Probale TCP FIN scan in log

That was probably a spoofed IP source address in the TCP FIN scan.

Ok, there are a lot of flags in the TCP header that can be turned on and off by some of the better port scanners, like NMAP. And the FIN flag is just one of these flags. YOu can also do a TCP SYN scan (the "half-open" scan type that is very popular), TCP XMAS scan (turn all flags on so the packet is lit like a Christmas tree, hence the name!), and the TCP NULL scan (leave all flags off).
And also with the good port scanners (again, like NMAP), you can put in a fake source IP address, called "spoofing."

So, someone spoofed the IP with that of Hotmail.com, and did a TCP FIN scan against your firewall. Can you catch who did this scan attempt now? No, not unless your router was in debug mode at the time (which it probably wasn't, due to the overhead).

So, I wouldn't worry about it very much. Verify the firewall settings (what ports it has open and who --if anyone-- can connect to those open ports), and make sure there isn't anything open that shouldn't be.

But port scan are a daily reality nowadays. They happen all the time all over the place. What I find amazing is how often even dial-up clients are port scanned! For example, NEVER USE NETZERO for dial-up connections UNLESS you have a firewall! That network is scanned constantly!

hope this helps

Thanks, Joseph