what does the port activity /logs show when this occurs?