fw tab -u -t connections | grep -i C0A8FFFA
The current timeout values for that connection will be on the far right of the display for each connection and look like: (3500/3600). The first number is a countdown timer and shows how much time is remaining until expiration, unless traffic matching that connection is processed in which case the countdown starts anew. The second number is the expiration time for that type of connection, inherited from the "Stateful Inspection" screen of the Global Properties or overridden by the Advanced tab of the service object in question. Note that trying to use -f to see decimal IP addresses with the above command will exclude the timeout values from the output.
This situation is mentioned in my book (p. 87-91), check out the TCP state logging function which can be very helpful diagnosing issues such as these (especially a kernel value of 2):
sk101221: TCP state logging
My book "Max Power: Check Point Firewall Performance Optimization"
now available via http://maxpowerfirewalls.com.
New 2-day Live "Max Power" Series Course Now Available:
"Gateway Performance Optimization R81.20" at maxpowerfirewalls.com