Today I came across the following message in the kernel's log: conntrack_ftp: partial 227 4048680485+13 Fortunately this link helped:

The FTP conntrack helper has found a partial matching when parsing a request to start a connection in passive mode (ie. needs missing information to track that connection, malformed packets,...). In that case such packet is silently drop[ped].