I am not sure if this belongs here or the NAT forum, but I think it
may have more to do with filtering.

After a long process of evaluating our firewall I am seeing this in
the NAT log. I don't know what is going on . I was wondering if it
is port scanning, but my PC (IP .41) is doing it as well. I know that

one user( IP 114) is using Instant Messenger,but he uses port 80 and
has permission to do so. None of the other IP's in the log even haveInstant Messenger installed. I am puzzled. I have port 21 open for
ftp passive stateful. but I know these are not ftp requests. If I
shut off port 21 in the filters, this does not happen. But then
legitimate ftp requests don't work. Does anyone have an idea?
( It looks like the NAT LOG does not translate very well in this
message format)

***********TCP NAT Connection

SRC IP | Orig Port |Trans Port | Dest IP |Dest Port |

State | LAT(Sec)