Sometimes associated with P2P software. Does the log give an origin IP address? And what is "a load"? several times per second, or once a week? TCP fin scan could be someone doing a TCP reset on your traffic, in other words they think you're consuming too much bandwidth.