ZoneAlarm-type firewall for Linux?

[Victor Odhner]

Hi, Craig.

>... many other processes will completely escape detection by using
>port 80 which passes through most every proxy and firewall unfiltered
>and thus you would never know about the activity anyway which leads
>to a false sense of security ...
>
ZoneAlarm will, as I said before, catch *any* new program trying to
connect to the Internet.  It does not just filter based on ports, but on
the originating executable.  So I can use Firefox all day, but if I put in
a new version, ZoneAlarm will recognize that and block it until I
say it's OK.

That's the functionality I'm looking for under Linux.  It is *not*
false security, it's pretty darned effective.  That's how I caught
AcroRead trying to connect out without my permission:  ZoneAlarm
caught it.  But it could be happening under Linux and I would not
know, because port 80 is open to all.

Vic