I have not seen this specifically, however this may be related to TCP handshake optimization some devices do, especially related to WAN optimization. If you've confirmed this not an attack, you can set an Alert filter for this.
after further invectigation and understanding riverbed function adn deployment on our network
we conclude thsi as false positive and filter has been made.
I have also seen this traffic
We utilise the Riverbed appliances and we too see the Ack port scans.
It would appear to be normal traffic and we too have applied suppression to the alerts - it may have something to do with the device scanning through for other Riverbeds
Yeap this happen because tcp can flow in betweeen riverbeds devices so when sensor detect only ACK from particular device, it's treat as ACK scanning.