I have my firewall set to 'set access for specific services and applications'.
Then whenever an app tries to accept incoming connections, a dialog pops up and asks you to allow it or not.
Even though I have a router firewall, this might help see what apps are trying to get incoming traffic (shame it doesn't seem to do outbound as well). For instance: For some reason RealPlayer seemed to want to accept incoming connections? Since I can't trust Real (they are basically on the level of spammers in my book), I disallowed that. I only use RealPlayer for the occasional RM file that I can't play elsewhere anyway.