my guess is the first packet got through a firewall, which created a flow.

subsequent packets then got blocked because the firewall has no way of matching this to an existing flow.