I suspect these connections reported as violations to be in fact the responses for the aforementioned allowed connections and not separate connections. And if that's the case, isn't that a bug?