What triggers a port scan detection in Symantec Endpoint Protection (SEP)?