Hell knows, might be to log first all IP/ports connections (for svc) on _clean_ machine and use it as "white" list?