Okay, so I have this firewall thingy. (it's not zonealarm, it's one of the major brand ones, which my cable internet provider has hooked me up with a free year of ... (doesn't actually take the sting out of the obscene amount of money I'm paying for the really fast connection, but hell, it's something. 
How do I tell what's the bad probes (other than the really obvious ones that report things like "probe for sub7 trojan blocked") that I should be clicking the report button for and what's the innocuous ones, or ones legitimately generated ... there's a bunch that appear to arise from various nodes operated by my provider for example ...