If someone is really sneaky, he or she may try to bypass your company's firewall by sending a packet that has both the SYN flag and another flag set. This ability to choose another port number is certainly a security hazard. For example, consider what would happen if a disgruntled employee set up his or her office desktop with FTP services on port 80. The employee could go home, connect to the company's network, and send packets through the firewall. To prevent anyone from bypassing your company's firewall in this way, you can create a packet filter.
Ephemeral ports are ports that are temporary.
As you might guess, ephemeral ports are used only for a short period of time. For example, when an FTP client issues an ls command to view the contents of a directory, this FTP client sets up a temporary port number to be used for the transfer of directory contents. The FTP client software then translates the ls command to the NLST command. Ephemeral ports irritate most protocol analysts. After all, just when you think you have set up a nice FTP filter by using the checkbox method, you find out that the filter won't capture even half of the actual FTP communications.