port scans from local workstation

["Infrastructure Dept." <infrastructure () narellan net>]

Follow up to my original post.
I see these scans happening right after accountable FTP sessions. The scan
appears to start about one minute after the FTP session is opened. This is
happening from all my workstations and off site workstations using a mixture
of FTP clients. What could be triggering this?

Aug 11 10:24:50 ns1 ftpd[644]: FTP LOGIN FROM 209.23.33.114 [209.23.33.114]
<SNIP>
Aug 11 10:25:40 ns1 scanlogd: From 209.23.33.114 to 206.230.66.1 ports 3387,
23115, 19948, 42708, 10511, 56523, 33709, 50899, 24634, ..., flags ??r??u,
TTL 117, started at 10:25:36

Mr. I.
Network Engineer / Ops Manager
Narellan (NorthEast) Inc.