I'm using --set-log-denied to see who is poking my system and for general
debugging. I divert the resulting log to its own rotated log file to avoid
cluttering other logs.
I note that a lot of entries are from my own LAN and are noisy broadcast
discovery programs that are looking for printers and other devices. I don't
want to open the port on my system, but I also don't want those packets
cluttering my logs. Is there a way, apart from a direct rule, to just eat
those packets with a silent DENY so they don't hit the log-deny rules?