Gratuitous syn/ack

I'm seeing a significant number (about 1/minute 24 hr/day) of syn/ack packets coming from port 80 of random addresses to random ports on my nameserver and a few other systems. This isn't enough traffic to be really annoying, but is curious. I wonder if the simple explanation (backscatter from syn floods with spoofed source addresses) is more likely, or if there are some probing techniques in "normal" use that use these packets (one could accomplish a traceroute using port 80 packets in either direction...) -- Pete