If I am understanding you correctly, you have a client on one side of a hardware firewall connecting to a FTP server on the other side of the firewall? The confusion of this is that you are trying to observe the connection from the perspective of the firewall verses using the netstat on the FTP server itself. In such a case, the hardware firewall has no access to the TCP/IP stack on the FTP server and thus takes an educated guess on how to filter the connection. Such connections through the firewall typically have timeouts, especially on the more advanced firewalls. While this sounds counter intuitive, there is a valid but complicated reason for this. The shortest most simple answer I can give is that the firewall needs these timeouts to help keep track of outbound connections. Otherwise a hostile remote client could simply tell the firewall that the protected server was trying to make an outbound connection to the hostile client. These timers then try to give the firewall enough information to know that the hostile client is telling a lie. You would be better off checking from the FTP server itself.