The remote client appears to be tunneling data over port 21 TCP (FTP)
The remote host is running non-FTP traffic over port 21. Port 21 is a port that is typically allowed outbound access via a firewall. Because of this, some users may attempt to pass non-FTP traffic over port 21.
Ensure that this application is authorized for your network