nntp connects dropped at firewall

nntp connects dropped at firewall

[Harry Putnam]

Not really gnus related unless gnus nntp conversations are involved.
I posted the message below on comp.os.linux.security and one
respondent seemed to think it might be happening because my
newsreader was sending something those nntp servers didn't expect.
Like a disconnnect maybe.

I hoped one of the nntp buffs here would know if this looks normal or
what.  My IP is shown as xxx.xxx.xxx in output from firewall logs.

==================================

This is ultimately something I'll have to take up with netgear since
it is a netgear FVS318 router/firewall dropping these connections.

I thought I might first get a legup here.

I have 3 nntp servers:
news.west.cox.net. 
enews.newsguy.com
news.gmane.org

I get the news alright but some of the connects are dropped by my
firewall. These servers all send tcp connects from 119 to my firewall
that get rejected for unknown reason.

I wondered if there is something abnormal about them:

Examples: 
This is news.west.cox.net
Sun, 05/25/2003 13:35:42 - TCP connection dropped -
Source:68.6.19.6, 119, WAN - Destination:xxx.xxx.xxx, 17950, LAN -
'Possible Port Scan'

==============
This is from news.gmane.org
Sun, 05/25/2003 13:40:38 - TCP connection dropped -
Source:80.91.224.249, 119, WAN - Destination:xxx.xxx.xxx, 17943, LAN -
'Possible Port Scan'

======
This is from enews.newsguy.com
Sun, 05/25/2003 19:20:37 - TCP connection dropped -
Source:129.250.170.91, 119, WAN - Destination:xxx.xxx.xxx, 18013, LAN -
'Possible Port Scan'

=======
My firewall thinks these might be a port scans.  Is there reason to think
that.  Are the news servers sending uncommon connections, or is this
firewall just set up wrong?