There’s a new-ish Windows worm out and about. It’s causing lots and lots of samba connects to random hosts.
We had to resort to blocking samba at our border routers.
If we enabled it we get thousands of samba connects a minute from random hosts all over the world (infected machines).
If the worm dies down or a new method of filtering the traffic comes about, we’ll gladly have samba running again. In the meantime, there’s not much we can do.