when i do cat /proc/net/ip_conntrack i get o lot of entries like:
---------
tcp 6 359867 ESTABLISHED src=192.168.1.1 dst=192.168.1.184 sport=59975 dport=80 [UNREPLIED]
src=192.168.1.184 dst=192.168.1.1 sport=80 dport=59975 use=1
tcp 6 359867 ESTABLISHED src=192.168.1.1 dst=192.168.1.185 sport=59974 dport=80 [UNREPLIED]
src=192.168.1.185 dst=192.168.1.1 sport=80 dport=59974 use=1
tcp 6 359867 ESTABLISHED src=192.168.1.1 dst=192.168.1.185 sport=59975 dport=80 [UNREPLIED]
src=192.168.1.185 dst=192.168.1.1 sport=80 dport=59975 use=1
tcp 6 359867 ESTABLISHED src=192.168.1.1 dst=192.168.1.186 sport=59974 dport=80 [UNREPLIED]
src=192.168.1.186 dst=192.168.1.1 sport=80 dport=59974 use=1
tcp 6 359867 ESTABLISHED src=192.168.1.1 dst=192.168.1.186 sport=59975 dport=80 [UNREPLIED]
src=192.168.1.186 dst=192.168.1.1 sport=80 dport=59975 use=1
tcp 6 359867 ESTABLISHED src=192.168.1.1 dst=192.168.1.187 sport=59974 dport=80 [UNREPLIED]
src=192.168.1.187 dst=192.168.1.1 sport=80 dport=59974 use=1
tcp 6 359867 ESTABLISHED src=192.168.1.1 dst=192.168.1.187 sport=59975 dport=80 [UNREPLIED]
src=192.168.1.187 dst=192.168.1.1 sport=80 dport=59975 use=1
tcp 6 359867 ESTABLISHED src=192.168.1.1 dst=192.168.1.188 sport=59974 dport=80 [UNREPLIED]
src=192.168.1.188 dst=192.168.1.1 sport=80 dport=59974 use=1
---------
The sport is in the 56000 range and the dst is in the 192.168.1.* range. 192.168.1.1 is a slack 8.1 router with only sshd running, the rest of the lan are win boxes.
i can't figure it out what's generating these requests...

You slack box isn't a firewall is it.

You should traceroute the incoming port 80 from the router. It shouldn't be passing those packets to the lan if it was configured correctly. I don't know of any default allow all incoming on port 80 as generic iptables config, so I'll assume it's not allowing it. And that the scan is coming from the router itself.

Since this is something you seem to have just noticed, I'll assume that it was at one time configured correctly. Since that time, two things could have happened. You may have be running wget or another http program on your router- unlikely- or your lil sshd box has been hacked and you need to get that shit off the net.

So in short, u b farkd.

It is a firewall (i mean i use iptables, FORWARD default policy DROP, INPUT and OUTPUT ACCEPT, I only allow connections from my LAN to the internet and ESTABLISHED,RELATED back in). There was a powerfail a few days ago and the server restarted. After that I noticed the unexplained traffic and I used wget to download chkrootkit. Not sure though if the bogus traffic started before or after using wget. I have openssh3.6.1p1 which i know is secure.

I think those requests appear because of a guy in our LAN that uses kazaa (with that option that enables kazaa to use port 80).