Maybe the user has an Internet provider with one of those stupid policy where TCP port 80 is closed as inbound. And he used a TCP high port to be able to host h

Maybe the user has an Internet provider with one of those stupid policy where TCP port 80 is closed as inbound. And he used a TCP high port to be able to host his/her HTTP server.