A sensor sees many failed connections from one source to sequential destination ports. What is a plausible explanation?

1. Ordinary Ethernet MAC learning
2. Port scanning
3. A single successful encrypted file transfer
4. Normal clock synchronization