blocking my ISP's scanners

I've discovered my ISP is portscanning me.

I would like to DROP or DENY all packets from their scanner...

I'll setup a network def. for their scanners.

Then, should I setup a rule that says
from scanner service any server any drop
?

Or should I DENY?
I'd like for them to get logged.
It might be nice if there was a DROP AND LOG option.

What would a normal non-firewalled windoze PC do? Drop or Deny?

Thank you,
Barry

This thread was automatically locked due to age.