a firewall should stop incoming traffic. i use both the built-in firewall in OS X as well as the one on my router, because i'm extra paranoid. before OS X, i used norton's firewall, which will alert you to port scans and other attempts to access your network. there was always plenty of incoming attempts -- most of them were auto-pilot bots or scripts looking for unprotected windows systems, but still: there were enough incoming attempts to convince me that a firewall is a Good Idea.