The product comes in two components, a background intrusion
detection system and a foreground application. If somebody
is doing a long term scan of your system or there are
lots of broadcasts on the local cable-modem segments, the
intrusion detection system will frequently update the logs,
and the user interface will update its display.
The bug stems from an assumption we made when creating
the product. We assumed that the average user would
only receive one or two attacks per month, so we simply
updated the entire display whenever new traffic came in.
On cable-modem and DSL systems, users are getting scanned
much more often, so this "losing sync" problem becomes very
annoying.
We are working on a fix for this problem that retains the information
even when we update in the background.
