Sygate Personal Firewall still allows blocked applications?

Hi all

On Sygate Personal Firewall 5.6, blocked applications always have large counts of allowed incoming and outgoing packets. It would seem that Sygate allows these applications access to the network regardless of whether the application is blocked or not.

This is excluding the broadcast traffic. I have no advanced rules configured. My security mode is on normal. Even when I turn the firewall mode to "block all" blocked applications still show continuously rising "Incoming Allowed" packet counts.

Example applications are LSA Shell and NT Kernel - and worse, Apple's "Bonjour" service.

I run Sophos, and I find it highly unlikely I am infected with something that would allow everything to bypass sygate.

I've looked on a few forums I cannot find an answer.

Can someone out there shed some light on what I'm missing?

What's interesting is that when I "block all", I can't, for example, browse local network paths or surf internet anymore, so I know Sygate intervenes correctly. I can block Internet Explorer and it will not find URLs anymore. But why on earth can we see these silent applications like LSA Shell, NT Kernel, and Bonjour still transfer packets?

Thanks