Hellen, Blaster worm comes on port 135. Define a new service netbios_135 SP:1024:65535 DP 135. After this, make a new packet filter rule: From:Any Service: netbios_135 TO: Your_Internet_Interface ACTION: DROP. Thats enough for the blaster, but it is not bad to block all netbios ports to you outside Interface. Cheers
Overnet, regardless of which port is open on the firewall. If there are packets e.g. from the outside, which doesn´t match to a ALLOW or DROP rule, the packets are shown in your kernel log. So your kernel log grows up. Even the port is closed, the dropped packets are shown in the kernel log.
The meaning is that your packets are directly dropped and are not shown in the kernel logfile. Many users have the problem, that their logfile grows up and up ... and the partions gets full.With the drop entry, the packets are not shwon. But you are right, thats not coactive to set this rule, because the firewall is a firewall to block not allowed packets. cheers
