Any help on a rule here would be much appreciated.
you have samba listening on an internet interface?
turn that one off...
I think the directive is listen on, or bind to or something.
its just not a great idea to have samba listening on an internet interface if you can help it.
most of your traffic would probably be worms of one form or another.
nachi in particular can chew a 512K connection to max capacity easily..
dave
-- SLUG - Sydney Linux User's Group - http://slug.org.au/ More Info: http://lists.slug.org.au/listinfo/slug
