I have noticed similar behaviour as well. I also run gtk-gnutella on a high port number. My firewall however, detects on average one to two connection attempts on port 80 per hour. On forwarding the port and using netcat to gain a data snapshot it turns out to be Limewire (or Limewire varients) attemption to do a file transfer from my port 80. Often times it appears to be Limewire clients running behind a NAT (the handshake return address is a reservered non-routable net). It may happen from other non Limewire clients though, it has never bothered me enough (once I found out what it was) to actually take a large enough data sampling to try and solve it.