Looks like Port 520
(http://www.networkice.com/advice/Exp...20/default.htm) has to do with routing, which could either be benign or malicious, depending on what they are trying to do... I'm not sure, but I don't think they have a good reason to be trying to get to that port unless they are a router.
