Market: dominant in SOHO and a player in business.
How they work: similar to hardware, but using a generic computer as the firewall device.
- Comodo example: once downloaded and installed block by default all inbound traffic and ask for authorization for inbound and outbound traffic, creating rules. You can choose to allow or deny specific applications. You can create rules to make ports stealth, and see status of the connections in your host.
- ZoneAlarm example: similarly blocks all inbound traffic, require you to setup security levels for LAN and Internet. Ask for authorization for outbound traffic, adding authorized programs to the list.