D'oh. Right.

Could be timeout from existing/previous connections and the firewall is closing it (don't think so but doing random thoughts on this one). Do the sequence numbers match for existing connections?