Firewall logs strange attempts....

Hi All, Recently, my ipchains script running on SuSE 7.0 has been denying attempts at TCP access to ports: 12345 1243 1099 1099 I checked in /etc/services and found that 1099 is the standard port for RMI Registry. Connections to the above ports were made in rapid succession. Can anyone tell me what port 1099 and the two other unpriveliged ports could mean together? Thanks, Charlie