I'm currently building a new box(NW6.5SP5) to replace an older
server(NW6SP4) that acts as an external firewall to our DMZ. It only does
packet filtering.

The old server had BM3.7SP2 installed and currently abends every time you
change the filters - but my question is do I really need to install BM3.8
if all it's doing is packet filtering? Does BM offer 'better' packet
filtering capability and security than just using NW6.5's filtering?