I'm setting ipfw, and the following was suggested to me: If I make the rule only to drop SYN packets for TCP, no connection could be established and the firewall won't even have to look at other packets.
It seems counter intuitive for me. I think that firewall will perform better if I block all communication on the specified port (less packet inspection involved), and since no connection can be established either way, the number of incoming packets will be the same.
Is there really difference?
Edit: concrete problem, blocking SSH from somehost:
ipfw add deny tcp from somehost to any port 22 via em0 tcpflags syn
vs.
ipfw add deny tcp from somehost to any port 22 via em0