Session tables on routers are often not kept up to exact date with the state of the computer because the tables depend on packet transmits invoke a closing of connection or the like. If something (e.g. a firewall) interrupted such a transmission or wasn't sent at all, the connections can be left hanging for quite a while. Many NAT implementations have countdowns on sessions that have not transmitted or received data and will close the connection after a timeout is reached.
As far as TCP/6000-7000, That's normal browser activity, the computer locally will establish connections using a randomized port locally as so that multiple connections can be open at once to one or more webservers to download at once, otherwise, you couldn't browse more than one website at a time and page loading times would be much slower. ' How long after browser activity stops is the above screenshots recorded? -- --Kradorex Xeron [an error occurred while processing this signature]