Sygate Personal Firewall's mission is to watch network traffic for hack attacks and block them. And it succeeds: It scored the best marks on our lab tests. The program can also back-trace suspicious events or packets and control whether applications may access the Internet based on your responses to pop-up queries.

The firewall's main window lists all programs that use the network and displays momentary indicators of incoming, outgoing, and blocked traffic. Basic configuration settings are straightforward; for example, you can specify maximum size and duration for log files and choose whether to permit file sharing. Also, this is the only firewall in our roundup that can send you e-mail notifications about alerts.

The separate Log viewer window displays essential information in four categories: System, Security, Traffic, and Packet. The System log simply reports status events, such as when the firewall was launched. The Security log lists suspicious events, with type, severity, and all necessary details, as well as a plain English description. The Traffic log lists details for network traffic events. If enabled, the Packet log lists the most recent incoming and outgoing packets, with full decoding for the selected packet. In any of these, you can right-click an entry and back-trace the originating IP address. The back-trace window will also retrieve WhoIs information for the originator.

Sygate Personal Firewall has three security levels: Allow all, Block all, and Normal. Allow all permits all network traffic, though logging continues. Block all is a complete network lockdown. Normal is the standard operating level, with firewall rules defining allowable connections. The rules analyze traffic for patterns of suspicious activities such as port scans and identify Port 144– specific Trojan horses using signature files.

The program's tray icon indicates network traffic and flashes when an intrusion occurs; there's no pop-up notification of intrusions. A knowledgeable user can create advanced firewall rules that take precedence over built-in rules. As you configure the settings to define advanced rules, the Sygate firewall displays a refreshingly clear summary. You can schedule advanced rules' operation and export them to multiple computers.

Its e-mail notification and ability to export firewall rules make this program extremely well suited for small offices or multicomputer homes.