ZoneAlarm and NAT Router: How long to timeout?

In looking at ZoneAlarm's log files, I see where it has blocked incoming 
packets destined for my newsreader. Now, I don't recall if my newsreader 
was up and running at the time the packet was blocked, but it raises a 
couple of questions.

1) Usually, a NAT router will not transfer an incoming packet to a 
destination machine unless the destination machine (client) has initiated 
some sort of contact. (Or if port forwarding is turned on, which it is 
not.) Thus, an internally generated packet to an NNTP server:port119 will 
create a table entry in the NAT router and returning packets are routed 
accordingly. How long will this table entry exist?

2) Likewise with ZoneAlarm: How long will ZoneAlarm continue to *not* block 
packets expected by an application when that application has been 
terminated? For example, I fired up Aqualime (a LimeWire P2P clone) for 
about 5 minutes. Then I shut it down. About 15 minutes later, PeerGuardian 
is reporting that connections were denied from a known undesirable source. 
The second part to this question is: does PeerGuardian intercept the 
connection first or does ZoneAlarm?

Thanks.

Brian Smither


-- 
Remove INVALID from e-mail address.