Exam 312-50v10 topic 1 question 142 discussion

This should be a TCP Connect scan, which is the noisiest and most likely to be logged.

TCP Connect scan

Refer this article - https://www.ciscopress.com/articles/article.asp?p=469623&seqNum=5 The TCP Full Connect can be detected by IDS

Fundamentally, an idle scan consists of three steps that are repeated for each port: Probe the zombie's IP ID and record it. Forge a SYN packet from the zombie and send it to the desired port on the target. Depending on the port state, the target's reaction may or may not cause the zombie's IP ID to be incremented. Probe the zombie's IP ID again. The target port state is then determined by comparing this new IP ID with the one recorded in step 1.

TcP sync scan, or -sS rpvodies a sync with no ack hence doe snot complete 3way handshake

IP spoofing is the creation of Internet Protocol (IP) packets which have a modified source address in order to either hide the identity of the sender, to impersonate another computer system, or both. ... If the packet has been spoofed, the source address will be forged.