Cisco ASA/Wireshark question

This is a little puzzling. There is an office using a cheap linksys router to do port forwarding to their DVR so that they can access from a public ip address. this office with the DVR isn't on the network and it's part of a piece of the company we're divesting. Anyway, they're using port 2000 and 3000 to port forward to a couple of different IP addresses/DVR servers in their office.

One of them works and the other one doesn't. Ive done packet tracer as well packet capture on both flows and everything looks good.

if i telnet to publicipaddress:3000, i get some wingdings indicating i made a good connection.

if i telnet to publicipaddress:2000, i get an open connection but no wingdings. If i do the same test at our DR site with a different internet connection, it works on both of them.

I ran wireshark on my computer and noticed the one that doesn't work, (port 2000) I noticed after about the 3rd entry the window size value is 64813 and the calculated window size value is 64813. in fact after this entry all of the window size values and calculated size values are the same. While the one that does work, the values are different.

you know how it goes. if you don't know what you're doing, just compare 2 things, one that works and one that doesn't and spot the differences. :)