Firewall Slamming

The others are exactly right...

the reason you could most likely tell that it is not a port scan is that the destination port is always greater than 1024. Now certainly a port scan can do this, but IMHO is not likely because it would have to be specified manually. Also, the fact that the SPORT is 80 definately is indicative of a messenger-like connection. These packets are most likely keepalives or responses back to your machine from whatever server you may be connected to.

It is possible to analyze this in much more depth if you really wanted to find out what is going on and you are willing to put a bit more effort into it. You can start by getting a sniffer trace of the traffic. First look into the TCP header and try to find out what type of packet this is. I would guess that the SYN and ACK bits would be set, of course making it a SYN-ACK packet and usually a response to a connection you initiated with an initial SYN packet. Furthermore, if this is using port 80, it is more than likely not encrypted, which means you can look into the payload of the packets and reconstruct the session to find out exactly what is being sent.

Of course this is a very high-level description, but it may be enough to get you started. Since I am oviously not in front of your machine, I can't say for sure what is going on, so I have made many assumptions. However, I would be more than happy to help you figure it out if you really want to. Send me an email with a sniffer trace or just ask any questions you might have.