iptables: В логи пишется «спам» и ещё один вопрос

Типа такого:
IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:04:61:4e:ae:db:08:00 SRC=85.29.200.84 DST=85.29.207.255 LEN=78 TOS=0x00 PREC=0x00 TTL=128 ID=29764 PROTO=UDP SPT=137 DPT=137 LEN=58
IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:04:61:4e:ae:db:08:00 SRC=85.29.200.84 DST=85.29.207.255 LEN=78 TOS=0x00 PREC=0x00 TTL=128 ID=29767 PROTO=UDP SPT=137 DPT=137 LEN=58
IN=eth0 OUT= MAC=01:00:5e:00:00:01:00:c0:26:8f:28:3d:08:00 SRC=85.29.193.125 DST=224.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=4450 PROTO=UDP SPT=1774 DPT=5000 LEN=40
IN=eth0 OUT= MAC=01:00:5e:00:00:01:00:c0:26:a3:80:91:08:00 SRC=85.29.199.61 DST=224.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=1304 PROTO=UDP SPT=1040 DPT=5000 LEN=40
IN=eth0 OUT= MAC=01:00:5e:00:00:01:00:30:1b:2d:c0:9c:08:00 SRC=85.29.201.248 DST=224.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=8316 PROTO=UDP SPT=1496 DPT=5000 LEN=40
IN=eth0 OUT= MAC=01:00:5e:00:00:01:00:30:1b:2d:c0:9c:08:00 SRC=85.29.201.248 DST=224.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=8316 PROTO=UDP SPT=1496 DPT=5000 LEN=40
IN=eth0 OUT= MAC=01:00:5e:00:00:01:00:c0:26:8f:28:3d:08:00 SRC=85.29.193.125 DST=224.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=4976 PROTO=UDP SPT=1774 DPT=5000 LEN=40
IN=eth0 OUT= MAC=01:00:5e:00:00:01:00:c0:26:a3:80:91:08:00 SRC=85.29.199.61 DST=224.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=1463 PROTO=UDP SPT=1040 DPT=5000 LEN=40
IN=eth0 OUT= MAC=01:00:5e:00:00:01:00:c0:26:a3:80:91:08:00 SRC=85.29.199.61 DST=224.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=1463 PROTO=UDP SPT=1040 DPT=5000 LEN=40

Broadcast пакеты уже DROP-аю.

Вопрос
1) Как и от этого спама избавиться в логах? Логи пока не настроил, всё вываливается в dmesg.

2) Как сделать так, чтобы broadcast пакеты не засоряли трафик? В gkrellm постоянно видно, как 5-10 kb съедается на одни эти пакеты. iptables, как я читал, бессилен в этом отношении.

3) Кстати, ещё по ftp не зайти с удалённой машины.

Вот /etc/init.d/myfirewall:

#!/bin/sh
PATH=/bin:/sbin:/usr/bin:/usr/sbin

# Services that the system will offer to the network
TCP_SERVICES="5556 21 20" #
UDP_SERVICES="21"
SSH_PORT="5556"
# Services the system will use from the network
REMOTE_TCP_SERVICES="80 21 110 25 443"
REMOTE_UDP_SERVICES="53" # DNS
# Network that will be used for remote mgmt
# (if undefined, no rules will be setup)
# NETWORK_MGMT=192.168.0.0/24

if ! [ -x /sbin/iptables ]; then
exit 0
fi

fw_start () {

# Input traffic:
/sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Services
for PORT in $TCP_SERVICES; do
/sbin/iptables -A INPUT -p tcp --dport ${PORT} -j ACCEPT
done
for PORT in $UDP_SERVICES; do
/sbin/iptables -A INPUT -p udp --dport ${PORT} -j ACCEPT
done
# Remote management
if [ -n "$NETWORK_MGMT" ] ; then
/sbin/iptables -A INPUT -p tcp --src ${NETWORK_MGMT} --dport ${SSH_PORT} -j ACCEPT
else
/sbin/iptables -A INPUT -p tcp --dport ${SSH_PORT} -j ACCEPT
fi
# Remote testing
/sbin/iptables -A INPUT -p icmp -j ACCEPT
/sbin/iptables -A INPUT -i lo -j ACCEPT
/sbin/iptables -P INPUT DROP
/sbin/iptables -A INPUT -j LOG

# Output:
/sbin/iptables -A OUTPUT -j ACCEPT -o lo
/sbin/iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# ICMP is permitted
/sbin/iptables -A OUTPUT -p icmp -j ACCEPT
# So are security package updates
/sbin/iptables -A OUTPUT -p tcp -d security.debian.org --dport 80 -j ACCEPT
# Allow ICQ
/sbin/iptables -A OUTPUT -p tcp --dport 5190 -m state --state NEW,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -p tcp -s login.oscar.aol.com --sport 5190 -m state --state NEW,ESTABLISHED -j ACCEPT
# Allow ICQ incoming TCP events
/sbin/iptables -A INPUT -p tcp -s login.oscar.aol.com --sport 50000:51000 -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp -d login.oscar.aol.com --dport 50000:51000 -m state --state NEW,ESTABLISHED -j ACCEPT
#Jabber
/sbin/iptables -A OUTPUT -p tcp -d jabber.ee --dport 5222 -m state --state NEW,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -p tcp -s jabber.ee --sport 5222 -m state --state NEW,ESTABLISHED -j ACCEPT

#IRC
/sbin/iptables -A OUTPUT -p tcp --dport 6667 -m state --state NEW,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -p tcp --sport 6667 -m state --state NEW,ESTABLISHED -j ACCEPT

for PORT in $REMOTE_TCP_SERVICES; do
/sbin/iptables -A OUTPUT -p tcp --dport ${PORT} -j ACCEPT
done
for PORT in $REMOTE_UDP_SERVICES; do
/sbin/iptables -A OUTPUT -p udp --dport ${PORT} -j ACCEPT
done

# Block Netbios broadcasts
/sbin/iptables -I INPUT -m pkttype --pkt-type broadcast -j DROP

# All other connections are registered in syslog
/sbin/iptables -A OUTPUT -j LOG
/sbin/iptables -A OUTPUT -j REJECT
/sbin/iptables -P OUTPUT DROP
# Other network protections
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
echo 0 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo 1 >/proc/sys/net/ipv4/conf/all/log_martians
#echo 1 > /proc/sys/net/ipv4/ip_always_defrag
echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects
echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route

}

fw_stop () {
/sbin/iptables -F
/sbin/iptables -t nat -F
/sbin/iptables -t mangle -F
/sbin/iptables -P INPUT DROP
/sbin/iptables -P FORWARD DROP
/sbin/iptables -P OUTPUT ACCEPT
}

fw_clear () {
/sbin/iptables -F
/sbin/iptables -t nat -F
/sbin/iptables -t mangle -F
/sbin/iptables -P INPUT ACCEPT
/sbin/iptables -P FORWARD ACCEPT
/sbin/iptables -P OUTPUT ACCEPT
}


case "$1" in
start|restart)
echo -n "Starting firewall.."
fw_stop
fw_start
echo "done."
;;
stop)
echo -n "Stopping firewall.."
fw_stop
echo "done."
;;
clear)
echo -n "Clearing firewall rules.."
fw_clear
echo "done."
;;
*)
echo "Usage: $0 {start|stop|restart|clear}"
exit 1
;;
esac
exit 0