Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
a firewall should stop incoming traffic. i use both the built-in firewall in OS X as well as the one on my router, because i'm extra paranoid. before OS X, i used norton's firewall, which will alert you to port scans and other attempts to access your network. there was always plenty of incoming attempts -- most of them were auto-pilot bots or scripts looking for unprotected windows systems, but still: there were enough incoming attempts to convince me that a firewall is a Good Idea.
 
The big thing you want your firewall to do is to protect against unwanted kinds of traffic. So normally all the ports on your computer are potentially open (assuming any of your software can be coerced to listen to them). A firewall closes all the ones you don't need (like if your computer is not an FTP server), and can also help detect other suspicious activity.

I use the built-in OS X one, and ZoneAlarm on my PCs. I kinda like how Zone Alarm gives you pop-ups that tell you what's going on. Thankfully, my iBook has a LOT less silly programs running in the background trying to surf the web than my PC so I guess it doesn't matter much. :D
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.