At 03:33 09/16/05, David Gillett wrote:
>On 15 Sep 2005 at 16:17, Bill Cohane wrote:
> > I used to experience delays when attempting to download my email
> > using Eudora. (About half the time my attempt to logon to Road
> > Runner's POP3 email server would seem to hang and I'd have to
> > cancel it and try again.) This stopped when I upgraded to ZA 6.
>
>Many firewalls have two different ways of rejecting blocked traffic.
>One is to just ignore it, and the other is to send an actual rejection
>message back.  (Each has its pros and cons.)  The "ignore" option is
>considered most secure, and if a firewall only blocks traffic in one
>way, that is usually it.
>
>   When a client (your computer) connects to a POP server, in most
>cases the POP server won't actually start message download right
>away.  For historical reasons, most POP servers will first try to
>connect back to the client using the obsolete "ident" protocol on
>TCP port 113. Since this protocol is obsolete and unused at the PC
>end, the firewall will block it.
>
>The server will try three times before it gives up and proceeds with
>the POP download.  If the firewall sends a rejection in response to
>each attempt, this process takes less than a second.
>   If the firewall just ignores the server's first "ident" attempt,
>the server will allow 30 seconds for the attempt to time out, and
>then try a second time.  So if the firewall does not send rejections
>of blocked "ident" traffic, POP download will be delayed by up to 90
>seconds....
>
>So while ignoring blocked traffic is generally the most secure thing
>to do, POP performance is improved if the firewall makes an exception
>for "ident" rejections.  A really smart firewall might only send
>rejections for "ident" attempts that follow establishment of a POP
>connection.
>
>It rather sounds like this is probably one of the enhancements made
>to [the latest build of] Zone Alarm.  It wouldn't necessarily have
>any impact on any other traffic, whether permitted or blocked,


Hi David

Thanks for the very informative explanation. This sounds exactly like
what was happening. I rarely if ever waited that 90 seconds before
attempting to start the email downloads all over again.

These email delays started happening right after I upgraded Zone Alarm
5.5 to Zone Alarm 6.0.631. Because of this timing, I strongly suspected
that Zone Alarm was causing the delays. Playing with ZA's settings
for Eudora didn't help any. This scenario seems to have been confirmed
since the delays went away with the upgrade to ZA 6.0.667. It's
interesting that Zone Labs only announced that they fixed a POP problem
between Zone Alarm 6 and Norton Antivirus. It appears to have been more
widespread...seeing that I don't use NAV for email protection.

Interestingly, Road Runner's POP3 server was the only email server
(that I use) that consistently showed this delay. (Verizon's and
GMail's POP servers never took/take more than a few seconds using
Eudora.)

Any other Zone Alarm 6 user experiencing delays downloading email from
a POP server would do well to upgrade to the latest ZA build.

Regards,
Bill

               The NOSPIN Group Promotions is now offering
                 our special coffee cups and mouse pads
              with the PCSOFT logo...  at a great price!!!
             http://freepctech.com/goodies/promotions.shtml