE Defender scores highly as it maintains a very low profile on your PC and yet offers excellent protection and a wealth of features. A price of £30 is also a modest sum to pay for peace of mind - buy it and be safe.

Author: Dave Mitchell