Hi, hope this is in the right place?

Our firewall team discovered some packets leaving our Netware server going to clients in our VPN zone, in this case the firewall has dropped the packets.

I'm trying to narrow it down as to what could be causing this, pktscan has been run a few times and I can't really see anything odd going out to the same source IP addresses.

When they first came to me it was noticed that the Netware server was sending packets over port 1116 and 1119 (UDP), I did a pktscan and found some clients replying back on these ports for NCP requests initiated on port 524 from the server which is quite normal, but I could never find anything going from the server to the clients on the "problem" ports.

According to the firewall team this happens about 10 mins after the user logs on
I'm looking for any tips on where to look further with this, any help at all :)