I have a RH9 distribution configured to be a firewall (iptables 1.2.7). From my terminal I have access only to ssl port 22. When I scaned (from my terminal) the firewall for holes I found 1 TCP (ssl) port and 9 UDP ports opened. I whant to stop them, but I don't know how. When I tried netstat -atn I couldn't see them. I checked with ntsysv 2 and there is no service that are asociated with these UDP ports. Could someone give me a clue?
The UDP ports are:
- bootpc 68
- epmap 135
- NetBIOS DGM 138
- SNMP trap 162
- MS-SQL-s 1433 (this one worries me)
- ssdp 1900 (this one too)

Thanks!

netstat -atn will only list the tcp ports. Add the -u option to see udp as well:
netstat -atnu

Checkout the netstat man page for what the various options do. You can also use lsof -i to see what files are holding those ports open.