Strange sessions

[ddemchuk]

I observe some strange sessions on my OpnSense box (Firewall -> Diagnostics -> Sessions). I use 1.1.1.1 as DNS provider.
10.5.1.250:2 -> 1.1.1.1:2 - not sure why it is connecting to port 2 at all.
1.1.1.1:2 -> 10.5.1.250:2 somehow matched the "allow DHCP client on WAN" while the rule is about ports 67 and 68, not port 2.
Both sessions remain constantly open, "Expires" value is always 9 or 10 seconds.

Is there some logical explanation to this? Or is there a bug in sessions view?