You are running a vulnerability scan on a remote network and the traffic Is not making It to the target system. You investigate the connection issue and determine that the traffic is making it to…

If your own network firewall were the problem, traffic would be blocked before or at the perimeter - it would not be observed arriving at the internal interface and then failing; the block would occur upstream.

NAT/PAT table exhaustion is an uncommon edge case that would cause intermittent drops across all traffic types, not a consistent and reproducible failure to reach the target - making it less likely than a host firewall rule.

A host-based firewall running on the target machine - such as Windows Firewall or iptables - operates at the operating system level and can silently drop incoming scan packets even after they have passed through all network-layer devices. This matches the described symptom where traffic traverses the network infrastructure but never reaches the target. Host-based firewalls are independent of network firewalls and are a common cause of 'last mile' scan blockage.

ISP-level blocking would prevent traffic from leaving your network segment entirely, occurring far upstream of any internal firewall interface - inconsistent with the described symptom.